Privacy policy

When you submit an enquiry or request a quotation. Your name, business email address, telephone number, the organisation you represent, and what you told us you need. Where you ask for a formal quotation or an invoice, also your billing address and GSTIN.

When you create an account. The above, plus a password, which is stored only as a bcrypt hash and is never readable by us or recoverable in plain text.

When you place an order. The purchase order reference, the delivery contact, and the licence assignments made against the order. Where we provision into your tenant, the administrator email address needed to do it.

When you contact support. The content of the ticket and the correspondence on it.

Automatically, on every request. Your IP address, the page requested, the time, and the browser's user-agent string, recorded in server logs. Where a request fails or a security control is triggered, the same information is recorded in an audit log with the account it relates to.

Under the Digital Personal Data Protection Act, 2023 we process personal data either with your consent or for a legitimate use permitted by the Act. In practice:

• To answer your enquiry and prepare a quotation. You gave us the data for this purpose; that is the consent.
• To perform a contract — provisioning licences, issuing invoices, providing support, managing renewals.
• To meet a legal obligation — tax invoicing and the retention of books of account.
• To keep the service secure — rate limiting, audit logging, and investigating misuse.
• To tell you about a renewal that is approaching, which is a service message about something you already own rather than marketing.

We do not sell personal data, and we do not use it to build advertising profiles. We do not send marketing email to an address that only ever reached us through a support ticket.

Publishers and distributors, where provisioning a licence requires it. To create a Microsoft, Adobe, Autodesk or Zoho subscription in your name we must pass the administrator's name, email address and the organisation's details to that publisher or to the distributor through whom the programme runs. Provisioning cannot happen without this, and it happens only for orders you have placed.

Our hosting and email providers, who process data on our instructions in order to run the site and deliver mail.

Professional advisers, auditors and authorities, where we are required to disclose — a lawful demand, a tax audit, or the defence of a legal claim.

That is the complete list. We do not share personal data with anyone else, and we do not transfer it as an asset except as part of a transfer of the business as a whole, in which case you would be told.

Transfers outside India. Some publishers operate their provisioning and support systems outside India. Where a licence you have ordered is provisioned through such a system, the data needed to provision it is processed there. We do not transfer personal data outside India for any other purpose.

The commercial retention periods are statutory minimums and we cannot shorten them on request — an invoice cannot be deleted from the books because its recipient asked. Everything outside those periods can be, and is.

Under the Digital Personal Data Protection Act, 2023 you may:

• ask what we hold about you, and why, and who it has been shared with;
• have it corrected where it is wrong, incomplete or out of date — you can do most of this yourself in the account area;
• have it erased, where we are not required to keep it for one of the reasons above;
• nominate someone to exercise these rights on your behalf if you die or become incapacitated;
• withdraw consent where processing rests on consent — though withdrawing it may mean we can no longer provide the service it supported;
• complain to us, through the grievance officer below, and afterwards to the Data Protection Board of India if you are not satisfied.

To exercise any of these, write to the grievance officer named below. We will respond within thirty days. We may need to verify who you are before acting, which is a protection for you rather than an obstacle.

• All traffic is served over TLS. Session cookies are marked HttpOnly, Secure and SameSite, so they cannot be read by scripts or sent from another site.
• Passwords are stored as bcrypt hashes with a per-password salt.
• Every state-changing request carries a CSRF token that is checked against the request's origin.
• Staff access is role-based and least-privilege: sales staff cannot reach content administration, and content administrators cannot reach another organisation's commercial records without an audit entry.
• Administrative actions are written to an audit log with the actor and the source address.
• Credentials, tokens and payment fields are redacted from application logs before they are written.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and every affected person as required by the Act, describing what happened, what data was involved, and what to do about it.

This site sets two cookies, both strictly necessary, and no others. There is no analytics, advertising or tracking cookie anywhere on it. The cookie policy names each one and says what it does.

This is a business service and is not directed at children. We do not knowingly collect the personal data of anyone under 18. If you believe a child's data has reached us, tell the grievance officer and it will be deleted.

We will update this policy when what we do changes, or when the law does. Where a change materially affects how we handle data you have already given us, we will tell account holders by email rather than only publishing it. The date of the last change is shown in the page footer.