Privacy Policy

Last updated: 14 July 2026 · DPDPA 2023 compliant · GDPR-aligned

This Policy explains how SolvexaRetail (operated by Solvexa Systems, "we") collects, uses, stores, and protects personal information under India's Digital Personal Data Protection Act, 2023 (DPDPA).

1. Who this Policy applies to

This Policy applies to (a) Users — individuals who create an account or log in, (b) Tenant business data — items, customers, vendors, transactions you upload, and (c) Website visitors — anyone browsing solvexaretail.com.

2. What data we collect

2a. Directly from you

Account: Name, email, phone, business name, GSTIN, PAN, business address.
Login: Username, password hash (never plaintext).
Business data: Items, customers, vendors, transactions, prescriptions (for Pharma), invoices, tax records — as you upload.
Payment: When you upgrade, Razorpay processes card/UPI details. We do NOT store card numbers.
Support tickets: Any messages you send to /Support or email.

2b. Automatically

Usage: Page views, features accessed, Saathi AI queries, error logs.
Device: IP address, browser type, OS.
Cookies: A single session cookie (auth) + a preference cookie (theme). No third-party tracking cookies.

2c. From third parties

None currently. If we integrate marketing tools later, we'll update this Policy with 30 days' notice.

3. Why we collect it — Purpose & Legal Basis

Purpose	Data	Legal basis (DPDPA)
Provide the Service	Account + business data	Contract performance
Charge for Paid Plans	Payment info via Razorpay	Contract performance
Respond to support	Support ticket content	Legitimate interest
Detect fraud / abuse	Login IP + usage patterns	Legitimate interest
Comply with tax laws	GST invoices, financial records	Legal obligation
Send transactional email	Email + notification preferences	Contract performance
Send marketing email	Email (opt-in only)	Consent

4. Sharing your data

We do not sell your data. We share only with:

Sub-processors — DigitalOcean (hosting, India-region servers), Razorpay (payments), Meta (WhatsApp), GoDaddy (SMTP), Ollama / Anthropic (AI inference — with tenant data anonymised where possible).
Law enforcement — when required by a valid Indian court order, subpoena, or notice under the DPDPA or CrPC.
Business transfer — in event of merger/acquisition, with 30 days' prior notice.

5. Your Tenant customers' data (Data Processor role)

Data you upload about your end-customers (their names, phones, purchases) — you are the Data Fiduciary under the DPDPA. We act as your Data Processor and process this data solely on your instructions. You are responsible for obtaining consent from your customers for their data processing. We provide the technical tools (e.g. WhatsApp opt-in flow) to help you comply.

6. Data location & transfers

Primary data storage is in India (DigitalOcean Bangalore region). AI inference may temporarily route to servers in the United States (Anthropic Claude) or self-hosted Ollama in India. No data is stored in prohibited or restricted jurisdictions per DPDPA Section 16.

7. Data retention

Data type	Retention
Live tenant data (active account)	As long as account exists
Deleted account PII	Erased within 30 days
Backups	Purged within 90 days of deletion
GST invoices & financial records	7 years (statutory under GST Act §36)
Audit logs (login, errors)	2 years
Support ticket history	3 years after last interaction

8. Your rights under DPDPA

Right to access: Request a copy of your data — via Admin → Export or by emailing us.
Right to correction: Update any inaccurate personal data in your account settings.
Right to erasure: Delete your account via Account → Delete. Subject to statutory retention.
Right to grievance redressal: Contact our Grievance Officer (below) within a reasonable time; expect response within 15 days.
Right to nominate: Nominate a person to exercise your rights in case of death or incapacity — email us.
Right to withdraw consent: For any processing based on consent (e.g. marketing emails) — via unsubscribe link or account settings.

9. Grievance Officer

In accordance with DPDPA Section 8(9) and the IT Rules 2011:

Grievance Officer: Sudipto (Founder)
Email: contactus@solvexaretail.com
Response time: within 15 business days
Escalation: If unresolved, you may complain to the Data Protection Board of India.

10. Security

We use industry-standard measures: TLS 1.2+ for all connections, PBKDF2 password hashing, encrypted database backups, session cookies with SameSite=Lax + Secure, HSTS enforcement, Content Security Policy, per-tenant data isolation via CompanyID scoping. No system is 100% secure — we commit to notifying you within 72 hours of any material breach affecting your data, as required by DPDPA Section 8(6).

11. Children

The Service is not intended for individuals under 18. We do not knowingly collect data from minors. If you believe a minor has provided data, email us for immediate deletion.

12. Changes to this Policy

Material changes will be notified via in-app banner + email at least 30 days before taking effect. Continued use after the effective date constitutes acceptance.

13. Contact

Privacy questions: contactus@solvexaretail.com
Solvexa Systems · Bengaluru, Karnataka, India