Privacy Notice

Governed by the Digital Personal Data Protection Act, 2023 (DPDP Act) and IT Act 2000 SPDI Rules.

1. Who We Are

ChakraOS is a business management SaaS platform for Indian SMBs. We are the Data Fiduciary under the DPDP Act in respect of personal data collected through this platform. For privacy queries, contact us at privacy@chakraos.com.

2. Data We Collect and Why

Category	Examples	Purpose
Account data	Name, email, phone, password (hashed)	Authentication, communication
Business identity	GSTIN, PAN, business name, address	GST compliance, invoice generation
Financial records	Invoices, payments, purchase orders	Core SaaS functionality
Banking details	Bank account numbers, IFSC codes	Payment link generation
Party data	Names, GSTINs of your customers/vendors	Party management module
Security data	IP address, browser info, timestamps	Security logging, audit trail

We collect only what is necessary to provide the service.

3. Legal Basis

Consent — captured at signup for personal data processing
Contract performance — processing required to deliver the subscribed service
Legitimate interest — security logging, fraud prevention, service integrity
Legal obligation — records required under Indian tax law (GST, TDS/TCS)

4. Data Retention

Active account data: duration of subscription
Financial records: subscription duration + 3 years post-termination (CGST Act requirement)
Security and audit logs: 3 years
After verified deletion request: deleted within 30 days

5. Data Security

All data in transit encrypted via TLS 1.2+
Role-based access control (RBAC); tenant-isolated storage
Immutable audit log of all sensitive write operations
Daily automated database backups with tested restore procedures
Production system access limited to authorised personnel only

6. Your Rights Under DPDP Act 2023

Access — request a summary of personal data we hold
Correction — request correction of inaccurate or incomplete data
Erasure — request deletion of your personal data (subject to legal retention obligations)
Grievance redressal — raise a complaint with our Data Protection Officer

To exercise any right, email privacy@chakraos.com with subject "DPDP Data Request". We will respond within 30 days.

7. Breach Notification

In the event of a confirmed personal data breach, we will notify you by email within 72 hours and inform the Data Protection Board of India as required.

8. Cookies

ChakraOS uses only session/authentication cookies required for the service to function. We do not use tracking or advertising cookies.

9. Changes to This Notice

We will notify you by email if we make material changes. Continued use of the service after notification constitutes acceptance.

← Back to registration