Privacy Policy

This Privacy Policy explains how Delusional Machines collects, uses, shares, and protects personal information when you visit our website, book a discovery call, or contact us about our applied‑AI services.

Delusional Machines is an India-based applied‑AI consultancy. Our registered address is 1/1 KK Nagar, Vellore Main Road, Ranipet District, Tamil Nadu 632509, India. You can reach us at that address, or by booking a call.

Under India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, we act as a Data Fiduciary in respect of the personal data described below, and you are a Data Principal.

This Policy is intended to be practical and transparent. It does not replace any separate privacy or data processing terms that may be agreed with a client for a paid engagement.

Information we collect

We currently collect limited information through this website and our booking flow.

When you book a call or contact us, we may collect your name, email address, company name, timezone, meeting preferences, and any message or business context you choose to share.

When you use the website, our hosting provider and technical tools may process basic technical information such as browser type, device information, IP address, pages visited, referral source, and timestamps.

When you book through our Google Calendar appointment scheduling link, Google may process booking-related information needed to schedule, manage, and confirm the meeting.

We do not intentionally collect sensitive personal information through this website. Please do not submit confidential client datasets, credentials, financial records, health information, or other sensitive operational data through the public website or booking form.

How we use information

We use personal information to:

• respond to enquiries;
• schedule and manage discovery calls;
• understand the business context you choose to share with us;
• prepare for consultancy conversations;
• operate, secure, and improve the website;
• maintain business records; and
• comply with legal, regulatory, accounting, or administrative obligations.

We do not use your personal data for a new purpose that is incompatible with the one it was collected for without telling you first.

Consent and lawful basis

Where applicable, we process personal information because it is necessary to respond to your request, take steps before entering into a client engagement, operate our website, pursue legitimate business interests, comply with legal obligations, or because you have provided consent.

Where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not affect processing already carried out before the withdrawal, and it may mean we can no longer respond to an enquiry or hold a scheduled call.

Sharing information

We do not sell personal information.

We may share information with trusted service providers that help us operate the website, manage bookings, host data, communicate with visitors, or administer our business.

We use Google Calendar appointment scheduling to support booking. When you use that link, your information may be processed by Google according to its own applicable terms and privacy practices.

Where a client-approved engagement requires specialist execution, we may share relevant project information with subcontractors or channel partners who help us deliver the agreed work. We only do this where it is reasonably necessary for the engagement and subject to appropriate confidentiality or contractual controls.

We may also disclose information if required by law, regulation, legal process, government request, or to protect our rights, users, clients, or business.

International clients and applicable law

We are based in India and serve clients internationally, including in the United Kingdom, the United States, New Zealand, Saudi Arabia, and India.

India’s DPDP Act governs our processing as an Indian Data Fiduciary. Separately, the law of your own country may give you additional rights, and we honour those where they apply to you:

• United Kingdom — the UK GDPR and Data Protection Act 2018, supervised by the Information Commissioner’s Office (ICO).
• United States — state privacy laws such as the CCPA as amended by the CPRA in California, and comparable laws in other states.
• New Zealand — the Privacy Act 2020 and its Information Privacy Principles, supervised by the Office of the Privacy Commissioner.
• Saudi Arabia — the Personal Data Protection Law (PDPL), supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA).
• India — the DPDP Act 2023 and DPDP Rules 2025, supervised by the Data Protection Board of India.

Where more than one of these applies, we apply the standard that gives you the stronger protection rather than the weaker one.

International processing and transfers

Because we are based in India, personal information you give us will generally be processed in India. Some of our service providers, tools, clients, subcontractors, or channel partners may be located elsewhere.

This means personal information may be processed or stored in countries other than your own. Where required, we use reasonable contractual, technical, and organisational measures to protect it in transit and at rest — including standard contractual clauses or an equivalent transfer mechanism where the law of your country requires one.

Specific regimes we observe where they apply:

• For UK personal data, transfers out of the UK are made under the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
• For Saudi personal data, the PDPL restricts transfers outside the Kingdom, and we will only transfer such data where the conditions SDAIA sets are met.
• For New Zealand personal data, we only disclose it outside New Zealand where Information Privacy Principle 12 permits.
• For Indian personal data, we observe any restrictions the Government of India places on transfers to particular countries.

If a client engagement requires data to stay in a particular country, that belongs in the signed agreement for that engagement and we will honour it there.

Retention

We keep personal information only for as long as reasonably needed for the purposes described in this Policy, including responding to enquiries, maintaining business records, managing client relationships, resolving disputes, and meeting legal or accounting obligations.

Booking and enquiry information may be retained for a reasonable business period unless you ask us to delete it and we are legally permitted to do so.

Security

We use reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration, and disclosure.

No website, email system, booking tool, or internet transmission is completely secure. You should avoid sending sensitive or confidential information through public website forms unless we have agreed a secure method with you.

If a personal data breach occurs, we will notify affected Data Principals and the Data Protection Board of India as required by the DPDP Act and Rules.

Your rights

Wherever you are, we will honour a request to:

• access a summary of the personal data we hold about you and how we process it;
• ask us to correct, complete, or update it;
• ask us to erase it, where we are not legally required to keep it;
• withdraw consent where we rely on consent;
• object to or ask us to restrict a particular use; and
• raise a grievance and have it resolved.

Depending on where you are, you may also have the right to:

• India — nominate another individual to exercise your rights in the event of your death or incapacity (DPDP Act).
• United Kingdom — receive your data in a portable format, and not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions about you.
• United States — know what is collected, request deletion or correction, and opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of, and we will not discriminate against you for exercising a right.
• New Zealand and Saudi Arabia — the access, correction, deletion, and portability rights their respective laws provide.

To exercise any of these, or to raise a grievance, write to us at the postal address at the end of this page, or book a call. We may need to verify your identity before responding. We aim to respond within 30 days, and sooner where the law that applies to you requires it. We do not charge for this.

If you are not satisfied with how we handle your request, you can complain to your regulator: the Data Protection Board of India, the Information Commissioner’s Office in the UK, the Office of the Privacy Commissioner in New Zealand, SDAIA in Saudi Arabia, or your state Attorney General in the United States.

Third-party links and services

Our website may link to third-party websites, services, or ecosystem brands. We are not responsible for the privacy practices, content, or security of third-party websites or services.

If you visit a third-party website or use a third-party booking or communication tool, you should review that provider’s own privacy policy.

Children

This website and our services are directed at businesses, not children. We do not knowingly collect the personal data of a child. If you believe a child has provided us personal data, contact us and we will delete it.

Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above.

Material changes will apply from the date they are published on this website unless a different date is stated.