Privacy Policy
Effective 9 November 2026
This policy explains how AISec Private Limited ("Tryam", "we", "us") handles personal data when you visit tryamaisec.com, use our web application firewall service (the "Service"), or browse a website that a customer protects with the Service.
1. Who we are
AISec Private Limited (CIN U62011UW2026PTC260693), 22, Sector 71, Noida, Uttar Pradesh 201307, India. Contact for privacy questions: privacy@tryamaisec.com.
We act in two roles:
- As the party deciding how data is used (a "data fiduciary" under India's Digital Personal Data Protection Act, 2023, or "controller" under the GDPR) for our website visitors, our customers' and partners' account users, and billing.
- On behalf of our customers (a "data processor") for the traffic that passes through the Service to their websites. Each customer decides why its website is protected; questions about a protected website's data should go to that website's owner first.
2. What we collect
Accounts
- Name, email address, organisation, role and team membership.
- Your password, stored only as a one-way hash; two-factor authentication settings.
- If you sign in with Google: your Google account's email address, name and a unique account identifier. We request only the basic "openid email profile" permissions and nothing else from your Google account.
- A record of security-relevant actions in your account (audit log), including the IP address and time.
Service configuration
- The domains you protect, their origin servers, your security rules and settings, alert channels and webhook addresses (stored encrypted), and API keys (stored as hashes).
- Support tickets and messages you send us.
Billing
- Plan, invoices, billing name and address and, where you provide it, your GST number.
- Payments are made through Razorpay. We never see or store your card or bank details; we receive the payment's status and reference.
Traffic to protected websites (on behalf of our customers)
To block attacks, the Service inspects every request to a protected website. For each request it records a security event with: the visitor's IP address, the time, the website, the request method and URL (including the query string), the browser's user agent and referrer, technical TLS fingerprints, the country and network derived from the IP address, the decision taken, and the identifiers of the security rules that matched together with the name of the field they matched in. Request bodies, uploaded files and AI prompts are inspected in memory and not stored; we keep only which rules matched, not the content.
When a visitor passes a browser check on a protected website, a cookie (__waf_bot, valid for one
hour) records that the check was passed. It is not used to track visitors across websites.
Our public website
If you fill in the get-started form, we keep the details you give in it (name, work email, company, and optionally your website, role and message) to contact you about Tryam, until you ask us to delete them.
If, and only if, you accept analytics cookies on our public pages (home, pricing, sign-in and sign-up), we use Google Analytics to count visits to those pages. See section 5.
3. Why we use it, and on what basis
| Purpose | Basis |
|---|---|
| Providing the Service: accounts, sign-in, protecting customers' websites, alerts, support | Performance of our contract with you or your organisation; for traffic, our customer's instructions |
| Billing, invoicing and tax records | Contract and legal obligations (including GST law) |
| Keeping the Service and its users secure: detecting attacks and abuse, fraud prevention, audit logs | Legitimate interests / legitimate uses permitted by law |
| Counting visits to our public pages | Your consent, which you can withdraw at any time |
| Complying with law, such as reporting cyber security incidents to CERT-In | Legal obligation |
We do not sell personal data, and we do not use it for advertising.
4. Who we share it with
- Service providers who process data for us under contract: OVHcloud (hosting, in data centres in Mumbai, India and Singapore), Razorpay (payments), Google (sign-in with Google and, with your consent, Google Analytics), Hostinger (our email).
- Let's Encrypt issues the HTTPS certificates for protected domains. As with every public certificate, the domain names appear in public Certificate Transparency logs.
- Partners: if your organisation's account is provided and managed by one of our partners (resellers), that partner can see your account, configuration and billing details in order to manage and support it.
- Authorities, where the law requires it, for example CERT-In incident reports or a valid legal order.
- A buyer or successor, if our business is reorganised or sold, under the same protections.
5. Cookies and similar technologies
| Name | Purpose | Duration |
|---|---|---|
waf_session, waf_partner, waf_staff | Keep you signed in (strictly necessary) | Up to 14 days |
waf_google | Protects the "Continue with Google" sign-in against forgery (strictly necessary) | 10 minutes |
tryam.analytics (browser storage) | Remembers your analytics choice | Until you clear it |
_ga, _ga_* | Google Analytics visit counting, only after you accept | Up to 2 years |
__waf_bot | On protected websites: records a passed browser check (strictly necessary for security) | 1 hour |
You can change your analytics choice at any time with "Cookie settings" at the bottom of our public pages; withdrawing consent deletes the Google Analytics cookies. Analytics never runs inside the signed-in console, and advertising features are switched off.
6. Where data is stored
The Service runs in India (Mumbai) and Singapore. Our service providers may process data in other countries (for example Google and Razorpay); where we transfer personal data outside India or the EU, we rely on the safeguards the law requires, such as standard contractual clauses.
7. How long we keep it
- Security events about individual requests (including IP addresses): up to 180 days.
- Aggregated traffic statistics (counts by website, country and network, without IP addresses): up to 400 days.
- Account data: while the account is active; deleted or anonymised when the account is closed or on request, except what we must keep by law.
- Invoices and billing records: as long as tax law requires (in India, at least the period required under the GST law).
- Database backups: up to 14 days; copies in our off-site backup store are deleted within 30 days.
8. Security
We protect data with encryption in transit (HTTPS, and mutual TLS and encrypted tunnels between our servers), encryption of sensitive fields at rest, hashed passwords and keys, two-factor authentication, role-based access, tamper-evident audit logs and monitoring. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.
9. Your rights
Depending on where you live, you can ask us to: access your personal data and how it is used; correct or update it; delete it; receive a copy in a portable format; restrict or object to some uses; and withdraw consent (this does not affect use before withdrawal). Under India's DPDP Act you may also nominate someone to exercise your rights if you die or become incapable.
To exercise these rights, write to privacy@tryamaisec.com. Owners and admins can also export or request deletion of their organisation's data from the console. For traffic to a protected website, please contact that website's owner; we will help them respond.
10. Grievances and complaints
Grievance Officer: Deepak, AISec Private Limited, 22, Sector 71, Noida, Uttar Pradesh 201307, privacy@tryamaisec.com. We aim to respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India or, in the EU or UK, to your data protection authority.
11. Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect children's personal data.
12. Changes
We will post any change to this policy on this page with a new effective date, and tell account owners by email or in the console before material changes take effect.