Privacy and DPDP notice

• Identity of the organisation: legal name, GSTIN, PAN, and where applicable CIN, LLPIN or Udyam registration. These are verified against the issuing authority, and the result of that verification is stored.
• People: the name, work email and mobile number of each user on your account, and which permissions they hold.
• Addresses: your billing address and each delivery address, including pincode, which determines serviceability, delivery estimate and the tax treatment of your order.
• Documents you upload during onboarding, and the verification decisions made on them.
• Bank details, for suppliers only, including the account-holder name returned by a penny-drop verification.
• What you did here: orders, approvals, returns, warranty claims, tickets, and the audit trail of who changed what.

Consent under the DPDP Act is purpose-specific. Blanket consent is not consent, so we record each of these separately and you may hold some and not others. These are the exact six purposes the platform recognises.

• Verifying who you are — checking your GSTIN, PAN and documents against the issuing authorities so that an account can be approved.
• Messages about your transactions — order confirmations, delivery notifications, invoices, return and claim updates.
• Marketing — stock alerts, offers and newsletters.
• WhatsApp — receiving any of the above on WhatsApp rather than only by email.
• Credit assessment — where credit terms are requested. Credit is not offered today, so this purpose is not currently used.
• Sharing with logistics providers — passing a recipient name, address and phone number to whoever carries the machine to you.

You may withdraw any of the consents above. Write to the address in grievance redressal naming the purpose you are withdrawing.

Two things about withdrawal that are worth being plain about. First, withdrawing a consent does not delete the record that you once gave it — that record is the evidence that we had a lawful basis at the time, and it is kept, stamped with the moment you withdrew. Second, withdrawal is one-way: we cannot un-withdraw a consent, so restoring it means giving it again.

Messages about a transaction you have entered into are not sent on the basis of consent and do not stop when you withdraw one. If you have ordered a machine, we will tell you when it ships whether or not you have opted out of marketing. Only marketing and digests respect these flags.

• Verification providers, in order to check a GSTIN, PAN, bank account or address against the source. We send them the identifier being checked and nothing else.
• The logistics provider carrying your order, where you have consented to that sharing — the recipient, the address and a phone number.
• Our payment and accounting infrastructure, for the invoice and the money.
• Government, where a statute or a lawful order requires it.
• Suppliers see none of your data. A supplier is told which serial to ship and where, and that is the extent of it; they are not told who you are, and you are not told who they are.

Tax records — invoices and the transaction data behind them — are retained for the period the GST law requires, which is presently six years from the due date of the annual return for the relevant year. Consent records are retained for as long as the account exists, because a consent artefact that can be deleted is not evidence of consent.

A full retention schedule for everything else — onboarding documents, verification responses, audit logs — has not been settled and is not published here. We will not publish a period we are not yet enforcing.

General retention schedule — not yet published

Under the DPDP Act you may ask for a summary of the personal data we hold about you and how it is processed; ask us to correct or complete it; ask us to erase it where we no longer need it for the purpose it was collected for or to meet a legal obligation; and nominate someone to exercise these rights if you cannot.

Requests go to the grievance officer, and are answered on the timescales published in grievance redressal.