Privacy
A contact form, a theme preference in your own browser, and a hashed count to stop one machine flooding the form. This page says what happens to each.
About this page. It describes how this website works and what it does with what you send it. It is not legal advice, and it does not vary any agreement you have signed with us — where the two differ, the signed agreement governs.
Scope
This covers itzal.ai, the marketing website. What the Itzal product does with data on an employee's device is a different question with a different answer, and it is described in the privacy architecture and governed by the agreement a customer signs.
The form on /contact and /demo asks for your name, work email, organisation, and what you need — a topic and a rough device count. Your role, your country and a message are optional. Nothing else on the site collects anything about you.
There is one field you will not see: a hidden input a person never fills in and an automated script usually does. If it arrives filled, the submission is discarded.
Straight to a mailbox we read, sent through Amazon SES in us-east-1.
It is not passed to a third-party form service, a CRM we have not named here, a
mailing list, or any enrichment service that would attach to you what you did not
tell us.
Two processors are involved and both are named rather than implied: Cloudflare, which serves this site and through whose network your submission passes, and Amazon Web Services, which delivers the mail.
To stop one machine flooding the form, the server counts recent submissions per origin. It does that against a SHA-256 hash of your IP address, never the address itself, and the count expires after an hour. A rate limiter needs to know that two submissions came from the same place; it never needs to know where.
Your country — the country alone, derived by Cloudflare from the connection — is attached to the submission so a reply arrives at a sensible hour.
This site sets no cookies. If you use the light/dark toggle, that
choice is stored in your browser's local storage under itzal-theme. It
stays on your device, is never sent to us, and clearing site data removes it.
A submission is kept while the conversation it started is live, and deleted afterwards. Ask us to delete it sooner and we will.
Ask for a copy of what we hold, ask for it corrected, or ask for it deleted, by writing to us through the contact form, which reaches a named person rather than a queue. We will not ask you to prove anything beyond enough to be sure we are answering the right person.
Depending on where you live you may also have the right to complain to a supervisory authority. Our establishment is in India, so the Data Protection Board of India is the relevant body under the Digital Personal Data Protection Act. If you are in another jurisdiction you may also have a route to your own regulator; we will not object to you using it.
No analytics script, session recorder or advertising pixel is part of this site, and the Content-Security-Policy it is served under names the hash of every script that may run, so one could not be added quietly. One exception, stated because it is currently true: our host injects Cloudflare Web Analytics into pages served to browsers. The policy above blocks it from executing, but it is present in the markup and you can see it in view-source. It is being turned off; until it is, this paragraph is the accurate statement and the “no analytics script” line on the contact and demo pages is not.
Who we are
Itzal, Bangalore, Karnataka, India.
Questions about this page go through the contact form, which reaches a named person rather than a queue. Security reports go to security@itzal.ai instead — the terms are in security.txt.
The privacy architecture page explains what the product does on the device, which is the question behind this one.