What we collect, why, and what never leaves your computer
This policy covers the website recoveryantra.com, the partner portal, and the RecoverYantra software. It was written from what the code does, and it is changed in the same release as the code. Version 1.1, effective 13 September 2026.
1. Who we are
Valuepitch E Technologies Pvt. Ltd. (“we”) publishes RecoverYantra and operates recoveryantra.com and the partner portal. We are registered in India with offices in Navi Mumbai, Hyderabad, Bellampally. For the data described in this policy we are the data fiduciary (the term used by India’s Digital Personal Data Protection Act, 2023) or controller (the term used by the GDPR and UK GDPR). Questions and requests go to support@recoveryantra.com.
The short version: the website collects almost nothing, the portal collects what it takes to run a partner account and license issue licence keys for your machines, and the software itself sends us nothing at all - it has no code that connects to any server of ours. Nothing you recover is ever seen by us.
2. The website
| What | Details |
|---|---|
| Server logs | Your IP address, the page requested, the time, the referring page and your browser's user-agent string, written by the web server (nginx) for every request. Used to keep the site running and to investigate abuse. Rotated daily and kept for 14 days. |
| The enquiry form | Name, email address, phone number (optional), company (optional), the topic you pick and your message, together with the IP address and browser user-agent of the submission. Stored in a database on our own server and read by the people who answer enquiries. The IP address is also used to refuse a burst of submissions from one source. Kept for 24 months after the last exchange, then deleted. |
| Cookies | This website sets no cookies and runs no analytics, advertising or social-media scripts. The partner portal sets one cookie, described below. |
| Fonts | The pages load their typefaces from Google Fonts. When a page loads, your browser requests the font files from Google's servers, which see your IP address and browser details in that request. Google's handling of that request is described in Google's privacy policy. Nothing else on the site is loaded from a third party. |
3. The partner portal
The portal at recoveryantra.com/partners is where approved partners download the software, request licence keys for their machines, and raise support tickets. Everything in this section applies only to people who apply for or hold a partner account.
| What | Details |
|---|---|
| Your application | Company name, contact name, email address, phone number, country, city, website, tax or registration number, type of business and what you intend to use the software for - the fields on the application form. Read by a person who decides on the application; the decision and its note are stored with it. |
| Your password | Stored only as a salted scrypt hash. We cannot read it and cannot tell it to you; a forgotten password is reset, not recovered. |
| Sign-in sessions | One cookie, ry_portal, holding a random session token. The session itself lives on the server with the time it was created, the IP address and browser it was created from, and its expiry: 12 hours, or 14 days if you tick “keep me signed in”. Signing out deletes it. The cookie is strictly necessary for the portal to work and is used for nothing else. |
| Licence key requests | What you type when you request a key: the product, the machine code the application shows (a short code derived from that computer's operating-system installation identifier - it identifies the installation, not you), the name you give that computer, the licensee name to print in the key, the number of uses and the validity, and any note. When an administrator issues the key it is stored against the request, encrypted at rest, so that you can read it from your dashboard. |
| Support tickets | The subject and messages you write, who wrote each one and when. |
| Downloads | Which release was downloaded, by which account, when, and from which IP address. |
| Audit trail | Every significant action on the portal - sign-ins, key requests and issues, approvals, downloads - is written to a hash-chained audit log with the actor, the time and the IP address. It exists so that the history of a key or an account cannot be altered afterwards, and it is kept for as long as the account exists and for 7 years after it closes. |
| Email we send | Account decisions, password resets, ticket replies and release notices are sent to the address on your account through an SMTP email service (Amazon SES or an equivalent provider), which processes the address and the message in order to deliver it. We send no marketing email. |
4. The RecoverYantra software
The software runs on your own computer, reads the drive or image you point it at without writing to it, and writes what it recovers to a folder you choose. This section lists every case in which it communicates with anyone.
| What | Details |
|---|---|
| Nothing, by default | The application does not send usage data, crash reports, device lists, file names or anything else to us or to anyone. It runs with no internet connection. There is no account, no sign-in and no background service. |
| Licence activation | A licence key is verified on your computer against a public key built into the software. Nothing is sent anywhere - not the key, not the machine code, not what you recover. Every key is bound to the machine code the licence panel shows, a short code derived from your operating system's installation identifier. That code reaches us only when you request a key for it through the partner portal or send it to us by other means. The application records on your computer which drives or images a key has been used on; that record never leaves it. |
| No connection to us, ever | The application contains no code that contacts recoveryantra.com or any server of ours: no licence check, no key redemption, no update check, no error reporting. A test in the build fails if such code is ever added. |
| The diagnostic log | The application writes RecoverYantra-log.txt next to itself (or in your application-data folder): device identifiers and sizes, the folders it was asked to write to, timings, and error messages. It never contains the contents of any file. It stays on your computer unless you choose to send it to support to help diagnose a problem, in which case it is kept with the ticket. |
| Cloud acquisition | The cloud-acquisition workspace connects to the operator's own Microsoft 365 tenant with credentials the operator supplies, and copies mailbox data to a folder the operator chooses. That traffic runs between the operator's computer and Microsoft. It does not pass through us and we cannot see it. |
| Model assistance in the SakshyaYantra Forensic Suite | The Forensic Suite can ask a model about a frame pack. In the default mode nothing leaves the computer; a local model pack runs with no internet. Cloud mode is off until the agency turns its authorisation switch on, and then the product connects to the provider the agency chose (its own account and key, kept in the operating system's credential store) and sends only the frame pack - a few frames and their manifest, never the video. A transfer manifest records every digest that left. That traffic runs between the operator's computer and the provider; it does not pass through us and we cannot see it. |
| Recovered data | Whatever the software recovers - photographs, documents, databases, mailboxes, forensic images - is written to a folder on the operator's own storage. It is read from the source and never written back to it. We never receive it, and the person or organisation running the software is responsible for it under whatever law applies to them. |
5. Why we process it, and on what legal basis
| Purpose | Basis |
|---|---|
| Answering an enquiry | Your consent, given by sending the form. Withdraw it at any time by telling us; we then delete the enquiry. |
| Running a partner account | Performance of the partner agreement you apply for - we cannot review an application, issue keys or answer tickets without the data on the form. |
| Recording issued keys and the audit trail | Performance of the agreement and our legitimate interest in resolving disputes about what was licensed to which machine, and in keeping records that may be required by tax and company law. |
| Server logs and rate limiting | Our legitimate interest in keeping the service available and in detecting abuse. |
| Sending account and support email | Performance of the agreement. We send no marketing email and do not need consent for email you asked for. |
6. Who sees it
Nobody outside Valuepitch sees your data except the service providers that process it on our instructions, and the authorities where the law requires it:
- Amazon Web Services hosts the website, the portal and its database on a server in the United States (US East, Ohio). AWS stores the data; it does not use it.
- An SMTP email service (Amazon SES or an equivalent provider) delivers the account and support email described above.
- Google Fonts serves the website's typefaces and sees the request for them, as described in section 2.
- Public authorities, where a law, court order or lawful request requires it. We disclose the minimum the request covers and, where the law allows, we tell you.
We do not sell personal data, do not share it with advertisers, and do not use it to train anything.
7. Where it is kept
The server that runs the website and the portal is in the United States. If you are in India, the EEA, the United Kingdom or elsewhere, the data you give the site or the portal is therefore transferred to and stored in the United States. For people in the EEA and the UK that transfer relies on the standard contractual clauses in our agreement with AWS. The data the software handles - the drives, images and recovered files - stays wherever you run it.
8. How long we keep it
| Data | Kept for |
|---|---|
| Web server logs | 14 days, rotated daily. |
| Enquiry-form submissions | 24 months after the last exchange. |
| Partner account and application | For as long as the account is open, and 12 months after it closes or a rejected application is decided, so that a repeat application can be recognised. |
| Sign-in sessions | Until expiry (12 hours, or 14 days) or sign-out. |
| Licence-key records and the audit trail | 7 years after the account closes. These are the record of what was licensed to whom, which both sides may need. |
| Support tickets | 3 years after the ticket is closed. |
| Download log | 3 years. |
| Diagnostic logs you send us | With the ticket they belong to. |
After the period ends the data is deleted or reduced to figures that no longer identify anyone.
9. How it is protected
- Every connection to the website and the portal is encrypted (HTTPS).
- Passwords are stored as salted scrypt hashes and never in a form we can read.
- Sessions live on the server and can be revoked; the cookie carries only a random token, marked Secure and HttpOnly.
- Issued licence keys are encrypted at rest (AES-256-GCM) under a secret held outside the database.
- The audit trail is hash-chained, so an altered or deleted entry is detectable.
- Sign-in, registration and the enquiry form are rate-limited.
- Access to the server is by key, limited to the engineers who run it.
No system is beyond compromise. If a breach affects your personal data we will tell you and the relevant authority without undue delay, as the DPDP Act and the GDPR require.
10. Your rights
Whatever jurisdiction you are in, you may ask us for:
- Access - a copy of the personal data we hold about you and how it is used.
- Correction - of anything inaccurate or out of date - most of it you can edit from your dashboard.
- Erasure - of your data where we no longer need it for the purpose it was collected for or to meet a legal obligation. The recovery-key and audit records described above are retained for their stated period.
- Withdrawal of consent - where processing rests on consent - for instance an enquiry you sent us - with effect from the moment you withdraw it.
- Nomination - under India's DPDP Act, of another person to exercise these rights for you if you are unable to.
- Objection and portability - for people in the EEA, the United Kingdom and other jurisdictions that grant them, on the terms of that jurisdiction's law.
Write to support@recoveryantra.com. We may ask you to confirm that the account or the enquiry is yours. We answer within 30 days. If you are not satisfied you may complain to the Data Protection Board of India, or - for people in the EEA or the UK - to your local supervisory authority.
The website and the portal are for businesses and their staff and are not directed at anyone under 18. We do not knowingly collect personal data from children; if you believe we have, tell us and we will delete it.
11. Contact and changes
Grievance officer / privacy contact: Valuepitch E Technologies Pvt. Ltd., reachable at support@recoveryantra.com. Postal addresses are in the footer of every page.
When this policy changes, the version number and effective date at the top change with it, and the previous version is available on request. A change that reduces your rights or adds a new use of your data will be announced by email to partner accounts before it takes effect. Continued use of the portal after that date is acceptance of the new version.
Version 1.1 · effective 13 September 2026 · This page describes the software at version 7.8.10.76.