Privacy Policy

1. Introduction

This Privacy Policy explains how Dot Labs Web Solutions Private Limited ("Upaj", "we", "us", or "our") collects, uses, stores, and protects information when you visit our website at upaj.com or use the Upaj platform.

This policy applies to:

• Website visitors — anyone browsing upaj.com, including public pages, pricing, and contact forms.
• Product users — registered users who access the Upaj platform to manage rental portfolios, billing, compliance, and related workflows.

By using our website or platform, you agree to the collection and use of information as described in this policy.

2. Information We Collect

2.1 Information you provide

Category	Data collected	When
Contact form data	Name, email, phone, company name, message	When you submit a contact or demo request form
Account data	Name, email, phone, role, password (hashed)	When you create an account or are invited
Business data	Portfolio, property, tenant, lease, billing party, invoice, payment, rent cycle, and maintenance records	When you use the platform
Compliance data	TDS-related records, GST-ready summaries, compliance task details	When you use billing and compliance features
Documents	Files you upload (invoices, receipts, supporting records)	When you attach files to records
Communication data	Messages, support tickets, email correspondence	When you contact us or use in-app messaging

2.2 Information collected automatically

Category	Data collected	Purpose
Technical data	IP address, browser type, device type, operating system	Security, debugging, service improvement
Usage data	Pages visited, features used, timestamps, session duration	Product improvement, analytics
Log data	Server logs, error reports, API request metadata	Monitoring, debugging, security
Cookie data	Session identifiers, preference settings, analytics identifiers	See Section 4 below

2.3 Information we do not collect

We do not collect Aadhaar numbers, PAN card numbers, bank account details, or payment card information directly. Payment processing is handled by our third-party payment processor (Razorpay), which has its own privacy policy and PCI-DSS compliance.

3. How We Use Information

We use the information we collect for the following purposes:

• Providing the service — Operating the platform, processing your business data, generating invoices, tracking payments, and producing reports.
• Account management — Creating and managing your account, authenticating sessions, and enabling role-based access.
• Communication — Responding to your inquiries, sending transactional emails (invoices, payment reminders, account notifications), and providing customer support.
• Compliance support — Producing GST-ready summaries and TDS tracking records to help you with your compliance workflows. Upaj does not provide tax advice or file returns on your behalf.
• Security — Detecting and preventing fraud, unauthorized access, and other security incidents.
• Improvement — Analyzing usage patterns to improve the platform, fix bugs, and develop new features.
• Legal compliance — Fulfilling legal obligations and responding to lawful requests from authorities.

We do not use your business data (property records, invoices, tenant details) for advertising, profiling, or any purpose other than providing and improving the Upaj service.

4. Cookies and Tracking Technologies

4.1 What cookies we use

Cookie type	Purpose	Required?
Essential cookies	Authentication, session management, security	Yes — required for the platform to work
Analytics cookies	Understanding how visitors use the website and platform	No — can be disabled

4.2 How to disable cookies

You can disable non-essential cookies through your browser settings. Most browsers allow you to:

• Block all cookies or only third-party cookies
• Clear existing cookies
• Get notified when a cookie is set

Disabling essential cookies may prevent you from logging in or using the platform. Disabling analytics cookies will not affect your ability to use Upaj.

5. Legal Basis for Processing

We process your information on the following legal grounds:

• Contract performance — Processing your business data is necessary to provide the service you signed up for.
• Legitimate interest — Improving the platform, ensuring security, and communicating with you about your account.
• Consent — Where you explicitly opt in, such as subscribing to marketing communications or submitting a contact form.
• Legal obligation — Where we are required by law to retain or disclose information.

For users in the European Union, this processing is compatible with GDPR requirements. For users in India, this processing is aligned with the Digital Personal Data Protection Act, 2023 (DPDP Act) to the extent applicable.

6. Sharing with Service Providers

We share information with third-party service providers only as necessary to operate the platform. These providers are contractually obligated to protect your data and use it only for the purposes we specify.

Provider	Purpose	Data shared
Supabase	Database hosting and authentication	Account data, business data, session tokens
Vercel	Website and application hosting	Technical data, request logs
Razorpay	Subscription payment processing	Billing name, email, subscription details
Resend	Transactional email delivery	Email address, email content
Sentry	Error monitoring and debugging	Technical data, anonymized error reports

We do not sell, rent, or trade your personal information or business data to any third party for their own purposes.

7. International Data Transfers

Our service providers may process data in locations outside India, including the United States and the European Union. Where data is transferred internationally, we ensure appropriate safeguards are in place, including the provider's compliance with applicable data protection frameworks.

Your business data is stored in Supabase-managed infrastructure. You can contact us to confirm the current storage region.

8. Data Retention

Data type	Retention period
Active account data	As long as your account is active
Business records (invoices, payments, leases)	As long as your account is active, plus 30 days after account deletion to allow recovery
Contact form submissions	Up to 24 months, or until the inquiry is resolved
Server logs	Up to 90 days
Audit trail records	As long as your account is active (required for compliance integrity)

After account deletion, we permanently remove your data within 30 days, except where retention is required by law (e.g., tax records under Indian law may need to be retained for up to 8 years).

9. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit — All data transmitted between your device and our servers is encrypted using TLS (HTTPS).
• Encryption at rest — Database storage is encrypted at rest.
• Authentication — Passwords are hashed. Sessions use secure JWT tokens.
• Access control — Role-based access ensures users only see data relevant to their role. Account-level data isolation prevents cross-account access.
• Audit trail — All significant actions are logged with timestamps and user attribution.
• Immutable records — Finalized invoices cannot be edited, preserving data integrity for compliance.

No system is perfectly secure. If you become aware of any security vulnerability or unauthorized access to your account, please contact us immediately at support@upaj.com.

10. Your Rights

Depending on your location, you have the following rights regarding your personal data:

For all users

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate or incomplete data.
• Deletion — Request deletion of your account and associated data.
• Export — Export your data in a standard format before deletion.
• Withdraw consent — Where processing is based on consent, you can withdraw it at any time.

Additional rights under India's DPDP Act

• Right to grievance redressal through our designated grievance officer.
• Right to nominate another person to exercise your rights on your behalf.

Additional rights under GDPR (EU/EEA users)

• Right to restrict processing.
• Right to data portability.
• Right to object to processing based on legitimate interest.
• Right to lodge a complaint with your local data protection authority.

Additional rights under CCPA (California users)

• Right to know what personal information is collected and how it is used.
• Right to request deletion of personal information.
• Right to non-discrimination for exercising privacy rights.
• We do not sell personal information as defined by the CCPA.

11. How to Request Access, Correction, or Deletion

You can exercise your data rights by:

• Self-service — Update your profile, export data, or delete records within the Upaj platform (Settings > Profile and Settings > Account).
• Email — Send a request to support@upaj.com with the subject line "Data Request" and include your registered email address.

We will respond to your request within 30 days. We may ask you to verify your identity before processing the request. If we cannot fulfill your request (e.g., due to legal retention requirements), we will explain why.

Account deletion: When you request account deletion, we will permanently remove your account data within 30 days. Business records (invoices, payments) may be retained for the legally required period. We will notify you of any data retained and the reason.

12. Data Deletion Requests

To request complete deletion of your data:

1. Export any data you need from the platform (Reports > Export).
2. Email support@upaj.com with subject "Account Deletion Request".
3. We will confirm receipt within 3 business days.
4. Your data will be permanently deleted within 30 days of confirmation.
5. You will receive a final confirmation email once deletion is complete.

Deletion is irreversible. Once completed, we cannot recover your data.

13. Third-Party Links

Our website and platform may contain links to third-party websites or services (e.g., Razorpay for payments, App Store for mobile downloads). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing your information.

14. Children's Privacy

Upaj is a business tool designed for property owners, managers, and finance professionals. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us and we will promptly delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will:

• Update the "Effective Date" at the top of this page.
• Notify registered users by email for material changes.
• Post a notice on the platform for 30 days.

Continued use of Upaj after the effective date of a revised policy constitutes acceptance of the updated terms.

16. Contact Information

If you have questions about this Privacy Policy or want to exercise your data rights, contact us:

• Email: support@upaj.com
• Company: Dot Labs Web Solutions Private Limited
• Address: Hyderabad, Telangana, India
• Website: upaj.com