Privacy Policy

1. Who we are

Nexotri (“we”, “us”) is a sole proprietorship based in Kolhapur, Maharashtra 416113, India, registered as an MSME under Udyam registration number UDYAM-MH-15-0316683. We build websites, mobile apps and custom software for businesses, and we run software products of our own: PG Connect, Layo, Zym and Case Alerts.

India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) calls the business that decides why and how personal data is used the Data Fiduciary. For the data described in this policy, that is us. The one exception is data we handle for clients inside software we build or host for them: there the client decides, and we act on its instructions. Section 9 explains how that works.

For anything in this policy, write to info@nexotri.com or call +91 84849 64515 (Monday to Saturday, 10:00 – 19:00 IST).

2. What this policy covers

This policy applies to:

• this website, nexotri.com;
• enquiries, support requests, early-access requests and demo requests you send us through this website, WhatsApp, email or phone;
• our dealings with clients — consultations, Proposals, projects, invoices and support;
• personal data we process on behalf of clients in software we build, host or maintain for them (section 9).

Our apps have their own policies

Each of our apps holds data this page does not describe — rooms and rent in PG Connect, shared lists in Layo, and so on. The app’s own privacy policy covers that data. Where an app’s policy and this page differ, the app’s policy prevails for data inside that app.

To delete an account in any of our apps, see Delete your account.

3. What we collect, and why

We collect only what we need to answer you and to do the work. We do not buy data from data brokers, and we collect nothing for advertising.

When you visit this website

Like any web server, ours keeps standard access logs — your IP address, the page you asked for, the time and your browser — in a daily rotation with 14 archived log files, to keep the site secure and to find faults. We do not use them to track you or build a profile, and they are deleted automatically.

When you send an enquiry or product request

For a product demo request, we also collect the product, approximate business or household size, preferred date and time, language and any questions you include. We use these details to arrange and prepare the walkthrough. The interactive product demo uses fictional data in the page and does not submit payment or tenant records.

Support and early-access forms also ask for the product, topic, approximate business size or courts to cover, and any existing enquiry or payment reference you choose to include. We use these details to respond to your request. The plan selector runs in your browser without sending your entries to us.

The form will not send until you tick the consent box. That consent covers us using these details to reply to your enquiry and to discuss your project. It does not cover marketing.

When you message us on WhatsApp

Your WhatsApp number, the name on your WhatsApp profile, the messages and any files you send, and when they were sent. Section 6 explains how WhatsApp messages reach us.

When you email or call us

Your email address or phone number, your name, and whatever you choose to tell us. If we speak on the phone, we may note what we discussed so we can follow up.

When you become a client

Contact details for the people we work with on your side; the Proposal, invoices and payment records; project messages and meeting notes; and the materials and access you give us for the project — content, brand assets, and logins for hosting, domain, app store or other accounts. We use access details only for your project and keep them only as long as the work needs them.

Payments made through Razorpay are entered on Razorpay’s own checkout. We receive a record that a payment was made — the amount, date and reference — but we never see or store your card details or UPI credentials.

When you use one of our apps

The app’s own privacy policy describes what it collects (see the table in section 2). Plans bought inside our apps are also paid through Razorpay, in the same way.

4. Cookies and tracking

This website sets no tracking or advertising cookies. It uses no advertising pixels or social media trackers, and loads its fonts from our own server.

We use Umami Cloud for cookie-free website analytics to understand which pages and product demos are useful, and how often visitors click demo or early-access links or successfully submit a request. Umami receives page paths, the referring website, browser language and screen size, and the names of these actions. Requests to Umami also expose connection information such as your IP address to its infrastructure.

We exclude query strings, URL fragments and page titles from analytics, and reduce referrers to the referring website’s origin. We do not send form entries, names, phone numbers, email addresses, payment or enquiry references, or sample tenant records to analytics. We do not enable session recordings or identify visitors using customer IDs. Analytics is disabled when your browser signals Do Not Track or Global Privacy Control; content blockers may also prevent it.

Analytics data is held by Umami Cloud for up to six months under its Hobby plan. Its analytics storage is in the US or EU, according to our account’s selected region, with other processing possible under its privacy policy.

The staff inbox — the private part of the site our team uses to answer enquiries and chats — uses one strictly necessary session cookie to keep staff signed in. Visitors to the public website never receive it.

5. How we use it

• To reply to your enquiry and talk through what you need.
• To prepare a Proposal and, if you go ahead, to deliver the work, invoice you and support you afterwards.
• To keep the website and our inbox free of spam and abuse.
• To meet our legal obligations, such as keeping tax and accounting records and answering lawful requests from authorities.

We process your data either with your consent — such as the consent box on the contact form — or for a use the DPDP Act allows without separate consent, such as when you have given us your details for a specific purpose (asking for a quote, say) or when the law requires us to keep a record.

We do not sell personal data, rent it, or share it for advertising. We do not send marketing messages on WhatsApp or by email unless you have agreed to receive them, and you can withdraw that agreement at any time.

6. WhatsApp

Our WhatsApp Business number, +91 84849 64515, runs on Meta’s WhatsApp Business Platform (the Cloud API), not on a phone. When you message it:

• Meta delivers your message to us, and processes it under Meta’s own terms and privacy policy;
• we store the conversation in our own inbox, on our servers, so that our team can read it and reply;
• you may receive an automatic acknowledgement straight away, and then a person replies — during working hours, Monday to Saturday, 10:00 – 19:00 IST;
• we do not add you to broadcast lists or send you marketing messages without your consent.

To stop hearing from us, say so in the chat or block the number. To have the conversation deleted from our inbox, ask us (section 12). Deleting it from our inbox does not delete the copy on your phone, or anything Meta keeps under its own policies.

7. Who we share it with

Only the service providers that help us run the business see personal data, and each sees only what it needs for its part:

We may also disclose personal data when the law requires it — for example, in answer to a valid request from a court, the police or a tax authority — or where it is needed to protect someone’s safety. We do not hand over data without a legal basis.

8. Where it is stored

Our website, enquiry inbox and databases run on servers we operate in Oracle Cloud’s Mumbai region, in India. All traffic to and from them uses HTTPS.

Some of our providers may process data outside India as part of their service — Meta for WhatsApp messages and Brevo for email, for example. The DPDP Act allows this, except to countries the Government of India restricts by notification, and we will follow any such restriction.

9. Client projects: when we act for a client

When we build, host or maintain software for a client — a website, an app, a CRM or a portal — that software often holds personal data about the client’s own customers, staff or members. For that data, the roles are different:

• The client is the Data Fiduciary under the DPDP Act. It decides why the data is collected and how it is used, and it is responsible for telling its users about it and getting any consent the law requires.
• Nexotri is a Data Processor. We process the data on the client’s behalf and nothing more.

As a Data Processor, we:

• process the data only on the client’s documented instructions, and only for the engagement;
• keep it confidential, and let only the people working on the project see it;
• protect it with the security measures described in section 11;
• use sub-processors — for example, the cloud hosting chosen for the project — only as agreed with the client;
• help the client answer requests from its users to access, correct or erase their data;
• tell the client promptly if we become aware of a breach affecting its data, so the client can meet its own duty to report it;
• return or delete the data at the end of the engagement, as the client chooses, unless the law requires us to keep it.

We never use a client’s data for our own purposes. A data processing agreement setting out these commitments is available on request — write to info@nexotri.com.

If you use a website or app we built for someone else

That business’s privacy policy applies to you, not this one. Please contact the business first: it decides what happens to your data. If you write to us instead, we will pass your request on to them.

10. How long we keep it

You can ask us to delete an enquiry or a chat earlier at any time. Records the law requires us to keep, such as invoices, we keep only for that purpose and delete when the period ends.

Routine database backups have a 14-day retention target, with daily cleanup and at least three recovery copies retained. If backup jobs fail, those minimum copies can be older. Restricted deployment-recovery snapshots expire after 30 days and are removed at the next daily cleanup. Deleted data may remain in these restricted recovery copies until rotation.

11. Security

• Every page and every connection to our servers uses HTTPS.
• Our databases are not exposed to the internet.
• Our servers can be reached only with an SSH key — never with a password.
• Access to personal data is limited to the people who need it for their work.

No system is perfectly secure. If a breach affects your personal data, we will inform you and the Data Protection Board of India as the DPDP Act requires, telling you what happened, what it means for you and what we are doing about it.

12. Your rights

You can make the requests below under this policy now. India’s DPDP Act and Rules have a phased commencement; statutory rights and complaint procedures apply as the relevant provisions take effect. Our commitments below do not depend on waiting for those provisions.

• Access — ask for a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
• Correct, complete or update — ask us to fix anything that is wrong or out of date, or to fill in what is missing.
• Erase — ask us to delete your data, unless the law requires us to keep it.
• Withdraw consent — at any time, and as easily as you gave it. This does not undo what we did before you withdrew it, but we will stop from then on.
• Grievance redressal — complain to our Grievance Officer (section 14) and receive an answer.
• Nominate — name another person to exercise these rights on your behalf if you die or become unable to.

How to ask

Write to info@nexotri.com from the email address we have for you, or message us on WhatsApp from the number we have for you, and say what you want. We may ask you to confirm who you are before we act, so that we never hand your data to someone else. We answer within 30 days, and it costs nothing.

For data inside one of our apps, you can also use the app itself or the contact details in the app’s policy. To delete an app account, see Delete your account.

If you are not satisfied after using our grievance process, you may use the remedies available under applicable law, including the Data Protection Board of India when the relevant provisions and complaint procedure are in force.

13. Children

Our website and services are for businesses and adults. We do not knowingly collect personal data from anyone under 18, and we do not ask for it. If you believe a child has sent us their details, write to us and we will delete them. Each app’s privacy policy explains how that app handles this.

14. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made under it, and with the DPDP Act, complaints about how we handle personal data may be sent to our Grievance Officer:

We acknowledge grievances within 24 hours and aim to resolve them within 15 days.

15. Changes to this policy

When we change this policy, we update this page and the date at the top. If a change materially affects how we use data you have already given us, we will tell you before it takes effect — by email or WhatsApp, if we have your details.

16. Contact

Nexotri, Kolhapur, Maharashtra 416113, India. Udyam registration UDYAM-MH-15-0316683.

• General and privacy questions: info@nexotri.com
• Payments and refunds: billing@nexotri.com
• Phone: +91 84849 64515, Monday to Saturday, 10:00 – 19:00 IST
• WhatsApp: +91 84849 64515

You can also reach us through our contact page.