The short version: Gavety is a connectivity service. Your files stay on your own devices and travel directly between them — we do not receive, store or read your file contents. We do collect the account, device, connection and billing records we need to run the service. We do not sell your data, and we do not use it for advertising.
1. Who we are
This Privacy Policy explains how Gavety Labs Pvt Ltd (CIN U62099OD2026PTC054087), whose registered office is at MIG-2/7, Phase-3, Chhend Colony, Rourkela, Odisha – 769015, India ("Gavety", "we", "us"), handles personal data when you visit gavety.com or use the Gavety software and services. We are the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the "controller" under the EU and UK GDPR.
Gavety is available worldwide. Some sections below add detail for particular regions; where local law gives you stronger rights, those rights apply.
2. What Gavety does — and does not do
Gavety software lets you reach files stored on your own hardware from other devices. Our servers help your devices find each other and set up a direct, encrypted connection. Your files then travel directly between your devices.
We do not receive, store or read your file contents, file names, folder listings or thumbnails. Because we do not hold them, we cannot access them, hand them over or recover them for you. You are the one in control of the files on your devices.
Gavety currently does not operate a relay service for file traffic. If we introduce one in future, we will update this policy and tell you before it is switched on.
3. Information we collect
| Category | What we collect | Why |
|---|---|---|
| Account | Username, email address and password. Passwords are handled by Google Firebase Authentication and stored in hashed form; we never see your password. | Create and secure your account, sign you in, send service notices. |
| Device | A device ID created by the Gavety software, software version, heartbeat (online status) and last-seen time. | Register your device, check your licence, deliver updates, diagnose problems. |
| Connection | IP address, connection timestamps and signalling (WebSocket) session data showing which device and account are connecting. | Set up connections, keep the service secure, prevent abuse. |
| Remote-access usage | Which accounts use remote access on a device, and when. | Apply per-user remote-access licences, billing and security. |
| Billing | Payment status, order and transaction IDs, amount, currency and billing country. Card details are handled by Razorpay and never reach us. | Process payments, tax and accounting. |
| Support | Messages and attachments you send us. | Answer your requests. |
| Website analytics (only with your consent) | Pages viewed, device and browser type, approximate location from IP address, referrer, interactions and, through Microsoft Clarity, session recordings. We also use Google Search Console, which shows us aggregated search performance, not individual visitors. | Understand and improve our public website. |
We do not run analytics or session recording inside the signed-in dashboard.
4. How we use your information, and our legal bases
- Provide the service (accounts, devices, connections, licences, billing, support) — to perform our contract with you.
- Security, fraud and abuse prevention; service improvement — our legitimate interests.
- Tax, accounting and legal obligations — legal obligation.
- Website analytics — your consent, given through our cookie banner.
- Marketing emails — we do not send these today. If we start, we will ask for your consent first and every email will have an unsubscribe link.
Under the DPDP Act we rely on the consent you give when you create your account and, where the Act allows, on other lawful grounds. You may withdraw consent at any time (see Your rights); if you do, we may not be able to continue providing the service. We do not make decisions about you by automated means that have legal or similarly significant effects.
7. International transfers
We are based in India, our backend runs in Sweden, and some providers process data globally, including in the United States. You may also access Gavety from anywhere. Where EU or UK law restricts these transfers, we rely on standard contractual clauses or equivalent safeguards in our providers' data processing terms. Under the DPDP Act, personal data may be transferred outside India except to countries the Government of India restricts.
8. Security
Connections to our servers use TLS. File transfers between your devices use WebRTC, which encrypts data in transit between the two ends. Passwords are managed by Firebase Authentication, and device access has automatic protection against repeated failed attempts. We limit staff access to personal data.
No system is completely secure, and we cannot guarantee absolute security. You are responsible for securing your own devices, drives and credentials.
If a personal data breach affects you, we will tell you and, where the law requires, the relevant authority (including the Data Protection Board of India, and EU or UK regulators within 72 hours where GDPR applies), without undue delay.
9. How long we keep information
| Data | Retention |
|---|---|
| Account data | While your account is active; deleted within 30 days after you close it. |
| Device and heartbeat records | While the device is registered; deleted within 30 days after you remove it or close your account. |
| Remote-access usage records | While your account is active; deleted within 30 days after you close it, except where needed for billing records below. |
| Signalling session state | Discarded when the session ends. |
| Server, connection and security logs | Up to 180 days. |
| Billing and tax records | Up to 8 years, as Indian company and tax law requires. |
| Support messages | Up to 2 years after the matter is closed. |
| Website analytics | As configured in Google Analytics (14 months or less) and Microsoft Clarity. |
Deleted data may remain in encrypted backups until those backups expire. We delete or anonymise data earlier if we no longer need it.
10. Your rights
Depending on where you live, you can ask us to:
- give you access to the personal data we hold and a summary of how we use it;
- correct, complete or update it;
- erase it (we will do so unless the law requires us to keep it, for example billing records);
- withdraw consent you gave us;
- restrict or object to certain processing, and receive your data in a portable format (EU/UK GDPR);
- nominate another person to exercise your rights if you die or become unable to (DPDP Act).
To exercise a right, email privacy@gavetylabs.com. We may need to verify your identity. We will respond within 30 days; if a request is complex we may extend this where the law allows and will tell you why. Exercising your rights is free unless a request is clearly unfounded or excessive.
Complaints. Please contact our Grievance Officer first. If you are not satisfied, you may complain to the Data Protection Board of India or, if you are in the EU or UK, to your local data protection authority. If you are elsewhere (for example California or Brazil), tell us and we will honour requests as your local law requires.
11. Grievance Officer
Grievance Officer / Privacy contact: Deepak Hembram, Director & Founder
Email: privacy@gavetylabs.com (monitored by the Grievance Officer)
Post: Gavety Labs Pvt Ltd, MIG-2/7, Phase-3, Chhend Colony, Rourkela, Odisha – 769015, India
We acknowledge complaints within 3 business days and aim to resolve them within 30 days.
12. Children
Gavety is for people aged 18 and over. You must confirm you are 18 or older when you create an account. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email privacy@gavetylabs.com and we will delete it.
13. Legal requests
We may be required by law to disclose information we hold, such as account, device and connection records. We review requests for validity, disclose only what is legally required and, where the law allows, tell you first. We cannot disclose file contents because we do not hold them.
14. Changes to this policy
We may update this policy. We will post the new version here with a new date and, for material changes, email registered users and show a notice in the dashboard at least 30 days before the change takes effect. Where the law requires your consent to a change, we will ask for it again. Earlier versions are available on request.
This is version 2.0, effective October 21, 2026.
15. Contact us
Grievance Officer / Privacy contact: Deepak Hembram, Director & Founder
Email: privacy@gavetylabs.com (monitored by the Grievance Officer)
Post: Gavety Labs Pvt Ltd, MIG-2/7, Phase-3, Chhend Colony, Rourkela, Odisha – 769015, India
Gavety Labs Pvt Ltd · CIN U62099OD2026PTC054087
MIG-2/7, Phase-3, Chhend Colony, Rourkela, Odisha – 769015, India