Privacy Policy

Last updated: 4 October 2026. Effective: when this page goes live.

Who we are

SanPan Studio Private Limited ("SanPan Studio", "we", "us") operates the TradeOps platform at app.indusarth.com. We help Indian manufacturers and traders run their procurement, sales, and accounting workflows. This policy explains what personal and business data we process when you sign up for TradeOps or your company is invited as a counterparty.

What we collect

From you, at signup

• Your name, work email, and password (stored only as an Argon2id hash — we never see the plaintext).
• Your company's legal name and (once you complete the company profile) GSTIN, PAN, registered address, and primary contact details.
• Your acceptance timestamp + IP address for the Terms of Service and this Privacy Policy.

From your use of the product

• Vendor / customer master data you create — names, addresses, contact emails, bank account details (the bank account number is encrypted at rest with AES-GCM).
• Transactional records you enter — RFQs, purchase orders, invoices, goods receipts, payments.
• An audit trail of state-changing actions (who did what, when) so disputes can be reconstructed.
• Session metadata — login times, IP addresses, browser user agents — for security investigations.

From the marketing site

• If you contact us through indusarth.com — for example to start a trial or request the investor deck — we store the contact details and message you send us.
• Cloudflare may log request metadata (IP, country) for DDoS protection. We do not run third-party analytics or advertising trackers.

Why we collect it

• To run the service — issue logins, route data to the right tenant, send transactional emails.
• To comply with law — books of account under Companies Act 2013 § 128(5); GST records under CGST Act § 35; MSME aging tracking under MSMED Act § 15.
• To support you — when you write to contactus@indusarth.com we may look at your data to debug a problem you've reported.
• To improve the service — aggregate, anonymised metrics about feature usage. We do not sell or use your business data to train models.

Who we share it with

With your counterparties

TradeOps is a network. When you connect with a vendor or customer — always through an invitation that one of you accepts — the two of you transact on shared records. So your company's identity block (legal name, GSTIN, registered address, and primary contact details) and the trade documents you exchange (purchase orders, quotations, invoices, goods receipts, dispatch notes) are visible to that connected counterparty. This is inherent to B2B trade and to GST-compliant invoicing, which requires each party's GSTIN and address on the document. Only parties you have deliberately connected with can see this — never the general public, and never another tenant you have no relationship with.

With our sub-processors

We otherwise share your data only with the sub-processors strictly needed to operate the service:

• Google Cloud (GCP) — hosting, database and file storage, in the Mumbai (asia-south1) region. Holds all of your data at rest.
• Google Vertex AI (Gemini) — the AI that reads a document you upload and drafts entries from it, in the Mumbai (asia-south1) region. It receives document content, which can include names, GSTIN, addresses, contact email and phone numbers. We do not permit your data to be used to train models.
• Cloudflare — DNS, CDN, DDoS protection and TLS termination in front of the application. Sees requests in transit; stores nothing.
• ZeptoMail (Zoho) — transactional email delivery (signup verification, password resets, invitation links), from an India data centre. Receives recipient name and email address.
• Sentry — error tracking, so we find out a screen broke before you have to tell us. Receives stack traces. Email addresses are stripped before they are sent; other identifiers can still appear inside an error value, and Sentry is the one subprocessor hosted outside India.
• GSP (GST Suvidha Provider) — would file your GST e-invoices and return the IRN, within India. Not active as of the date at the top of this page; e-invoicing runs in log-only mode and no GSP is contracted, so no invoice data leaves us for this purpose today.
• Google Document AI — OCR, as a fallback when the AI above cannot read a scan. Not active as of the date at the top of this page; it is switched off in production.
• Razorpay — payment-gateway processing of subscription fees, within India. Not active as of the date at the top of this page; we do not yet charge through the product.

That is the whole list. Tally runs on your own premises when you connect it, so your vouchers never pass through a third party, and GitHub holds our source code and no customer data at all. If we add a subprocessor we will update this list and the “Last updated” date before the new one starts processing.

We don't sell your data. We don't share it with advertisers. We share only when compelled by Indian law (a court order, RBI / GST regulatory request, etc.) and only the minimum required.

Where it's stored

All TradeOps data sits on Google Cloud infrastructure in the Mumbai (asia-south1) region. Daily encrypted backups go to Google Cloud Storage in the same region. We don't transfer your data outside India.

How long we keep it

Different categories of data have different retention windows, driven by Indian law:

• Financial records (invoices, purchase orders, payments, GRNs) — 7 years from soft-deletion, satisfying Companies Act § 128(5) and CGST Act § 35.
• Operational records (vendor / customer master data, RFQs) — 2 years from soft-deletion.
• Personal contact data (vendor / customer contact persons) — 30 days from soft-deletion.
• Audit trail (event log of state changes) — kept as long as the underlying records, then purged.
• Marketing-site enquiries (emails you send us from indusarth.com) — kept until you ask us to remove them.

An automated nightly job enforces these windows. Backups are retained for 30 days; we will extend backup retention to match the legal floor before our first paying customer goes live.

Your rights under the DPDP Act 2023

As a Data Principal under India's Digital Personal Data Protection Act, 2023 you have the right to:

• Confirm what personal data we process about you (right to access).
• Correct inaccuracies in your personal data (right to correction).
• Request erasure of your personal data, subject to the legal-retention floors above (right to erasure).
• Withdraw consent for any optional processing.
• Nominate someone to exercise these rights on your behalf if you are unable.
• Raise a grievance with our Grievance Officer or, if unresolved, with the Data Protection Board of India.

To exercise any of these rights, email our Grievance Officer at grievance@indusarth.com. We acknowledge within 3 working days and aim to resolve within 30 days — see Grievance Officer below. Signed-in users can find the same contact under Settings → Account → Privacy & legal.

Security

• Passwords stored as Argon2id hashes.
• Bank account numbers encrypted at rest (AES-GCM, per-environment master key).
• TLS in transit (Let's Encrypt certificates, HTTP Strict Transport Security).
• Multi-factor authentication available; required for tenants on the Trade plan.
• Row-level security at the database layer so one tenant cannot read another tenant's data.
• Daily encrypted backups; recovery procedures documented in our internal runbook.

We are working toward SOC 2 Type II attestation. No certification is claimed today.

Cookies

We use two strictly-necessary cookies on app.indusarth.com:

• tradeops_access — short-lived (15 min) access token.
• tradeops_refresh — refresh token (7 days).

Both are HttpOnly, Secure, SameSite=Lax. We do not set advertising or analytics cookies. The marketing site (indusarth.com) sets no application cookies.

Children

TradeOps is a B2B product not directed at children. We don't knowingly collect data from anyone under 18.

Changes to this policy

We'll post material changes here and email all account admins at least 14 days before they take effect. The "Last updated" date at the top reflects the latest change.

Grievance Officer

As required by the DPDP Act 2023 § 13 and the Information Technology Rules, 2011 — a named person, not a role:

We acknowledge within 3 working days — from a person, not an auto-reply — and aim to resolve within 30 days. If we have not resolved your grievance, you may escalate it to the Data Protection Board of India.

If you use TradeOps, the same contact and clocks are inside the product under Settings → Account → Privacy & legal, so you do not have to come back here to find them.

Reporting a security problem

If you have found a vulnerability, write to security@indusarth.com. This is a different route from the grievance address above, and it is read with severity in mind: we acknowledge within 5 working days, tell you our assessment and our intended fix window, and credit you when the fix ships if you would like to be credited.

Safe harbour. We will not pursue or support legal action against research conducted in good faith that stays within the limits set out in our machine-readable policy at /.well-known/security.txt — in short: test only what is yours, stop at the first sign you have crossed into another company's data and tell us rather than going further, no denial of service or social engineering, retain nothing, and give us a window to fix before publishing.

← Back to indusarth.com · Terms of Service