Legal
Privacy policy
This policy explains what personal data Liyagent Private Limited collects, why, on what legal basis, how long it is kept, who else handles it, and how you can exercise your rights. It covers our website, documentation, demo and sales channels, and explains what happens when one of our customers uses our platform with your data.
On this page
- Who we are and how to reach us
- Our two roles: controller and processor
- What we collect and where it comes from
- Why we use it, and our lawful basis
- The site assistant chat and the Agent finder
- When we act for our customers
- AI, automated decisions and labels
- Who receives your data
- International transfers
- How long we keep it
- How we protect it
- Your rights
- If you are in India (DPDP Act 2023)
- If you are in California (CCPA/CPRA)
- Children
- Cookies and local storage
- Changes to this policy
- Contact and complaints
Liyagent Private Limited is a private limited company being incorporated in India. Its Corporate Identity Number and registered office will be published here once issued. A UK company will follow.
The short version. We collect what you send us (a demo request, an email, a privacy request) and the minimum a web server needs to work. We count the steps of a visit in daily totals on our own server, with no cookies and nothing that identifies you. We load third-party tools (LinkedIn Insight Tag) only if you allow them, and nothing else from third parties. We do not sell or share your personal information. When a company runs our software with its own data, that company decides what happens to it and we act on its instructions.
To exercise a right, use the privacy request form or write to privacy@liyagent.com.
01Who we are and how to reach us
The website at liyagent.com, its documentation, the hosted demo and the TicketIQ and Liya agent products are run by Liyagent Private Limited ("Liyagent", "we", "us").
- Company
- Liyagent Private Limited
- Corporate Identity Number
- U62011KA2026PTC230273
- Registered address
- [to be published]
- Privacy contact
- privacy@liyagent.com
- Grievance Officer (India)
- [to be published], reachable at privacy@liyagent.com
- EU representative
- [to be published]
- UK representative
- [to be published]
We have not appointed a data protection officer: neither the GDPR nor the DPDP Act requires one for the processing we do. Privacy questions go to the privacy contact above, which is read by the people responsible for privacy at Liyagent.
02Our two roles: controller and processor
Data protection law treats us differently depending on whose data it is and who decides what happens to it.
Where we decide (we are the controller)
We are the controller (a "data fiduciary" under India's DPDP Act, a "business" under California law) for personal data we collect for our own purposes:
- visits to our website and documentation;
- demo, pilot and design-partner requests you send through the website, and our follow-up;
- emails you exchange with us, including with sales;
- the site assistant chat and the Agent finder, where the website offers them (see the site assistant chat and the Agent finder);
- accounts we create for you on our hosted demo, and what you do there;
- privacy requests you send us.
This policy is mainly about these.
Where a customer decides (we are the processor)
Companies use our platform (TicketIQ and the Liya agents for IT, HR, SAP and finance) to handle their own employees' and customers' requests. When they do, the customer is the controller and decides what personal data the agents handle and why. If we handle that data at all, we are the customer's processor and act only on its documented instructions, under our Data Processing Addendum. Most customers run the platform in their own cloud or data centre, in which case we do not receive that data at all. See when we act for our customers.
If you are an employee or a customer of one of our customers and have a question about your data in their system, please contact them first. If you contact us, we will pass your request to them and tell you we have done so.
03What we collect and where it comes from
| What | Examples | Where it comes from |
|---|---|---|
| Demo, pilot and design-partner requests | Name, work email, company, role (optional), the product you are interested in, the systems you use, and what you would like an agent to do | You, through the request form on our website |
| Correspondence | Your email address and name, your signature details, and what you write to us and we write back | You, when you email us |
| Privacy requests | Name, email, how you know us, the right you are exercising, details you give us, whether you confirmed your address, and how we answered | You, through the request form or by email; our own handling notes |
| Hosted demo and pilot accounts | Your username, role and a salted hash of your password (never the password itself); what you do in the console (recorded in its audit log); what you type to the agents and what they answer; tickets you create; if you use the demo agent in Microsoft Teams, the name, Microsoft account identifier and email address Teams gives us | You, and your organisation when it asks us for an account for you; Microsoft, when you use Teams |
| Site assistant chat and Agent finder | What you type and the answers you are given | You, where the website offers them |
| Technical data | Your IP address and the request your browser makes; a session cookie when you sign in, and for each signed-in session how you signed in (password or single sign-on), when, and when you last used it (so an inactivity limit can sign you out, and an administrator can see who is signed in and sign a session out) | Your browser |
What we do not collect. We do not use third-party analytics, session recording or fingerprinting. No advertising or social media tools run unless you allow them in Cookie settings (see cookies). Apart from those tools (LinkedIn Insight Tag), our pages load no scripts, fonts or images from third parties. The visit counts described under cookies stay on our own server. We do not buy personal data or collect it from data brokers. We do not ask for special category data (health, religion, ethnicity, sexual orientation and the like) on the website; please do not put any in a form or an email to us.
Server logs. Our web server keeps an access log: for each request, the time, your IP address, the method and page path (never the query string), the response status, its size and how long it took. It never records cookies, sign-in tokens, other request headers or anything you type. We keep it for 12 months for security, to investigate incidents and because India's CERT-In Directions require logs of our systems for at least 180 days. The legal basis is our legal obligation (Art. 6(1)(c)) and our legitimate interest in keeping the service secure (Art. 6(1)(f)). The server also processes your IP address while it answers each request and to limit how often one address can use our forms and sign-in. When you send a form, the request is recorded in our audit log with its time and the network address it came from, but not what you wrote. The application's own logs record errors and the service's operation, not what you type, and are kept for the same 12 months. All of these logs are stored with Amazon Web Services in the Asia Pacific (Sydney) region.
04Why we use it, and our lawful basis
Under the GDPR and UK GDPR (Article 6) we need a lawful basis for each use. Under India's DPDP Act we rely on your consent or on a "legitimate use" (section 7), such as data you gave us voluntarily for a purpose you stated.
| Purpose | Data used | GDPR / UK GDPR basis | DPDP Act basis |
|---|---|---|---|
| Showing you the website and documentation, keeping them secure and stopping abuse (rate limits, spam protection) | Technical data | Legitimate interests (Art. 6(1)(f)): running a working, secure website | Legitimate use: data you provide by visiting, for that purpose |
| Answering your demo, pilot or design-partner request, arranging a demo, and discussing a possible contract | Request data, correspondence | Steps you asked for before entering a contract (Art. 6(1)(b)); for contacts acting for a company, legitimate interests (Art. 6(1)(f)) in answering business enquiries | Legitimate use: data you gave voluntarily for this purpose (s. 7(a)) |
| Following up about our products after your request or a demo | Request data, correspondence | Legitimate interests (Art. 6(1)(f)) in business-to-business follow-up; you can object at any time and we will stop | Consent, which you can withdraw at any time |
| Answering questions in the site assistant chat and the Agent finder | What you type | Legitimate interests (Art. 6(1)(f)) in answering visitors' questions | Legitimate use: data you gave voluntarily for this purpose |
| Providing hosted demo and pilot accounts, supporting you, and keeping the demo secure | Account data, activity, what you type to agents | Contract (Art. 6(1)(b)) with you or your organisation; legitimate interests (Art. 6(1)(f)) in security and audit | Legitimate use (s. 7(a)); consent where it applies |
| Handling your privacy requests and keeping a record of how we did | Privacy request data | Legal obligation (Art. 6(1)(c)) and Art. 5(2) accountability | Compliance with the DPDP Act (s. 7) |
| Keeping security and audit records, and establishing or defending legal claims | Audit log entries, correspondence | Legitimate interests (Art. 6(1)(f)); legal obligation where a law requires records | Legitimate use for compliance with law (s. 7) |
| Optional cookies, only if you allow them: measuring how well our ads work | What the tools in the cookies section collect | Consent (Art. 6(1)(a)), which you can withdraw at any time in Cookie settings | Consent, which you can withdraw at any time |
| Remembering your display choices (theme, sidebar) in your own browser | Local storage on your device | Strictly necessary for a feature you asked for (see cookies) | Not personal data we receive |
Where we rely on legitimate interests, we have weighed them against your interests and rights; you can ask us for that assessment. You are never required to give us personal data; if you do not, we may not be able to answer a request or give you a demo account.
05The site assistant chat and the Agent finder
Parts of the website may offer a site assistant chat (an AI assistant that answers questions about our products) and the Agent finder at /start (which suggests an agent for the work you describe). Where they are offered:
- they are labelled as AI and their answers can be wrong;
- what you type is processed to produce an answer, which may involve one of the AI model providers listed on our sub-processors page;
- the conversation is not kept after it ends unless you choose to send it to us as a demo request, in which case what you send is stored as a demo request and handled as described here;
- if you ask the Agent finder to email you its blueprint, we send that one email to the address you give, keep the address and the blueprint with our demo requests (so we can reply if you write back), and tell our sales team; we send nothing else unless you ask;
- please do not type sensitive personal data into them.
06When we act for our customers
When a customer runs our platform, its agents handle requests from the customer's employees and customers: IT tickets, HR questions, purchasing and invoice look-ups. The customer chooses the systems the agents connect to (for example ServiceNow, Jira, Microsoft Teams, Workday or SAP), the AI models they use, and how long records are kept. The customer's own privacy notice tells you how it uses your data.
If we provide a hosted pilot, support a customer, or otherwise handle that data, we do so as a processor under our Data Processing Addendum: only on the customer's instructions, with confidentiality, the security measures listed in it, and the sub-processors it names. For self-hosted deployments where the customer brings its own AI models, we receive none of that data unless the customer gives us access, for example in a support session.
Sensitive data in HR agents
HR agents can come close to special category data. The platform is built to keep it away from AI models and to put people in charge:
- a sensitive HR matter, such as a grievance, harassment, discrimination, a medical condition, a dismissal or a pay dispute, is not answered by a model: a seeded guardrail refuses it and hands it to the customer's HR team, and the conversation is kept as metadata only (who, when, which agent), not its words;
- an HR agent answers an employee only about their own record, using that employee's own access, and any change it prepares (a time-off request, a profile update) is sent only after the employee confirms it;
- guardrails can mask or tokenise personal identifiers, such as email addresses and phone numbers, before text reaches a model, and put them back only inside the customer's own system;
- a customer can require that a tenant's AI calls stay inside a chosen geography (data residency), and the call is refused rather than sent elsewhere.
The customer, as controller, decides whether it may process special category data and on what condition (GDPR Article 9).
07AI, automated decisions and labels
Our agents use AI models to classify, route and prioritise requests, find relevant knowledge and draft answers. Agents built on our platform tell people they are an AI assistant whose answers can be wrong (in Microsoft Teams, for example, in the agent's description and its help message), and always offer a way to reach a person by filing a ticket.
Neither we nor our platform make decisions about you based solely on automated processing that produce legal effects or similarly significant effects (GDPR Article 22). Sensitive HR matters go to people; actions an agent prepares on your behalf wait for your confirmation; and customers can require a person's approval before an agent takes a risky step. A customer that chooses to use the platform for a decision of that kind is responsible, as controller, for the safeguards the law requires.
We do not use your personal data to train AI models of our own. Some AI model providers that answer on our public website and hosted demo (the site assistant chat, the Agent finder and the demo agents) are used on free plans whose terms may let the provider use what is sent to improve its services; that is one more reason not to type personal data into them. The providers are listed on our sub-processors page.
08Who receives your data
We share personal data only with:
- Our service providers (sub-processors), who host our website and demo, send our email, and run the AI models the hosted demo uses, under contracts that limit them to providing that service. They are listed, with what they receive and where, on our sub-processors page.
- Your employer, if you are an employee of one of our customers and you send us a request about their system: we forward it to them, as they decide on it.
- Authorities and advisers, where the law requires it or to establish, exercise or defend legal claims; and professional advisers bound by confidentiality.
- A buyer or successor, if our business is reorganised, merged or sold, under this policy's protections; we would tell you first.
We do not sell personal data, rent it, or share it for advertising.
09International transfers
Liyagent is based in India. Our website and hosted demo run on Amazon Web Services in the Asia Pacific (Sydney) region, Australia. Some of our sub-processors are in the United States. So personal data you send us may be handled in India, Australia and the United States.
The European Commission and the UK have not found these countries to provide adequate protection, except for US companies certified to the EU-U.S. Data Privacy Framework (and its UK Extension). Where personal data from the European Economic Area, the UK or Switzerland is transferred to a recipient without such a finding, we use the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data), or the Data Privacy Framework where the recipient is certified, together with the security measures described below. You can ask us for a copy of the relevant safeguards at privacy@liyagent.com.
Under India's DPDP Act, personal data may be transferred outside India except to a country the Government of India restricts; we will follow any such restriction.
10How long we keep it
We keep personal data only as long as we need it for the purposes above, then delete it. The periods below are the ones our software applies automatically, every day, unless a legal hold requires us to keep something longer.
| Data | How long |
|---|---|
| Demo, pilot and design-partner requests | 24 months from receipt, then deleted; the IP address kept with a request is blanked after 90 days |
| Privacy requests and how we answered them | 3 years from receipt once the request is closed (as evidence we handled it), then deleted; the IP address is blanked after 90 days |
| Correspondence with us | While the conversation is active and for up to 24 months after our last contact, unless it becomes part of a contract |
| Hosted demo: conversations with agents | 90 days |
| Hosted demo: the record of how each ticket was processed, and agent telemetry | 12 months and 14 days respectively |
| Hosted demo: answer records and unanswered-question reports | 90 days and 90 days |
| Hosted demo: tickets, attachments and accounts | For as long as your evaluation continues; we delete them when it ends or when you ask |
| Audit log (security and accountability record) | 12 months |
| Web server access log and the service's operational logs (see server logs) | 12 months, then deleted |
| Consent receipts: a record of each cookie choice, with no IP address or browser details (see cookies) | 2 years, then deleted |
| Sign-in session, with when it began and was last used | 12 hours, or until you sign out, an administrator signs it out, or it goes unused for longer than an inactivity limit the administrator sets (none by default); then deleted within 10 minutes |
Data in backups is deleted as the backups are replaced. In customer deployments the customer sets these periods; our defaults are shown in our documentation.
11How we protect it
We use technical and organisational measures appropriate to the risk, including:
- Encryption in transit: the website and demo are served only over HTTPS (TLS 1.2 or later), with HTTP Strict Transport Security.
- Encryption of stored secrets and sensitive records: credentials, agents' memory and cached answers are sealed with AES-256-GCM under a key-encryption key kept outside the database (and can be held in a cloud key management service), so a copy of the database or a backup alone does not open them.
- Access control: sign-in with roles and fine-grained policies on every request, single sign-on, rate limits and lockouts on sign-in, and administrator-only access to privacy tools.
- Tamper-evident audit log: every administrative action and agent action is written to a hash-chained log that can be verified and exported.
- Data minimisation and masking: guardrails can mask or tokenise personal data before it reaches an AI model, and our own forms keep only what they need.
- Hardened pages: a strict Content Security Policy, no third-party code unless you allow optional cookies, and protection against framing.
- Erasure with receipts: our privacy tools find a person across every store, and erase them with a receipt for each store and a check that nothing is left.
No system is perfectly secure. If a breach affects your personal data and is likely to put you at risk, we will tell you and the relevant authorities as the law requires.
12Your rights
If you are in the European Economic Area or the UK, you have these rights under the GDPR and UK GDPR. We extend them to everyone, wherever you are.
- Access: to know whether we hold your data and get a copy of it.
- Rectification: to have inaccurate data corrected and incomplete data completed.
- Erasure: to have your data deleted, unless we must keep it (for example, to show how we answered a privacy request, or to meet a legal obligation).
- Restriction: to have us keep your data but stop using it, for example while we check its accuracy.
- Portability: to receive data you gave us in a structured, machine-readable format (we provide JSON).
- Objection: to object to our use of your data based on legitimate interests, and to stop direct marketing at any time.
- Withdraw consent: where we rely on consent, at any time, without affecting what we did before.
- Complain: to a supervisory authority (see contact and complaints).
How to exercise them
Use the privacy request form or email privacy@liyagent.com. We will email you a link to confirm the address is yours before we act, so that nobody else can obtain or delete your data. We answer within one month (30 days) of receiving your request. If a request is complex or one of many, we may extend this by up to two further months; we will tell you why within the first month. We do not charge, unless a request is manifestly unfounded or excessive.
If your request is about a customer's deployment of our platform, we will forward it to that customer (the controller) and help it answer you.
13If you are in India (DPDP Act 2023)
Under the Digital Personal Data Protection Act, 2023 and its Rules, you have the right to:
- obtain a summary of the personal data we process about you and the processing we do, and the identities of those we have shared it with;
- have your personal data corrected, completed, updated or erased;
- withdraw consent you gave, as easily as you gave it;
- have a grievance about our handling of your data addressed by us;
- nominate another person to exercise your rights if you die or become unable to.
Grievance Officer. [to be published], at privacy@liyagent.com, or through the privacy request form (choose "DPDP grievance"). We aim to answer every grievance within 30 days, well inside the period the DPDP Rules allow. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
You may ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India.
14If you are in California (CCPA/CPRA)
This section is our notice at collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, to the extent it applies to us.
- Categories we collect: identifiers (name, email address, IP address, account name); professional information (company, role); commercial information (the products you are interested in); internet activity limited to your requests to our site and actions in the demo console; and the content of messages you send us. We do not collect sensitive personal information as defined by the CCPA, other than account sign-in credentials for the demo, which we use only to sign you in.
- Sources and purposes: as set out in what we collect and why we use it.
- Retention: as set out in how long we keep it.
- We do not sell or share personal information (including for cross-context behavioural advertising), and have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16.
- Your rights: to know what we collect, use and disclose; to delete; to correct; and not to be discriminated against for exercising these rights. Because we do not sell or share personal information or use sensitive personal information beyond permitted purposes, there is nothing to opt out of or limit, but you may still ask us. You may use an authorised agent; we will ask the agent for your signed permission and confirm your identity with you.
- How to exercise them: the privacy request form or privacy@liyagent.com. We confirm receipt within 10 business days and answer within 45 days (extendable once by 45 days, with notice).
15Children
Our website, demo and products are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16 (or under 18 in India). If you believe a child has sent us personal data, contact privacy@liyagent.com and we will delete it.
16Cookies and local storage
We use no optional cookies without your consent. With your consent, and only then, the public website loads these tools: LinkedIn Insight Tag (see below). A banner asks first. Accept and Decline carry equal weight, and Manage choices lets you decide category by category. Nothing optional loads until you allow its category. Everything else our pages store is strictly necessary, remembers a choice you made on your own device, or counts visits in daily totals as described below.
Categories. We group cookies and similar storage by what they are for.
- Necessary
- Keep the site working and secure, and remember the choices you make here. Always on.
- Functional
- Remember things that make the site easier to use beyond what it strictly needs, such as your preferences from one visit to the next. We do not use any at present.
- Analytics
- Help us understand how people use the site, so we can improve it. We do not use any at present.
- Marketing
- Measure how well our ads work, for example whether people who saw one later visited the site or booked a demo. Off unless you turn it on. Used by: LinkedIn Insight Tag.
Counting visits, not visitors. To see which parts of the public website work, its pages count the steps of a visit (for example, that a visit reached the Agent finder's blueprint or booked a demo). Each count carries the step, the page's address, the campaign named in the link you arrived by, which version of a page you were shown, and a random identifier for the visit that your browser keeps in the tab's session storage. We store only daily totals: the identifier is kept only as a code that changes every day and is deleted after 30 days, and never with your IP address, your browser's details or anything you typed. The totals are kept for 13 months. Nothing else in local or session storage is sent to us.
| Name | Type | Where | Purpose | Lasts |
|---|---|---|---|---|
tiq_session | Cookie (HttpOnly, Secure, SameSite=Lax) | Sign-in and console | Keeps you signed in | 12 hours, or until you sign out or the session ends sooner (see above) |
tiq_sso | Cookie (HttpOnly) | Single sign-on | Protects a sign-in through your organisation's identity provider against forgery | 10 minutes |
tiq-docs-theme, tiq-docs-collapsed, tiq-labs-view | Local storage | Documentation and these legal pages | Remember the light or dark theme, whether the sidebar is collapsed, and the labs list layout you chose | Until you clear it |
tiq-docs-votes | Local storage | Documentation | Remembers your "Was this helpful?" answers in your browser only; they are not sent to us | Until you clear it |
tiq_theme and console preferences (tiq_audit_*, tiq_telemetry_*, tiq_tx_columns) | Local storage | Sign-in page and console | Remember your theme and how you arranged console screens | Until you clear it |
tiq_branding, tiq_perm_schema, tiq_next_toast, tiq.home.dismissed, tiq_pg_session_* | Session storage | Console | Cache the product name and colours and the list of console permissions, carry a message to the next page, remember dismissed tips, and keep a playground conversation open | Until you close the tab |
liyagent.chat.teaser | Local storage | Website (site assistant chat) | Remembers that you closed the chat's greeting, so it is not shown again | Until you clear it |
liyagent.app.install-dismissed | Local storage | Workspace (/workspace) | Remembers that you dismissed the offer to install the Liyagent app | Until you clear it |
liyagent.workspace.ai-notice, liyagent.workspace.agent, liyagent.workspace.session.* | Local storage | Workspace (/workspace) | Remembers that you read the notice that Liya is an AI assistant, which agent you last chose, and the chat you had open with each agent | Until you clear it |
liyagent.chat.wake, liyagent.chat.wake.off | Session and local storage | Website (site assistant chat) | Show the assistant's greeting once a visit, and never again after you close it | Until you close the tab, or until you clear it |
liya.open | Session storage | Console | Where you clicked a link, so the next page opens from that point, then removed | Until the next page opens |
liyagent.announce.dismissed, liyagent.announce.last | Local storage | Website and documentation | Remember that you closed the announcement bar, and the last one shown | Until you clear it |
liya.try.v1, liya.try.journey.v1 | Session and local storage | Try it live (/try) | Keep your sample changes in this tab, and where you got to (which sample system, what you have tried) so you can continue on a later visit; it is sent to us only as part of your requests to the sample | Until you close the tab; the progress until you choose Start over or clear it |
liyagent.finder.v1 | Session storage | Agent finder (/start) | Keeps your Agent finder conversation in this tab while you browse; it is not sent to us unless you send it as a demo request or have the blueprint emailed to you | Until you close the tab |
liyagent.funnel.* | Session storage | Website | The visit's random identifier, the campaign of the link you arrived by, the versions of pages you were shown, and whether your arrival was already counted, for the daily totals described above | Until you close the tab |
liyagent.consent.v2 (it replaces liyagent.consent.v1, which is removed on your next visit) | Local storage | Website, only while we offer optional cookies | Remembers which optional cookies you allowed, when, under which version of our list of tools, and your consent receipt number, so we do not ask on every page | 180 days, then we ask again |
liyagent.agent.setup.* | Local storage | Console (an agent's page) | Remembers that you dismissed a new agent's setup checklist, or kept its default context window | Until you clear it |
Third parties, only with your consent.
LinkedIn Insight Tag (marketing)
Run by LinkedIn, under LinkedIn's privacy policy.
| Name | Type | Where | Purpose | Lasts |
|---|---|---|---|---|
li_fat_id, li_giant, ln_or, oribili_user_guid, li_adsid | Cookies on this site | Website, only after you allow marketing cookies | Tells us how many people who saw or clicked our LinkedIn ads visited the site or booked a demo. LinkedIn receives what its tag collects (the page, your IP address and browser details, and its cookies) and also uses it under its own privacy policy. Withdrawing consent removes these cookies from this site. | Up to 6 months for most. See LinkedIn's cookie table |
bcookie, lidc, li_sugr, UserMatchHistory, AnalyticsSyncHistory | Cookies on LinkedIn's own domain | Website, only after you allow marketing cookies | Set by LinkedIn for the same purpose. Only you can clear them, in your browser | Up to 6 months for most. See LinkedIn's cookie table |
Changing your choices
Use Cookie settings at the foot of our pages at any time. Turning a category off stops its tools loading from the next page, and removes the cookies they set on this site. Cookies a third party set on its own domain can only be cleared in your browser.
We keep your choice in your browser for 180 days, then ask again. We also ask again when we add a tool or move one to another category, so a choice always covers what we actually use.
Global Privacy Control
If your browser sends a Global Privacy Control signal, we treat it as a refusal of every optional category. We do not show the banner and load nothing optional, unless you open Cookie settings and turn a category on yourself.
Consent receipts
Each time you make a choice, your browser sends us a receipt: a random receipt number made in your browser, the categories you allowed, the version of this list of tools, and whether your browser sent Global Privacy Control. We add the time. We do not store your IP address or browser details with it, so a receipt does not identify you. It lets us show what was agreed and when. Your browser keeps the receipt number with your choice. We keep receipts for 2 years, then delete them.
You can clear cookies and local storage in your browser settings at any time. Blocking them does not affect the public pages; you cannot sign in to the console without the session cookie.
17Changes to this policy
We will update this policy when what we do changes. The date at the top says when it last changed. If a change materially affects how we use personal data we already hold, we will tell the people affected (for example, by email) before it takes effect. Changes to our sub-processors are announced on the sub-processors page.
18Contact and complaints
Email privacy@liyagent.com, use the privacy request form, or write to Liyagent Private Limited, [to be published].
If you are unhappy with how we handled your data, please tell us first and we will try to put it right. You also have the right to complain to a supervisory authority:
- in the European Economic Area, the data protection authority of the country where you live, work, or where you think the problem happened (the European Data Protection Board lists them all at edpb.europa.eu);
- in the UK, the Information Commissioner's Office (ico.org.uk);
- in India, the Data Protection Board of India, after you have used our grievance process;
- in California, the California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General.