Privacy Policy
Effective Date: August 16, 2026
Trakto Technologies Sole Proprietorship of Siddhant Rander
This Privacy Policy explains how Trakto Technologies ("we," "us," or "our") handles your data when you use the Trakto platform, mobile app, and website (collectively, the "Service").
This policy complies with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), and the Information Technology Act, 2000.
Under the DPDP Act, we are the Data Fiduciary. You — and any individual whose data is processed through the Service — are a Data Principal.
1. What We Collect
Information you provide:
Account details — name, email, phone number, company name, password.
Team member details — names, roles, and credentials of employees or operators you add.
Images and documents uploaded via the camera for OCR or storage.
Payment records — we record that payment was received. We do not store bank account numbers, UPI PINs, or financial credentials.
Support messages and communications.
Business and financial data you enter:
Production records, compound formulations, bills of materials, inventory and stock data, purchase orders, sales orders, customer and buyer details, pricing, quotations, profit margins, dispatch records, costing and overhead calculations, job work records, material consumption data, and related manufacturing and commercial information. This data is treated as strictly confidential. Where it does not identify an individual, it is not classified as personal data under the DPDP Act — but we apply the same security and isolation standards to all data in the Service.
Collected automatically:
Device type, OS, app version, and device identifiers (from the App).
IP address, browser type, pages visited, and error logs (from the Website).
Authentication and access logs, retained for a minimum of 12 months.
What we do not collect:
We do not use analytics or tracking tools (no Google Analytics, Mixpanel, or similar).
The App does not access your contacts, location, or microphone — only the camera, and only when you initiate it.
2. Why We Process Your Data
We process personal data for the following purposes only:
Operating the Service and delivering features you use.
Managing your account, authentication, and subscription.
Responding to support requests.
Processing images for OCR and in-app storage.
Sending service notifications, subscription reminders, and occasional product updates via email or WhatsApp.
Maintaining security, monitoring performance, and keeping audit logs.
Complying with applicable Indian laws.
We do not use your data for advertising, profiling, or behavioural tracking.
3. Consent
By creating an account, you consent to processing your personal data for the purposes above.
You may withdraw consent at any time by emailing support@trakto.tech. Withdrawal is as simple as giving consent. Since processing your data is necessary to provide the Service, withdrawal will result in account closure and data deletion per Section 7.
If you add employees or team members to the Service, you are responsible for ensuring you have the necessary consent or lawful basis to share their data with us.
4. How We Share Your Data
We do not sell, rent, or trade your data.
Your data is never shared with other customers. Trakto is a multi-tenant platform — multiple businesses use the same Service. Your data is strictly isolated from every other customer at the database level using row-level security. No other customer or business can access your formulations, costing, profit margins, customer lists, sales records, pricing, financial data, production records, inventory, or any other data you enter into the Service. All commercial and financial data is treated as strictly confidential. We do not aggregate, anonymise, benchmark, or use your data to generate insights that are shared with or made available to any other customer or third party.
We share data only in these limited cases:
Infrastructure provider: Your data is hosted on Supabase (our Data Processor), on servers in India. Supabase processes data solely under our instructions and has no independent access to or use of your data.
Integrations you enable: If you activate a third-party integration (e.g., Tally), the data required for that integration is shared at your request. No integration is activated without your explicit action.
Legal obligations: When required by Indian law, court order, or a request from the Data Protection Board of India or tax authorities.
Business transfer: In a merger, acquisition, or sale, your data may transfer to the successor entity. You will be notified before any such transfer.
5. Where Your Data Is Stored
All data is stored on Supabase servers located in India. Your data does not leave India.
6. How We Secure Your Data
We implement reasonable security safeguards as required under Section 8(5) of the DPDP Act:
Encryption in transit — all communication over TLS/SSL.
Encryption at rest — data encrypted on our infrastructure provider's servers.
Row-level data isolation — each customer's data is isolated at the database level. One customer cannot access another's data.
Role-based access within the Service — you control what your team members can see. Operators can log production without viewing costs.
Internal access controls — fewer than 5 team members have access to customer data, all bound by confidentiality.
API security — secret keys stored in environment variables, never exposed to clients.
Automated backups — daily backups maintained by our infrastructure provider, stored in India.
Audit logging — authentication events and data access logged and retained for at least 12 months.
No system is 100% secure. We implement industry-standard protections but cannot guarantee absolute security.
7. Data Retention
While your subscription is active: We retain all your data and keep it accessible, backed up, and secure. This is our responsibility.
After cancellation or termination: Your data remains accessible for 90 days. During this window you can export your data or reactivate your account. After 90 days, data is permanently deleted from production systems. Backups containing your data are purged within 90 days of production deletion.
Legal retention: We may retain limited records beyond the above periods where required by applicable Indian law. Retention is limited to the minimum data and duration required by law.
On consent withdrawal: Personal data is erased within 30 days of your request, unless retention is required by law. We also cause our Data Processor to erase data made available to them, per Section 8(7) of the DPDP Act.
Your responsibility: You are responsible for maintaining your own copies of business records required for statutory compliance. We provide data export on request in standard formats (CSV) to support this.
8. Data Breach Notification
In the event of a personal data breach:
We will notify the Data Protection Board of India without delay.
We will notify affected Data Principals without delay, with details of the breach and recommended protective steps.
A detailed report will be submitted to the Board within 72 hours, covering the nature, cause, remedial actions, and notification status.
9. Your Rights
Under the DPDP Act, you have the right to:
Access a summary of your personal data and how it is processed.
Correct inaccurate or incomplete data, via account settings or by contacting us.
Erase your personal data by requesting account deletion.
Export your data in a machine-readable format (CSV).
Withdraw consent at any time.
File a grievance with our Grievance Officer, and escalate to the Data Protection Board of India if unresolved.
Contact support@trakto.tech to exercise any of these rights. We will respond within a reasonable timeframe as prescribed under the DPDP Rules.
10. Grievance Officer
Grievance Officer: Siddhant Rander Email: support@trakto.tech Acknowledgement: Within 48 hours Resolution: Within 30 days
If unresolved, you may escalate to the Data Protection Board of India.
11. Camera Access
The App uses your camera only for OCR scanning and image uploads — only when you initiate it. The App does not access your camera in the background. You can revoke permission in your device settings at any time.
12. Children
The Service is for business use. We do not knowingly collect data from anyone under 18. If we learn we have collected a child's data without verifiable parental consent (per Section 9, DPDP Act), we will delete it promptly.
13. Cookies
The Website uses essential cookies for login sessions only. No advertising or tracking cookies. The App does not use cookies.
14. Third-Party Services
Integrations with third-party services (e.g., Tally) are governed by their own privacy policies. We are not responsible for their data practices.
15. Changes to This Policy
We may update this policy. Material changes will be communicated via email or on the Website. If a change alters the purpose of processing, we will seek fresh consent. Continued use after updates constitutes acceptance.
16. Governing Law
This policy is governed by the laws of India, including the DPDP Act 2023, DPDP Rules 2025, and IT Act 2000. Disputes fall under the exclusive jurisdiction of courts in Bengaluru, Karnataka.
17. Contact
Trakto Technologies
Proprietor: Siddhant Rander Email: support@trakto.tech
Website: https://trakto.tech
WhatsApp: +91 91139 82979
This Privacy Policy explains how Trakto Technologies ("we," "us," or "our") handles your data when you use the Trakto platform, mobile app, and website (collectively, the "Service").
This policy complies with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), and the Information Technology Act, 2000.
Under the DPDP Act, we are the Data Fiduciary. You — and any individual whose data is processed through the Service — are a Data Principal.
1. What We Collect
Information you provide:
Account details — name, email, phone number, company name, password.
Team member details — names, roles, and credentials of employees or operators you add.
Images and documents uploaded via the camera for OCR or storage.
Payment records — we record that payment was received. We do not store bank account numbers, UPI PINs, or financial credentials.
Support messages and communications.
Business and financial data you enter:
Production records, compound formulations, bills of materials, inventory and stock data, purchase orders, sales orders, customer and buyer details, pricing, quotations, profit margins, dispatch records, costing and overhead calculations, job work records, material consumption data, and related manufacturing and commercial information. This data is treated as strictly confidential. Where it does not identify an individual, it is not classified as personal data under the DPDP Act — but we apply the same security and isolation standards to all data in the Service.
Collected automatically:
Device type, OS, app version, and device identifiers (from the App).
IP address, browser type, pages visited, and error logs (from the Website).
Authentication and access logs, retained for a minimum of 12 months.
What we do not collect:
We do not use analytics or tracking tools (no Google Analytics, Mixpanel, or similar).
The App does not access your contacts, location, or microphone — only the camera, and only when you initiate it.
2. Why We Process Your Data
We process personal data for the following purposes only:
Operating the Service and delivering features you use.
Managing your account, authentication, and subscription.
Responding to support requests.
Processing images for OCR and in-app storage.
Sending service notifications, subscription reminders, and occasional product updates via email or WhatsApp.
Maintaining security, monitoring performance, and keeping audit logs.
Complying with applicable Indian laws.
We do not use your data for advertising, profiling, or behavioural tracking.
3. Consent
By creating an account, you consent to processing your personal data for the purposes above.
You may withdraw consent at any time by emailing support@trakto.tech. Withdrawal is as simple as giving consent. Since processing your data is necessary to provide the Service, withdrawal will result in account closure and data deletion per Section 7.
If you add employees or team members to the Service, you are responsible for ensuring you have the necessary consent or lawful basis to share their data with us.
4. How We Share Your Data
We do not sell, rent, or trade your data.
Your data is never shared with other customers. Trakto is a multi-tenant platform — multiple businesses use the same Service. Your data is strictly isolated from every other customer at the database level using row-level security. No other customer or business can access your formulations, costing, profit margins, customer lists, sales records, pricing, financial data, production records, inventory, or any other data you enter into the Service. All commercial and financial data is treated as strictly confidential. We do not aggregate, anonymise, benchmark, or use your data to generate insights that are shared with or made available to any other customer or third party.
We share data only in these limited cases:
Infrastructure provider: Your data is hosted on Supabase (our Data Processor), on servers in India. Supabase processes data solely under our instructions and has no independent access to or use of your data.
Integrations you enable: If you activate a third-party integration (e.g., Tally), the data required for that integration is shared at your request. No integration is activated without your explicit action.
Legal obligations: When required by Indian law, court order, or a request from the Data Protection Board of India or tax authorities.
Business transfer: In a merger, acquisition, or sale, your data may transfer to the successor entity. You will be notified before any such transfer.
5. Where Your Data Is Stored
All data is stored on Supabase servers located in India. Your data does not leave India.
6. How We Secure Your Data
We implement reasonable security safeguards as required under Section 8(5) of the DPDP Act:
Encryption in transit — all communication over TLS/SSL.
Encryption at rest — data encrypted on our infrastructure provider's servers.
Row-level data isolation — each customer's data is isolated at the database level. One customer cannot access another's data.
Role-based access within the Service — you control what your team members can see. Operators can log production without viewing costs.
Internal access controls — fewer than 5 team members have access to customer data, all bound by confidentiality.
API security — secret keys stored in environment variables, never exposed to clients.
Automated backups — daily backups maintained by our infrastructure provider, stored in India.
Audit logging — authentication events and data access logged and retained for at least 12 months.
No system is 100% secure. We implement industry-standard protections but cannot guarantee absolute security.
7. Data Retention
While your subscription is active: We retain all your data and keep it accessible, backed up, and secure. This is our responsibility.
After cancellation or termination: Your data remains accessible for 90 days. During this window you can export your data or reactivate your account. After 90 days, data is permanently deleted from production systems. Backups containing your data are purged within 90 days of production deletion.
Legal retention: We may retain limited records beyond the above periods where required by applicable Indian law. Retention is limited to the minimum data and duration required by law.
On consent withdrawal: Personal data is erased within 30 days of your request, unless retention is required by law. We also cause our Data Processor to erase data made available to them, per Section 8(7) of the DPDP Act.
Your responsibility: You are responsible for maintaining your own copies of business records required for statutory compliance. We provide data export on request in standard formats (CSV) to support this.
8. Data Breach Notification
In the event of a personal data breach:
We will notify the Data Protection Board of India without delay.
We will notify affected Data Principals without delay, with details of the breach and recommended protective steps.
A detailed report will be submitted to the Board within 72 hours, covering the nature, cause, remedial actions, and notification status.
9. Your Rights
Under the DPDP Act, you have the right to:
Access a summary of your personal data and how it is processed.
Correct inaccurate or incomplete data, via account settings or by contacting us.
Erase your personal data by requesting account deletion.
Export your data in a machine-readable format (CSV).
Withdraw consent at any time.
File a grievance with our Grievance Officer, and escalate to the Data Protection Board of India if unresolved.
Contact support@trakto.tech to exercise any of these rights. We will respond within a reasonable timeframe as prescribed under the DPDP Rules.
10. Grievance Officer
Grievance Officer: Siddhant Rander Email: support@trakto.tech Acknowledgement: Within 48 hours Resolution: Within 30 days
If unresolved, you may escalate to the Data Protection Board of India.
11. Camera Access
The App uses your camera only for OCR scanning and image uploads — only when you initiate it. The App does not access your camera in the background. You can revoke permission in your device settings at any time.
12. Children
The Service is for business use. We do not knowingly collect data from anyone under 18. If we learn we have collected a child's data without verifiable parental consent (per Section 9, DPDP Act), we will delete it promptly.
13. Cookies
The Website uses essential cookies for login sessions only. No advertising or tracking cookies. The App does not use cookies.
14. Third-Party Services
Integrations with third-party services (e.g., Tally) are governed by their own privacy policies. We are not responsible for their data practices.
15. Changes to This Policy
We may update this policy. Material changes will be communicated via email or on the Website. If a change alters the purpose of processing, we will seek fresh consent. Continued use after updates constitutes acceptance.
16. Governing Law
This policy is governed by the laws of India, including the DPDP Act 2023, DPDP Rules 2025, and IT Act 2000. Disputes fall under the exclusive jurisdiction of courts in Bengaluru, Karnataka.
17. Contact
Trakto Technologies
Proprietor: Siddhant Rander Email: support@trakto.tech
Website: https://trakto.tech
WhatsApp: +91 91139 82979