Privacy Policy

This distinction decides who is answerable for what, so it comes first.

• Account data — the details of you and your users: name, email, phone, role. We decide how this is handled, so for it we are the Data Fiduciary.
• Your business records — customers, vendors, employees, invoices, projects. You decide what goes in and why. You are the Data Fiduciary for it; we only process it to run the service for you.

If your records contain other people’s personal data, it is your responsibility to have a lawful basis for holding it and to answer their requests. We will help you do so.

• Registration details: name, work email, phone number, company name, and your role.
• Authentication data: a bcrypt hash of your password — never the password itself — and session tokens.
• Content you enter or upload: business records, documents, images and attachments.
• Location, only from the Field Portal, and only when your administrator has enabled geo-fencing for your account. It is used to verify attendance punches against a site, and is off by default.
• Technical data: IP address, browser type, and timestamps of requests.
• Audit records: who changed which record and when, kept so an organisation can investigate its own activity.

We do not collect payment card details on the free Lite edition, because we do not charge for it. Should you take a paid subscription, card details are handled by the payment gateway and never stored on our servers.

• To provide the service, and to authenticate you.
• To keep each organisation’s data separate and secure.
• To answer support requests you raise.
• To send service messages — security notices, changes to these policies, planned downtime.
• To detect and investigate abuse, fraud, and security incidents.
• To meet legal and tax obligations.

We do not sell personal data, share it with data brokers, use it for advertising, or use your business records to train machine-learning models.

Each customer organisation is stored in a separate database, not as rows sharing a table with other customers. Access is further restricted by role, so a user sees only what their administrator has granted. Passwords are hashed with bcrypt. Traffic is encrypted in transit with TLS.

No system is perfectly secure, and we do not claim otherwise. If a personal data breach occurs we will notify the Data Protection Board of India and affected users as the DPDP Act requires.

We use a small number of providers, each only to the extent needed to run the service:

• Google Cloud Platform — application hosting and database hosting.
• Cloudflare — hosting for the web interface, and cookieless site analytics.
• Google Sign-In — if you choose to sign in with your Google account, Google verifies your identity for us; we receive your name and email address, never your Google password.
• A payment gateway — for any organisation on a paid plan, to process that payment. We never see or store your card details.
• An email delivery provider — transactional email such as password resets.

All data is hosted in India. Our application servers run in the Mumbai region, and the database is hosted in India. We do not transfer your personal data outside India. If that ever changes, we will update this policy and tell you before the change takes effect.

• Account and business data: for as long as your account is open.
• After you close your account: retained for a minimum of 3 months, so that an account closed in error can be restored. After that period we delete it, unless the law requires us to keep it longer.
• Audit and security logs: retained for a minimum of 3 months so an incident can be investigated, then removed.
• Records we must keep for tax or statutory reasons: kept for the period the law requires, and no longer.

You can ask us to delete your personal data sooner. We will do so where we are not required to retain it — see clause 7.

Under the DPDP Act 2023 you may:

• Ask what personal data of yours we hold and how it is processed.
• Ask us to correct data that is inaccurate, or complete data that is incomplete.
• Ask us to erase your personal data, where we are not required to keep it.
• Nominate another person to exercise these rights if you are unable to.
• Raise a grievance with us, and escalate to the Data Protection Board of India if unsatisfied.

Write to Snxwfairies.ai@gmail.com. We will respond within a reasonable time and will not charge you for a routine request.

If the data is in an organisation’s business records rather than in your own account profile, contact that organisation’s administrator — they control it, and we will direct you to them.

We use a small number of strictly necessary cookies — an httpOnly authentication cookie that keeps you signed in, and local storage for preferences such as your chosen view. We do not use advertising or third-party tracking cookies. Blocking the authentication cookie will prevent you from signing in.

This is business software and is not directed at children. We do not knowingly collect the personal data of anyone under 18. If you believe a child’s data has reached us, tell us and we will delete it.

As required by the DPDP Act 2023 and the Information Technology Act 2000, complaints about the handling of personal data may be addressed to:

Prashant Khandelwal
Grievance Officer, Snxwfairies Innovations Private Limited
Snxwfairies.ai@gmail.com · +91 9600 750 750

We aim to acknowledge a grievance within 24 hours and resolve it within 15 days. If you are not satisfied with the outcome, you may escalate to the Data Protection Board of India, or to a court of competent jurisdiction.

We may update this policy. The “last updated” date at the top changes when we do, and we will notify you of material changes in the application or by email.

Questions about this policy can go to Snxwfairies.ai@gmail.com or +91 9600 750 750.