Privacy Policy

• Account Information: Name, email address, phone number, company name, and GST number when you register.
• Business Data: Products, inventory, orders, vendor details, and channel credentials you store on our platform.
• Payment Information: Billing details processed securely through Razorpay. We do not store your card numbers.
• Usage Data: Pages visited, features used, browser type, IP address, and device information collected automatically.
• Cookies: Session cookies for authentication and analytics cookies for improving our service.

• Provide, operate, and maintain the Kartriq platform.
• Process transactions and send billing-related communications.
• Respond to support requests and communicate service updates.
• Monitor usage patterns to improve features and performance.
• Prevent fraud and enforce our Terms of Service.

• AES-256-GCM encryption for channel credentials at rest.
• JWT-based authentication with HTTPS for all API communications.
• Role-based access control (RBAC) to limit data exposure.
• Regular security audits and automated vulnerability scanning.

• Service Providers: Payment processors (Razorpay), email services, and hosting providers who assist in operating our platform.
• Channel Integrations: Marketplace and logistics APIs you explicitly connect (e.g., Amazon, Flipkart, Shiprocket).
• Legal Compliance: When required by law, regulation, or legal process.

We retain your data for as long as your account is active or as needed to provide our services. When you delete your account from Settings → Security → Delete my account:

• Login is disabled at once — both password and Google sign-in stop working immediately, and your workspace status is set to DELETED so the team loses access.
• 30-day recovery window — your name, email, and phone are kept on file for 30 days so you can ask us to undo the deletion if you change your mind. Email privacy@kartriq.com from the same email address you signed up with to request a restore.
• After 30 days, personal identifiers are scrubbed — name, email, phone, password, avatar, and OAuth identifiers are removed permanently. Restoration is no longer possible after this point.
• Business records are retained — invoices, orders, audit logs, and tax-relevant documents are preserved as required by Indian GST and accounting regulations (typically 8 years). They're de-linked from your personal identifiers but remain in our records to satisfy legal and audit obligations.
• You can request a full erasure in writing to privacy@kartriq.com at any time — we'll review against our legal retention duties and respond within 30 days.

Under the Indian DPDP Act 2023 and applicable international laws (GDPR, CCPA), you have the right to:

• Access & correct your personal data from Settings → Profile.
• Export your full tenant data as JSON from Settings → Security → Download my data.
• Delete your account from Settings → Security → Delete my account (see Section 6 for what happens).
• Opt out of non-essential communications via the unsubscribe link in any marketing email.
• Withdraw consent for data processing — note that some processing (e.g. tax records) is required by law and cannot be withdrawn.
• Lodge a complaint with the Data Protection Board of India if you believe your rights have been violated.