1. Who we are and how to contact us
VMNexa Private Limited ("VMNexa", "we", "us" or "our") provides self-hosted software for cloud infrastructure management, cost analysis and authorized automation.
For privacy questions, requests or complaints, email info@vmnexa.com with the subject Privacy Request.
This policy covers individuals who visit our website, contact us, represent prospective or existing customers, acquire licences, or interact with support. It does not replace an employer's or customer's own privacy notice. Separate notices may apply to recruitment or other activities if offered.
2. Our role and the self hosted boundary
We determine the purposes and means of processing information used for our own sales, contracts, licensing, invoicing, website administration, security and business communications. For those activities, we act as the responsible organization or, where the terminology applies, a data fiduciary or controller.
Customer Operational Data means information processed by the software in a customer's environment, including infrastructure inventories, credentials, telemetry, cost and billing data, recommendations, schedules, user accounts, audit logs and operational records. The customer controls its installation and decides how that information is collected and used. Installation of VMNexa does not, by itself, give VMNexa Private Limited access to that information.
The self-hosted offering keeps Customer Operational Data in the customer-controlled environment and does not require that data to be sent to a VMNexa-operated telemetry or analytics service. Authorized connections to the customer's cloud providers, identity providers and other customer-selected integrations remain subject to the customer's configuration and those providers' arrangements. Self-hosted does not mean that a connected cloud-management installation makes no network requests.
We receive Customer Operational Data only when a customer chooses to provide it or grants us specific access, for example to investigate a support issue. Where we process personal information on a customer's behalf, we act on documented instructions under the applicable agreement and, where required, a data processing agreement. We do not acquire independent rights to use that information merely because we provide the software.
This policy describes the current self-hosted offering. It does not describe a VMNexa-hosted software service. Any future hosted offering will need an appropriate notice and contractual arrangements before it is provided.
3. Information we receive and its purposes
Business contact information. We receive names, business email addresses, telephone numbers, job titles, organization names, business addresses and enquiry details that you or your organization provide. We use these to respond to requests, arrange demonstrations, prepare proposals and manage business relationships.
Contract and payment records. We receive order details, billing contacts, invoice addresses, tax identifiers where applicable, transaction references, payment status and related correspondence. We use these to fulfil orders, administer licences, reconcile payments and meet accounting or legal requirements. Do not send payment card security codes, complete card credentials or online banking passwords by email or support ticket. Where a payment service is used, its separate notice governs information it collects directly.
Licensing and delivery records. We process customer and licence identifiers, purchased entitlements, licence validity, authorized contacts and information submitted to issue or renew a licence. If a particular licence requires an installation identifier or binding value, we identify the required fields when requesting them. Offline licensing does not authorize unrestricted collection of the customer's infrastructure inventory or credentials.
Website and download information. Web servers and security services may receive an IP address, request time, requested address, referrer, browser or device information, download events and security-related logs. We use these to deliver content, diagnose faults and protect our systems. Any optional analytics or marketing technologies are subject to the disclosures and choices described in section 5.
Support information. We receive messages, attachments, screenshots, product versions, configuration details and diagnostic material that you elect to share. We use these to investigate the issue, provide agreed support, maintain the support record and resolve related disputes. Support material can contain personal information even when it is primarily technical.
Communications and preferences. We record service correspondence, consent or withdrawal records, subscription preferences and complaint handling. We send relevant administrative messages and, when permitted and subject to your choices, product or marketing communications.
4. Information processed inside customer installations
Depending on enabled capabilities, the software may process cloud account identifiers and credentials; virtual machine names, IP addresses, tags and topology; utilization and connection metrics; cloud pricing and expenditure; schedules and policy settings; administrator identities and permissions; and audit, access and execution logs. Enabled remote-access or automation features may also process SSH details, command output, playbooks and session records. These categories can identify people or reveal confidential business information.
These are categories the customer's installation may process, not a statement that we automatically receive them. The customer controls access, deployment location, integration settings, retention and disclosures in that environment. Individuals with questions about their organization's installation should normally contact its administrator or privacy contact first.
Before sharing diagnostics, review the material and remove unnecessary personal information, secrets and unrelated business data. Do not send live private keys, passwords or unrestricted cloud credentials through ordinary correspondence. If access is necessary, agree the scope, approved access method and duration with us; use limited permissions and revoke access when the work ends.
We use Customer Operational Data provided for support only for the agreed support purpose and associated security or legal obligations. We do not sell it, use it for advertising or use it to train general-purpose artificial intelligence models. Customer reports remain customer information even when they contain estimates or analytics outputs.
5. Website tools, cookies and tracking
The website calculator and assessment-brief tool run in your browser. The website does not submit the values you enter to VMNexa, save them in persistent browser storage or use them to create a customer account. Copying a brief places the text on your clipboard at your request. If you later send that brief to us by email, we receive and handle it as business correspondence.
The current website application does not include advertising trackers, third-party analytics scripts or optional cookies. Hosting and security services may still process technical request information, including IP addresses and access logs, to deliver and protect the website. Browser controls for cookies do not prevent this server-side processing.
If we introduce optional cookies, analytics or embedded third-party content, we will describe the providers, purposes, retention and available controls and obtain consent before activation where required. Cookies and storage inside a customer-operated VMNexa installation are managed by that customer and its configuration.
6. Grounds for processing and your choices
We collect information for identified lawful purposes and limit it to what is reasonably necessary. Where applicable law requires consent, including for relevant sensitive personal information, we obtain it before the processing concerned. Where law expressly permits processing without consent, we rely only on the applicable permitted ground. A business contract does not automatically provide every legal permission needed to process an individual's personal information.
You may decline optional information or withdraw consent by emailing info@vmnexa.com, identifying the processing concerned. Withdrawal should be as straightforward as giving consent. If necessary information cannot lawfully be processed, we may be unable to provide the related service; we will explain that consequence. Withdrawal does not invalidate earlier lawful processing or require deletion of records that must lawfully be retained.
We send marketing emails only to people who have opted in, keep evidence of that permission and do not use bought, rented or scraped mailing lists. Each marketing email includes an unsubscribe link, and we honour opt-outs without undue delay. You may also email info@vmnexa.com to unsubscribe. Necessary contractual, billing, security and support messages may continue. Accepting our Terms and Conditions or making an enquiry is not blanket consent to unrelated marketing or tracking.
7. When we disclose information
We disclose relevant information to service providers used for business operations, such as website and email hosting, support administration, licence delivery, accounting and payment processing. We restrict providers acting on our behalf to the necessary purpose and require appropriate confidentiality, security and contractual protections. A provider acting independently, such as a bank, may also have its own legal duties and privacy notice.
We may use Mailjet, a Sinch email service, to deliver business and service emails and opted-in marketing messages. When we send through Mailjet, it processes the recipient email address and name where provided, message content, and delivery, bounce, complaint and unsubscribe records on our behalf. This supports delivery, troubleshooting and respect for your communication choices. It does not give Mailjet access to data held only in your self-hosted installation. Mailjet explains its own processing in its privacy policy at Mailjet Privacy Policy.
Email services can offer open and click tracking. If we enable those optional features, we will explain the information collected and obtain any required consent before using them. Delivery and security records are handled separately from optional engagement tracking. You can contact info@vmnexa.com about your choices.
Within a customer relationship, relevant account, licence and support information may be available to that customer's authorized administrators or designated contacts. We may share information with professional advisers where necessary and protected by appropriate confidentiality duties.
We may disclose information where required or otherwise lawfully permitted in response to a legal obligation, valid government request, court process, security incident or the establishment, exercise or defence of legal rights. We assess requests and limit disclosure to the lawful purpose; we notify affected customers where required and legally permitted.
If our business is reorganized, acquired or transferred, relevant records may be disclosed under safeguards for that transaction. Any successor must handle the information in accordance with applicable law and the notified purposes; a transaction is not permission for unrelated reuse.
We do not sell personal information or disclose Customer Operational Data for third-party advertising. Any disclosure outside the purposes described here requires a valid legal basis and any additional notice or consent that the law requires.
8. Storage locations and international transfers
The customer chooses where its self-hosted installation and backups operate. Data sent to a customer-selected cloud provider or integration follows the customer's arrangement with that provider. This policy does not promise that every customer's data is geographically located in India.
Business contact information, correspondence and support material that you provide to VMNexa may be processed by our service providers in countries other than your own. The location depends on the provider and the service used. Contact info@vmnexa.com for information about the providers and processing locations relevant to your relationship. Remote support access from another country may also constitute an international transfer.
We make transfers only as permitted by applicable law, with any required contractual, security, consent or other safeguards. Where the Indian sensitive personal information rules apply, the recipient must provide the required level of protection and the transfer must satisfy the applicable necessity or consent requirement. Additional localization or transfer restrictions imposed by law or an agreed customer contract take priority. Sending us information is not blanket consent to unrestricted worldwide transfers.
9. Retention and deletion
We retain information only for the period needed for the purpose for which we received it, the applicable contract and lawful retention requirements. We assess the type and sensitivity of information, the duration of the relationship, unresolved issues, security needs and relevant tax, accounting or claims requirements.
Enquiry records are reviewed when the enquiry or related relationship ends. Licence and contract records are retained for administration and applicable recordkeeping requirements. Support material is reviewed after the issue closes, and unnecessary diagnostic content is deleted or de-identified, subject to any lawful preservation requirement. Marketing records are removed or suppressed when you opt out; a limited suppression record may be retained to honour that choice.
Where legally required, security and processing logs are retained for the applicable statutory period. For example, covered systems subject to CERT-In's directions require a rolling 180-day log retention period within India. Other requirements may impose different or longer periods. Such requirements do not authorize unlimited retention or unrelated reuse.
Deletion can be subject to a legal hold and to the expiry of protected backup copies in the normal retention cycle. Retained copies remain access-restricted, and deletion decisions must be reapplied if a backup is restored. Contact us for information about the retention criteria relevant to your request.
We cannot remotely delete data held solely in a customer's installation. That customer must manage its own deletion, backups and statutory retention duties. Ending a licence does not automatically erase the customer's cloud resources or locally held information.
10. Security and incident handling
We apply reasonable technical and organizational safeguards appropriate to the information and processing under our control. These include limiting access to authorized persons, confidentiality obligations, appropriate protection in transit and storage, access management and incident response. Security also depends on the systems and settings used for the particular service.
Customers remain responsible for securing the infrastructure they operate, controlling users and credentials, applying supported updates, maintaining backups and configuring network access. No system or transmission method can be guaranteed completely secure. This statement does not exclude any security duty or remedy imposed by law.
If we become aware of an incident involving information under our control, we investigate, take appropriate containment and remediation steps, and make required notifications to customers, affected individuals or authorities within applicable deadlines. Customer notification and regulatory reporting are separate obligations. Report suspected incidents to info@vmnexa.com with the subject Security Incident, without including live secrets.
11. Requests and grievances
You may contact us to ask what personal information we hold about you, seek access or a summary, correct inaccurate or incomplete information, request deletion, withdraw consent or raise a complaint. Additional rights, including nomination of a person to exercise rights in specified circumstances, apply where the governing law provides them and the relevant provisions are in force.
Send the request to info@vmnexa.com with your name, the email or customer reference associated with the relationship, and a clear description of the request. We may seek proportionate information to verify identity or authority. Please do not send identity documents unless we explain why they are necessary and provide an appropriate method.
We acknowledge privacy grievances within two business days and address them within one month of receipt, or within any shorter period required by applicable law. Other rights requests are handled within the applicable legal deadline. If a request cannot be fully granted, we explain the lawful reason and available next steps. We do not charge a routine administrative fee for these requests.
If your request concerns information we process solely for a customer, we will direct it to that customer or assist under its instructions as appropriate. You retain the right to approach a competent authority or court. Where the Digital Personal Data Protection Act's complaint provisions apply and are in force, you may approach the Data Protection Board of India after first using the required grievance process.
12. Children and information about other people
VMNexa is intended for business use by adults and is not directed to children under 18. We do not knowingly solicit children's personal information for our own business activities. If you believe a child has provided information directly to us, contact info@vmnexa.com so we can investigate and take appropriate action.
A customer's use of the software does not remove its duties concerning information about employees, contractors, end users or children. Provide information about others only when you have the necessary authority and have given any required notice or obtained any required consent. Sensitive records unrelated to infrastructure management should not be included in support submissions.
13. Changes to this policy
We publish the current policy with its last-updated date. We give additional notice of material changes where appropriate or legally required. Where a new purpose requires fresh consent, we obtain that consent before undertaking the processing. A policy update does not retrospectively authorize an incompatible use of information.