Privacy Policy

1. Data Controller

Udhyam is operated by Deepak Achary, who serves as the Data Protection Officer (DPO) under the Digital Personal Data Protection Act, 2023 (DPDP Act).

• Data Controller: Deepak Achary
• DPO Email: [email protected]
• Grievance Officer: Same as DPO (see DPO page)

2. Information We Collect

2.1 Information You Provide

Account details (name, email, business name, GSTIN), inventory data, transaction history, and billing records.

2.2 Information Collected Automatically

• Usage data (pages visited, features used, session duration)
• Device and browser information
• IP address and approximate location

2.3 Payment Information

We do not process payments directly. Payment processing is handled by N/A (no payments integrated) and we do not store full payment card details.

3. How We Use Your Information

• To provide and maintain the Service
• To process transactions and send related communications
• To improve and personalize the Service
• To communicate with you about updates, security, and support
• To detect and prevent fraud or abuse

4. Consent Management

Under the DPDP Act 2023, we obtain your consent for specific data processing activities:

• Profile Storage — storing your account and business profile data
• Invoice Data — processing and storing billing/invoice records
• Email Updates — service emails, invoices, and account notifications
• Marketing — promotional communications (optional)

You may withdraw consent for any feature at any time. Withdrawal is processed within 24 hours and does not affect the lawfulness of processing before withdrawal. To manage your preferences, visit your account Settings or contact [email protected].

5. Third-Party Services

We use the following third-party services:

Service	Purpose	Data Shared
Supabase Inc.	Database, authentication, storage	Account data, usage data
Cloudflare Inc.	CDN, DNS, DDoS protection	IP address, request metadata
N/A (no payments integrated)	Payment processing	Payment details (PCI-DSS compliant)

Each third-party service has its own privacy policy governing the use of your data.

6. Data Storage & Security

• Data is stored on self-hosted PostgreSQL 16 in Oracle Cloud Mumbai, India (ap-south-1)
• All data remains within Indian borders in compliance with DPDP Act 2023 data localization requirements
• We implement encryption in transit (TLS 1.3) and at rest
• Access controls and RLS policies restrict data access
• Backups are performed daily with 7-day retention

7. Data Retention

We retain your data for as long as your account is active. You can request deletion any time from Settings → Delete Account; your data is then purged within 48 hours. Requests are cancellable during that window, and cancelling deletes nothing. Records may be retained longer only where required by law (for example, tax or accounting obligations).

8. Your Rights (GDPR)

If you are in the EEA, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

9. Your Rights (DPDP Act 2023)

If you are in India, the Digital Personal Data Protection Act, 2023 grants you the following rights:

• Right to Access — obtain a summary of personal data processed and details of processing
• Right to Correction — correct inaccurate or misleading personal data
• Right to Erasure — request deletion of your personal data
• Right to Grievance Redressal — file a grievance with the DPO
• Right to Withdraw Consent — withdraw consent previously given

To exercise your DPDP rights: File a grievance via our DPO page or email [email protected].

10. Breach Notification

In the event of a data breach that may compromise your personal data, Udhyam will:

• Acknowledge the incident within 24 hours
• Notify the Data Protection Board of India and affected users within 72 hours (as required by DPDP Act Section 8(6))
• Implement fixes and publish a post-mortem within 14 days

To report a suspected breach: [email protected] with subject "SECURITY INCIDENT".

11. Cookies

We use essential cookies for authentication and session management. We do not use tracking cookies or third-party analytics cookies.

12. Children's Privacy

The Service is not intended for users under 18. We do not knowingly collect data from children.

13. Changes to This Policy

We may update this policy. Material changes will be communicated via email or in-app notification.

14. Contact & Grievance Redressal

Data Controller / DPO: Deepak Achary
Email: [email protected]
Grievance: File via DPO page

If your grievance is not resolved satisfactorily, you may escalate to the Data Protection Board of India at complaints.dpbi.gov.in.