Privacy Policy

Last updated 7 September 2026 · Version 2.1

Who we are

This policy is issued by Nunnari Labs Private Limited (“Nunnari Labs”, “we”, “us”), an AI engineering company incorporated in India with its principal office in Coimbatore, Tamil Nadu. We deliver engagements in Australia and New Zealand with our exclusive partner DeepWeaver Technologies Pty Ltd, Sydney. Where DeepWeaver leads a client engagement, DeepWeaver may also be a controller of the personal information handled under that contract, under its own privacy policy.

Nunnari Labs is the controller (in India, the “data fiduciary”) for personal information collected through this website and through our sales, delivery and recruitment activities.

What we collect, and where it comes from

• Contact and enquiry details you give us through the contact form, by email, or when you book a call: name, organisation, role, email address, phone number, and the content of your message.
• Business relationship records for clients, partners and suppliers: contact details, contract and billing information, and correspondence.
• Candidate information when you apply for a role or write to careers@nunnarilabs.com: your CV, contact details, work history and anything else you choose to include.
• Website usage data collected automatically: pages viewed, referring site, device and browser type, and approximate location derived from your IP address.
• Technical data in server logs: IP address, request time and the resource requested.

We do not collect payment card details through this website, and we do not knowingly collect personal information from children.

Why we use it, and on what basis

• To respond to enquiries and arrange calls you request. Basis: your request, and our legitimate interest in responding to it.
• To scope, deliver, invoice and support client engagements. Basis: performance of a contract, and legal obligations such as accounting and tax.
• To assess job applications and contact candidates. Basis: your application, and steps taken at your request before entering a contract.
• To understand how the website is used and improve it. Basis: our legitimate interest in running a secure, useful website. Analytics runs only with your consent, given through the banner on your first visit and changeable at any time.
• To meet legal, regulatory and security obligations, including our ISO/IEC 42001 AI management system, which requires records of how systems are governed and operated.

We do not sell personal information, and we do not use it for automated decisions that have legal or similarly significant effects on you.

Who we share it with

We use a small number of service providers who process personal information on our behalf under contract. As of the date above, these are:

We may also share personal information with DeepWeaver Technologies for engagements they lead; with professional advisers such as lawyers, accountants and auditors, including ISO/IEC 42001 certification auditors; and with regulators or law enforcement where the law requires it. We do not share client project data with any party other than the client and the processors named in that client’s contract.

International transfers

We operate from India and Australia, so personal information may be accessed by our teams in either country. The providers listed above store data mainly in the United States. Where information leaves the country it was collected in, we rely on contractual protections with the recipient and, for client engagements, on the data residency terms agreed in the contract. Clients who require data to stay in-country can be served from in-jurisdiction infrastructure; ask us about our sovereign AI deployments.

How long we keep it

• Enquiries and call bookings: up to 24 months after our last contact, unless a client relationship follows.
• Client, partner and supplier records: for the life of the relationship and then for as long as tax, accounting and contract law require, typically 7 years.
• Candidate information: 12 months after the recruitment decision, unless you ask us to keep it longer or to delete it sooner.
• Website analytics: Google Analytics retains event data for up to 14 months. Server logs are kept for up to 30 days.

Cookies and analytics

This website uses Google Analytics to measure how the site is used, and only after you accept analytics in the banner shown on your first visit. Until you accept, no analytics script loads and no analytics cookies are set. We use the aggregate reports with IP anonymisation; we do not use analytics to identify individuals, and we do not run advertising cookies. You can change your choice at any time through the “Cookie settings” link in the footer, or by clearing cookies in your browser. The site works the same either way.

How we protect it

We apply technical and organisational measures appropriate to the information we hold: access limited to people who need it, encryption in transit, provider-managed encryption at rest, and the controls of our ISO/IEC 42001-certified AI management system for any system that processes personal data. Client project data is handled under the security terms of each contract, including on-premise and air-gapped deployments where required. No method of transmission or storage is completely secure, and we will notify you and the relevant regulator of any breach where the law requires it.

Your rights

Depending on where you are, you have rights over your personal information. We honour these for everyone we can, regardless of location:

• Access: ask what personal information we hold about you and receive a copy.
• Correction: ask us to correct information that is inaccurate or incomplete.
• Erasure: ask us to delete information we no longer need to keep.
• Withdrawal of consent: where we rely on your consent, withdraw it at any time without affecting earlier processing.
• Objection and restriction: object to processing based on our legitimate interests, or ask us to restrict it while a dispute is resolved.
• Grievance redressal: raise a complaint with us and receive a response within the time the law sets.

In Australia these rights arise under the Privacy Act 1988 and the Australian Privacy Principles. In India they arise under the Digital Personal Data Protection Act 2023. For individuals in the European Union or United Kingdom, they arise under the GDPR and UK GDPR. To exercise any of them, contact us as set out below. We will verify your identity before acting on a request.

Changes to this policy

We review this policy at least once a year and whenever our processing changes. The version and date at the top tell you which edition you are reading. Material changes will be announced on this page before they take effect.