Privacy Policy
Last updated: 1 November 2026
This Privacy Policy explains what personal data we collect when you visit thryveapex.com, contact us or work with us, why we collect it, who we share it with and how you can exercise your rights. It is published under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Because we also serve clients in the European Union and the United Kingdom, it covers your rights under the EU GDPR and UK GDPR.
1. Who we are
Thryve Apex is a brand used by Shariq Shaikh, an independent professional who provides digital services as a freelance practice from Hyderabad, Telangana, India. Thryve Apex is not a registered company or LLP. In these pages, “Thryve Apex”, “we”, “us” and “our” mean Shariq Shaikh trading as Thryve Apex, together with the professionals he engages to deliver work.
For the purposes of Indian law we are the data fiduciary, and for the GDPR the controller, of the personal data described here. When we handle personal data inside a client’s systems as part of a project, we act on that client’s instructions (as a data processor) under our agreement with them.
2. What we collect
| Data | When we collect it | Why |
|---|---|---|
| Name, email, phone, company, website and your message | Contact form, email, WhatsApp, calls and booked meetings | To reply, understand your needs, send a quote and follow up |
| Project information: business details, files, access to accounts you share with us | During a project or in our client portal (hub.thryveapex.com) | To deliver the services you asked for |
| Billing details: name, business name, address, tax numbers, payment confirmations | When we invoice you | To bill you and keep records required by tax law |
| Technical data: IP address, browser, device and pages requested | Automatically, in our hosting provider’s security and server logs | To keep the website secure and working |
| Usage data: pages viewed, clicks, scrolls, device, approximate location and how you found us; session recordings with form fields masked | Through Google Analytics and Microsoft Clarity, only if you click Accept in the cookie banner | To understand which pages help visitors and to fix problems on the site |
We do not ask for, and you should not send us, passwords in messages, bank card numbers, health information or other sensitive personal data. When a project needs access to an account, we ask you to add us as a user instead of sharing a password. Card payments, if any, are handled by the payment provider, not by us.
3. Our legal grounds
- You gave us the data for a purpose, such as an enquiry or a project (a legitimate use under section 7 of the DPDP Act; for the GDPR, steps before a contract or the contract itself).
- Consent, for analytics cookies and session recordings. You can withdraw consent at any time from “Cookie settings” in the footer; this does not affect processing that already happened.
- Legal obligations, such as keeping tax and accounting records.
- Legitimate interests (GDPR only), such as keeping our website secure and improving our services, balanced against your rights.
We do not sell personal data, and we do not use it for automated decisions that have legal or similar effects on you.
4. Who we share it with
We share personal data only with the service providers we need to run the business, and only for the purposes above:
- Hostinger: website hosting, email and our client portal.
- Google: Google Analytics and Tag Manager (with your consent), web fonts used on this website, and Google Drive or Google Meet when you share files or join a call.
- Microsoft: Microsoft Clarity heatmaps and session recordings (with your consent).
- Meta (WhatsApp): if you message us on WhatsApp.
- Professionals we engage to deliver your project, bound by confidentiality.
- Banks and payment providers that process payments, and our accountant or tax advisers.
- Authorities, where Indian law requires us to disclose information.
5. Transfers outside India
Some providers store data outside India. We transfer personal data only to countries not restricted by the Government of India under section 16 of the DPDP Act. For data from the EU or UK, transfers rely on safeguards such as the standard contractual clauses offered by our providers.
6. How long we keep it
- Enquiries that don’t become projects: up to 24 months, then deleted.
- Client project records and communications: for the project and up to 3 years after it ends.
- Invoices and accounting records: as long as Indian tax law requires (generally up to 8 years).
- Server and security logs: as set by our hosting provider, usually a few weeks.
- Analytics data: up to 14 months in Google Analytics; Clarity recordings up to 30 days and heatmaps up to 13 months.
When you withdraw consent or the purpose is complete, we delete the data unless the law requires us to keep it.
7. Your rights
Under the DPDP Act you can ask us for a summary of your personal data and how we use it, ask us to correct, complete, update or erase it, withdraw consent, nominate another person to exercise your rights if you die or become incapable, and raise a grievance with us. Under the GDPR and UK GDPR you can also object to or restrict processing, ask for a copy in a portable format, and complain to your data protection authority.
To use any right, email hello@thryveapex.com with “Privacy request” in the subject. We may need to confirm your identity first. We reply within 30 days, and earlier where we can.
8. Grievance officer
For any question, complaint or grievance about your personal data, contact our grievance officer:
- Name: Shariq Shaikh
- Email: hello@thryveapex.com (subject: “Grievance”)
- Phone: +91 91002 80101
- Location: Hyderabad, Telangana, India
We acknowledge grievances within 7 days and resolve them within 30 days. If you are not satisfied, you may approach the Data Protection Board of India once you have used this process, or your local data protection authority if you are in the EU or UK.
9. How we protect data
We follow reasonable security practices: encrypted connections (HTTPS), two-factor authentication on our accounts, access limited to people who need it, client accounts kept in the client’s own name, and regular updates and backups. If a personal data breach happens, we will inform affected people and the authorities, including the Data Protection Board of India and CERT-In, as Indian law requires.
10. Cookies
We use essential cookies, and analytics cookies only if you accept them. See our Cookie Policy.
11. Children
Our services are for businesses and adults. We do not knowingly collect personal data from anyone under 18; if you think a child has sent us data, contact us and we will delete it.
12. Changes to this policy
We may update this policy as our services or the law change. The date at the top shows the current version; for significant changes we will also notify clients by email.
13. Contact
- Email: hello@thryveapex.com
- Phone and WhatsApp: +91 91002 80101
- Location: Hyderabad, Telangana, India (postal address on request)