Privacy policy

1. Who is responsible for your data

Ajay Kumar Emani, trading as Lytheo, of Hyderabad, Telangana, India, is the data controller for personal data collected through this website. Under India’s Digital Personal Data Protection Act 2023 the equivalent role is data fiduciary.

Lytheo is not an incorporated company. It is a trading name used by an individual consultant. There is no separate legal entity, and there is no data protection officer — the business does not meet the thresholds at which one is required. All privacy enquiries go directly to hello@lytheo.com.

2. What is collected, and what is not

Data you give me

When you submit the enquiry form or the booking form, the following is collected:

• Your name
• Your email address
• Your company name, if you choose to provide it
• Your preferred call slot and time zone
• Whatever you write in the message field
• Whether you ticked the optional marketing consent box
• The date and time of submission, and the page you submitted from

Please do not include sensitive personal data — health information, financial account details, government identifiers, or anyone else’s personal data — in the message field. If a useful conversation requires discussing sensitive material, ask for an NDA first and we will arrange an appropriate channel.

Data collected automatically

Standard server logs are generated by the hosting provider when any page is requested. These include the IP address, the browser user-agent string, the page requested and the time. They exist for security and to keep the site running, are held by the host under their own retention policy, and are not used to build any profile of you.

When you submit a form, your IP address is used momentarily as a rate-limiting key to prevent automated abuse. It is not stored with your enquiry and is not retained after the request completes.

What is deliberately not collected

• No cookies unless you accept them. The only cookies this site can set are Google Analytics’, and they are set only if you accept when asked. Decline, or simply ignore the question, and nothing is stored on your device and nothing is requested from Google. Full detail, including how to change your answer, is in the cookie policy.
• No advertising or attribution tracking. No Meta pixel, no ad networks, no cross-site tracking, and nothing that follows you to other websites. Google Analytics is used to count visits and see which pages are read — not to build a profile of you or to advertise to you.
• No third-party fonts. Typefaces are served from this site’s own domain, so your IP address is never sent to a font provider merely for loading a typeface. Apart from analytics you have accepted, no page loads code from another company’s server.
• No profiling and no automated decision-making producing legal or similarly significant effects, within the meaning of Article 22 UK/EU GDPR.

3. Why it is used, and the lawful basis

Under India’s DPDP Act 2023, processing is on the basis of the consent you give when submitting the form, for the specific purpose stated at the point of collection. Under California law, none of this constitutes a “sale” or “sharing” of personal information as those terms are defined.

4. Marketing

You will not be added to any mailing list unless you tick the optional box. If you do, messages arrive no more than monthly, every one carries a working one-click unsubscribe, and unsubscribing takes effect immediately. Replying to an enquiry you sent is not marketing and does not depend on that box.

No lists are purchased and no scraped contact data is used for outreach from this business.

5. Who else handles your data

Your enquiry is processed by the following service providers, acting as processors on documented instructions. This is the complete list:

Your data is never sold, rented, traded, or shared with anyone for their own marketing purposes. It may be disclosed where I am legally required to do so, and if that ever happens I will tell you unless I am legally prohibited from doing so.

Enquiry data is not submitted to any AI system for processing. It is read by a person.

6. International transfers

I am based in India and the hosting and email providers listed above operate internationally. If you are in the UK, the EEA or another jurisdiction with transfer restrictions, your data will be transferred outside that jurisdiction.

Those transfers rely on the providers’ own transfer mechanisms — Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent safeguards published in their respective privacy documentation, linked in the table above. Given what is collected — a name, an email address and a message about your business — the risk profile of these transfers is low, but you are entitled to know they happen.

7. How long it is kept

• Enquiries that do not lead to work: up to 24 months from your last contact, then deleted.
• Enquiries that lead to an engagement: retained for the duration of the engagement and afterwards for as long as needed for tax, accounting and legal record-keeping obligations, then deleted.
• Marketing consent records: until you unsubscribe, plus a minimal record of the unsubscription so you are not contacted again by mistake.
• Server logs: per the hosting provider’s retention policy, typically a short rolling window.

8. Your rights

Depending on where you are, you have some or all of the following rights. In practice I honour all of them for everyone, regardless of jurisdiction, because maintaining separate standards would be more work than simply doing the right thing.

• Access — ask for a copy of what is held about you.
• Rectification — have inaccurate data corrected.
• Erasure — have your data deleted.
• Restriction — ask that processing be paused while a dispute is resolved.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, without affecting processing already carried out.
• Non-discrimination — exercising any of these rights will never affect the service or pricing you receive.

To exercise any of them, email hello@lytheo.com. There is no charge. I will respond within 30 days, and usually within a few working days — the volume of enquiries this site receives does not make this a difficult promise to keep. I may ask you to confirm your identity, which for enquiry data normally means replying from the address you originally used.

9. If you are unhappy

Please tell me first at hello@lytheo.com. If that does not resolve it, you have the right to complain to a supervisory authority:

• United Kingdom — the Information Commissioner’s Office (ico.org.uk)
• EEA — the data protection authority in your country of residence
• India — the Data Protection Board of India, once constituted under the DPDP Act
• California — the California Privacy Protection Agency, or the Attorney General

10. Children

This is a business-to-business service and is not directed at children. No data is knowingly collected from anyone under 18. If you believe a child has submitted information through this site, email me and it will be deleted.

11. Changes to this policy

If this policy changes materially, the date at the top of this page changes with it. If a change affects how data already collected from you is used, and I have a way to reach you, I will tell you directly rather than relying on you re-reading this page.

12. Related documents

• Cookie policy — what analytics stores, and how to refuse it
• Terms of service
• How I use AI — including on client data