Our privacy notice.
We sell privacy tooling, so this page holds itself to the standard we sell. It explains what this website collects, why, who it goes to, and how to make us stop.
Last updated: 14 August 2026
Who we are
This website, neostra.io, is operated by Nyusta Labs LLP ("Neostra", "we", "us"). For anything in this notice, contact info@neostra.io.
249/29, Laughing Waters, Ramagondanahalli, Whitefield, Bangalore 560066
This notice covers the website only. Where Neostra processes personal data inside the platform on behalf of a customer, that customer is the Data Fiduciary or Controller and their own privacy notice applies. We act on their documented instructions.
What we collect
We collect only what you choose to send us. Specifically:
When you request a demo or apply to the Readiness Program
Your name and work email address, which are required, and optionally your company name, company size, area of interest, DPDPA preparation stage and any message you write. We use this solely to respond to your enquiry.
When you run the readiness check
Your answers stay in your browser while you take the check. When the check completes we record the resulting score and answers without any identifier, so we can understand how prepared organisations are in aggregate. Your email address is attached to that record only if you ask us to send you the report.
When you submit a privacy rights request
Your name, email address, the right you are exercising and any detail you provide. We need this to identify you and act on the request.
Automatically
Our servers log the IP address, user agent and requested URL of each request, which is ordinary web-server behaviour and is used for security and troubleshooting. We apply a short-term rate limit to our form endpoints, which briefly holds an IP address in memory.
We do not set advertising cookies on this website, and we do not use third-party analytics that profile you across sites. Web fonts are served from our own domain rather than a third-party CDN, so loading this page does not disclose your IP address to a font provider.
Why we may lawfully process it
Under the DPDPA we rely on your consent, which you give by submitting a form after reading this notice. Under the GDPR, where it applies, we rely on your consent for marketing enquiries and on our legitimate interest in operating and securing this website for server logs. You can withdraw consent at any time, as easily as you gave it, by emailing info@neostra.io.
Who receives it
Your submission is delivered to the Neostra team, and to the service providers below. We do not sell or share personal data for advertising, and we do not sell or share personal information as those terms are defined under the CCPA and CPRA.
| Recipient | Purpose | Location |
|---|---|---|
| Google Cloud (Cloud Run, asia-south1) | Website hosting and server logs | Mumbai, India |
| Google Workspace (Gmail SMTP) | Delivery of form submissions to the Neostra team by email | Global |
| Anthropic and Voyage AI | The optional DPDPA Q&A assistant: question text is processed to generate an answer | United States |
The website itself is hosted in Google Cloud's Mumbai region (asia-south1), so page requests and server logs stay in India. Where a recipient above is outside India, the transfer is limited to the purpose stated and is governed by our agreement with that provider.
How long we keep it
We keep enquiry records for 24 months from your last contact with us, then delete them. Server logs are retained for a short operational period.
Your rights
Depending on where you are, you have the right to know what we hold about you, to get a copy, to have it corrected, to have it erased, to withdraw consent, and to nominate someone to exercise these rights on your behalf. Under the GDPR you also have rights to data portability, to object to processing, and to restrict processing. Under the CCPA and CPRA you have the right to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and not be discriminated against for exercising any of them.
The fastest route is our privacy rights request form. You can also email info@neostra.io. We respond within 30 days, and within 45 days for CCPA requests.
Grievance redressal
If you are not satisfied with our response, contact our Grievance Officer, Nivya Ajit, at nivya@neostra.io. If the matter remains unresolved you may escalate it to the Data Protection Board of India.
Security
This site is served over HTTPS only. Form submissions are validated and rate limited server-side, and credentials for our delivery providers are held in Google Secret Manager rather than in code. No system is perfectly secure, and we will tell affected people and the Data Protection Board without delay if a breach affects personal data, as the DPDPA requires.
Children
This website is aimed at businesses and is not directed at children. We do not knowingly collect personal data of anyone under 18. If you believe a child has sent us personal data, email us and we will delete it.
Changes
If we change this notice we will update the date at the top of the page. Material changes that affect how we use data you have already given us will be notified to you directly.
Exercise your rights, now.
The same request workflow we sell to our customers, pointed at ourselves.