Privacy policy,
uncompromised.

01Introduction & Scope

This Privacy Policy describes how Innovexa Solutions Ltd. ("Innovexa", "we", "us", or "our") collects, uses, discloses, and safeguards personal information in connection with the Innovexa ORBI hardware platform, associated software, APIs, and the website at hrinnovexa.com (collectively, the "Services").

This Policy applies to enterprise customers, their authorized users, and visitors to our public website. It does not apply to third-party sites or services that may be linked from our website, which are governed by their own privacy policies.

02Data We Collect

We collect information in three primary categories:

• Account & Identity Data — name, work email, role, organization, and authentication identifiers provisioned through SSO (SAML 2.0 / OAuth2).
• Device & Telemetry Data — hardware identifiers, firmware version, health metrics, and diagnostic logs from ORBI devices. Telemetry is anonymized by default and can be disabled entirely by enterprise administrators.
• Usage Data — interaction events within the ORBI interface (e.g., routine check-ins, feature engagement), retained on-device unless explicitly synced to your organization's cloud tenant.

ORBI is designed so that the majority of personal data never leaves the enterprise perimeter. Data collection is opt-in, granular, and governed by the enterprise administrator — not by Innovexa.

03How We Use Data

We process personal data only for the following purposes:

• Provisioning, operating, and maintaining the ORBI Services.
• Authenticating users and enforcing enterprise access controls.
• Providing customer support and responding to technical or privacy inquiries.
• Detecting, preventing, and responding to security incidents.
• Complying with legal obligations in the jurisdictions where we operate.

We do not sell personal data. We do not use personal data for advertising, and we do not train third-party AI models on customer data.

04GDPR & Data Subject Rights

For customers and data subjects located in the European Economic Area (EEA), the United Kingdom, or Switzerland, Innovexa acts as either a Data Processor (for enterprise customer data) or a Data Controller (for our own website visitors and prospective customers).

Our REST API includes automated endpoints for Data Subject Access Requests (DSAR) and permanent applicant data deletion, with a guaranteed compliance window of 30 days from request submission. Enterprise administrators can trigger these workflows directly through the ORBI admin console or via API.

05CCPA & US State Laws

For residents of California, Colorado, Connecticut, Virginia, and other US states with comprehensive privacy legislation, we comply with the California Consumer Privacy Act (CCPA) as amended by the CPRA, and equivalent state statutes.

You have the right to know what personal information we collect, the right to delete it, the right to correct inaccuracies, and the right to opt out of any "sale" or "sharing" of personal information. Innovexa does not sell personal information.

06On-Premise Air-Gapped Storage

For organizations deploying ORBI hardware in an air-gapped configuration, all candidate, employee, and operational data is stored entirely on-premise and never traverses the public internet. Innovexa has no technical means to access air-gapped deployments.

Air-gapped deployments receive signed offline firmware bundles, a USB-based provisioning kit, and an on-premise controller node that manages policies, updates, and telemetry within the corporate network perimeter. In this configuration, Innovexa acts as a hardware vendor only — not as a data processor.

07Encryption Standards

All data handled by the ORBI platform is protected by industry-standard cryptography:

• At rest — AES-256-GCM encryption, with per-device key derivation and hardware-backed secure enclaves.
• In transit — TLS 1.3 with forward secrecy; HSTS enforced across all endpoints.
• Key management — Customer-managed keys (CMK) available for cloud-connected deployments; cryptographic erasure supported for RTBF compliance.
• Backups — Encrypted with the same standard; geographically redundant across multiple availability zones.

08Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required by law.

• Account data — retained for the duration of the customer contract plus 90 days for deletion grace period.
• Telemetry data — anonymized and retained for 12 months, then automatically purged.
• Support tickets — retained for 24 months, then deleted.
• Legal hold data — retained per applicable statutory periods.

09Subprocessors & Third Parties

Innovexa uses a limited set of vetted subprocessors to operate the Services. A current list — including AWS, Cloudflare, and our payment processor — is maintained in our Subprocessor Registry and updated 30 days before any material change.

All subprocessors are bound by data processing agreements (DPAs) that meet or exceed the standard contractual clauses (SCCs) required under GDPR. We do not share personal data with any subprocessor for purposes beyond those necessary to deliver the Services.

10Cross-Border Transfers

Enterprise customers select the region where their data is stored during onboarding (EU, US, UK, or APAC). Personal data does not leave the selected region under any circumstance, except where required by a valid legal order from a competent authority in that region.

For any limited cross-border transfers (e.g., support escalations), we rely on Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum.

11Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Request deletion of your personal data ("right to be forgotten").
• Restrict or object to certain processing activities.
• Receive your data in a portable, machine-readable format.
• Lodge a complaint with your local supervisory authority.

To exercise any of these rights, contact your enterprise administrator or email our privacy team directly at [email protected]. We respond to all verified requests within 30 calendar days.

12Contact & DPO

For questions about this Privacy Policy or our data practices, contact our Data Protection Officer:

• Email — [email protected]
• Postal — Innovexa Solutions Ltd., Attn: DPO, Enterprise Privacy Office
• Response time — Within 48 hours for initial acknowledgment; full resolution within 30 days.

If you are unsatisfied with our response, you may escalate to your local data protection authority. Innovexa cooperates fully with all supervisory authorities and honors binding decisions without appeal.