01Who we are
Tervais is a software development company based in Islamabad, Pakistan. We design and build AI software, AI agents and chatbots, workflow automations, custom software, web and mobile applications, business websites and ERP systems, and we operate software products for clients in several countries.
In this policy, “Tervais”, “we”, “us” and “our” mean Tervais. “You” means anyone who visits this website, contacts us, uses a product we operate, or is a contact at one of our clients or suppliers.
We handle personal information under this policy as the party that decides how and why it is used — the controller — except where a client decides that and we act on their instructions, which section 11 explains.
- Privacy contact
- [email protected] · +92 313 811 3369
- Postal address
- Ali Pur Farash
Islamabad, Islamabad 45600
Pakistan
02What this policy covers
This policy covers three things:
- This website — tervais.com and every page we host on it, including any form on it.
- Our own business contacts — people who enquire, request a quote, negotiate or work with us on a project, and the staff of clients, suppliers and partners we deal with.
- Products we operate — software we host or run for a client, where we handle the personal information inside that system on the client’s instructions.
It does not cover services we do not control. Where we link to WhatsApp, Google Maps, an app store or a client’s own systems, those providers handle your information under their own policies.
The Terms of Service cover the commercial side of working with us.
03Who is responsible
Two different situations exist, and they matter for which rights you can exercise directly with us.
We are the controller
We decide how to use the information of people who contact us, visit this site, or deal with us while we provide services: enquiries, proposals, contracts, invoices, support conversations and business contacts. For that information, we are responsible, and you can come to us directly.
Our client is the controller
When we build, host or run a system for a client, the client decides what information the system collects and why. We process it only on their instructions. In that case the client’s privacy notice applies, and the client is the right place to start with questions or requests about your information in that system.
Section 11 sets out what we do when we act on a client’s instructions.
04Information you give us
We receive what you choose to send. In practice that is:
- Contact and enquiry details — your name, email address, phone or WhatsApp number, company, country, and the message or project brief you write.
- Project information — requirements, documents, sample data, screenshots and meeting notes you share while we plan or build.
- Account access for integrations — credentials or API keys you provide so we can connect your tools. We ask you to create a dedicated account for our work instead of sharing a personal one.
- Billing details — company name, billing address, invoice contact, tax identifiers and the country you are billed in. We do not store full payment card numbers on our own systems; card payments are processed by banks or payment providers.
- Support and product data — messages you send to support, and anything you upload to a product we operate.
Please do not send us sensitive information — medical records, government identity numbers, financial account numbers, biometric data — unless we have agreed in writing that a specific piece of work needs it.
05Information collected automatically
The server that delivers these pages records standard technical information each time a page is requested: IP address, browser and device type, the page requested, the referring page, the response code and the date and time.
We use it to keep the site online, diagnose faults, understand in aggregate which pages are used, and block abuse. We do not use it to build advertising profiles, and we do not combine it with the details you send us.
In software products we operate, we may collect technical logs and aggregated usage information — for example error traces, feature usage counts and response times — to run, secure and improve the product. Where a client’s system generates those logs, section 11 applies.
06The project form on this site
The project form on our home page runs entirely inside your browser. When you press Prepare my message, the page assembles a text message from what you typed and, if you choose, opens WhatsApp with that message pre-filled.
Worth knowing
The form does not send your details to our server. Nothing reaches us until you press send in WhatsApp, or copy the text and email it to us yourself. If you fill the form and close the tab, we never see it.
The Copy buttons use your browser’s clipboard to place text on your own device. That text is not transmitted to us.
08How we use information
We use personal information to:
- reply to enquiries, answer questions and prepare proposals and quotes;
- agree scope, timelines and fees, and administer the contract between us;
- design, build, test, deploy, host and support the software we provide;
- operate invoices, payments, tax records and accounting;
- provide support, investigate faults and notify you of changes that affect you;
- keep our systems secure, prevent fraud and abuse, and defend legal claims;
- meet legal, tax, accounting and regulatory obligations that apply to us.
We do not sell personal information, and we do not use it for cross-context behavioural advertising. We send marketing email only where we have a lawful basis to do so, and every message includes a way to opt out.
09Legal bases
Where a law requires us to identify a legal basis — for example the EU or UK General Data Protection Regulation — we rely on one or more of these:
- Contract — to take steps you ask for before a contract, and to perform a contract with you.
- Legitimate interests — to run and secure our business, respond to enquiries, operate our products and improve our services, balanced against your rights and freedoms.
- Consent — where we ask for it, for example before sending marketing email. You can withdraw consent at any time.
- Legal obligation — to keep records, respond to lawful requests and comply with tax and accounting law.
11Information we handle for a client
When we build, host or run a system that holds a client’s customers’, students’, patients’ or employees’ information, the client decides what is collected and why. We process that information on the client’s documented instructions, and the client’s own privacy notice applies.
When we act on a client’s instructions:
- we use the information only to provide the agreed services, and never for our own purposes;
- we sign a data processing agreement that sets out the subject matter, duration, nature and purpose of the processing, the security measures, sub-processors, breach notification and deletion;
- we keep it confidential and restrict access to the people who need it;
- we keep and provide a list of sub-processors on request, and tell the client before adding a new one that processes personal information;
- we help the client respond to access, correction, deletion, restriction and portability requests within the time limits the law sets;
- we notify the client without undue delay after becoming aware of a personal data breach affecting their information;
- we return or delete the information at the end of the engagement, and delete residual copies from backups on our normal backup cycle.
If you are a customer, student, patient or employee of one of our clients and have a question about your information in a system we built or run, contact that organisation first — they control the information and can act fastest. We help them when they ask us to.
12International transfers
We are based in Pakistan and work with clients and suppliers in other countries, so personal information may be processed outside the country where it was collected.
The hosting, email, backup and productivity providers we use process data in the European Union, the United Kingdom, the United States and Asia. Where the law requires safeguards for a transfer, we use them: the standard contractual clauses approved by the European Commission, the UK International Data Transfer Addendum, or another mechanism the law recognises. You can ask us for the details of the mechanism that applies to your information.
For client projects we can also agree, in the proposal or the data processing agreement, that personal information stays in a particular region or country. Where that constrains where a system can be hosted, we say so before work starts so the cost is known in advance.
13How long we keep information
We keep information only as long as we need it for the purpose it was collected for, or as long as the law requires:
- Enquiries that do not become projects — 24 months after our last contact, then deleted.
- Project, delivery, support and client contact records — six years after the engagement ends, for warranty, accounting and legal-claim purposes.
- Invoices, payment and accounting records — six years after the end of the tax year they relate to.
- Server and product logs — 30 days, except where a security incident requires us to keep a record longer.
- Client system data — for the term of the engagement, then returned or deleted as the data processing agreement describes.
We may keep information longer where the law requires it or a dispute is open, and we delete or anonymise it once it is no longer needed. Where we anonymise information, it can no longer be linked back to you.
14How we protect information
We use HTTPS for this site, restrict access to project information to the people working on it, use individual accounts rather than shared logins, keep systems patched, store secrets in a password manager, and take regular backups. For systems we build, we agree access control, audit logging, encryption in transit and at rest, and data handling with the client as part of the project.
No system is perfectly secure, and no method of transmission or storage is guaranteed. If an incident affects your personal information and creates a risk to you, we will notify you and the relevant authority where the law requires it, and we will tell you what we know, what we have done and what you can do.
15Your rights
Depending on where you live, you may have the right to:
- ask whether we hold information about you, and receive a copy of it;
- have inaccurate information corrected;
- ask us to delete information we no longer need;
- ask us to restrict or object to certain uses, including direct marketing;
- receive information you gave us in a portable, machine-readable format;
- withdraw consent you gave earlier, without affecting what was done before.
To exercise any of these, email [email protected]. We reply within 30 days. Where the law sets a shorter period, we meet it, and if a request is complex we tell you before the period ends and explain how long we need.
We may ask for information to confirm who you are, so we do not disclose information to the wrong person. We do not charge a fee, unless a request is manifestly unfounded or excessive, in which case the law allows us to charge a reasonable fee or refuse it.
Some rights have limits — we may need to keep a record to meet a legal obligation, or to establish or defend a claim. Where we cannot act on a request we explain why, and you can complain to a supervisory authority.
If the information belongs to a client’s system, contact that client first. We will support them, but they decide how to respond.
16Regional rights and notices
Nothing in this policy limits rights the law where you live gives you. These notices apply where that law requires them.
European Economic Area and the United Kingdom
- We process personal information on the bases set out in section 9, and only for the purposes in section 8.
- You can ask for the safeguards that apply to a transfer outside the EEA or the UK, including a copy of the standard contractual clauses or the UK Addendum.
- You can lodge a complaint with the supervisory authority in your country. We would prefer the chance to resolve it with you first.
- Where we act on a client’s instructions, the client is the controller and handles requests about the information in their system.
United States, including California
- We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no sale or sharing opt-out to exercise.
- You can ask what categories of personal information we hold about you, ask for a copy, ask us to correct it, or ask us to delete it.
- We do not discriminate against anyone for exercising a privacy right, and we do not offer financial incentives for personal information.
- Our services are provided to businesses. We do not knowingly collect personal information from consumers under 16 through this site.
Other countries
If the law where you live gives you additional rights — for example under data protection law in Brazil, Canada, India, Japan, South Korea, Australia or the Gulf states — contact us and we will honour them where they apply to the information we control.
17Children
This website and our services are for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 18 through this site.
Some systems we build for schools and clinics hold records about, or are used by, minors. In those projects the school or clinic is the controller: it provides the legal basis and any consent the law requires, and we process the information only on its instructions, as section 11 describes.
If you believe a child has sent us personal information directly, tell us and we will delete it.
18AI features and automation
Some systems we build use AI models, including models operated by third parties. Where a client’s system sends information to a model provider, we choose providers with appropriate terms, send only what the task needs, and document in the system what is sent, to whom and where.
Take care with chatbots
AI answers can be wrong, and public chatbots may keep what you type. Do not paste confidential or personal information into an AI tool unless your agreement with us covers it.
AI output is reviewed by a person before it affects a customer, a payment, a medical decision or a legal obligation. Where a system makes or supports a decision about an individual, we design it so a human can review and correct the outcome, and so the decision can be explained.
We do not use information from your systems to train models for our own purposes or for anyone else’s.
19Links to other services
This site and our products link to WhatsApp, Google Maps, app stores and services we do not operate. Once you follow such a link or connect such a service, its own privacy policy applies. We are not responsible for how it handles your information.
20Changes to this policy
We update this policy when our services, our suppliers or the law change. The date at the top of the page shows the current version.
If a change materially affects how we use information we already hold, we will tell the people concerned by email before it takes effect, and where the law requires consent we will ask for it.
If you would like an earlier version, ask us and we will send it.
21How to contact us
Questions about this policy, or a request about your information, can go to any of these:
Ali Pur Farash
Islamabad, Islamabad 45600
Pakistan
We acknowledge privacy requests within two business days and answer them within 30 days.