Privacy policy.

OpsGrids Pvt Ltd ("OpsGrids", "we") is a company based at HSR Layout, Bengaluru, Karnataka, India. We run the website opsgrids.com and the business software at app.opsgrids.com: Finance (GST e-invoicing), HRMS, Support and IT service desk, Operations and Inventory, Storefront, CRM, Project management, PulseBoard and Marketing.

This policy covers two groups of people:

• Website visitors: anyone who reads opsgrids.com or contacts us from it.
• Customers and their users: organisations that hold an account on app.opsgrids.com, and the people those organisations add to it, such as their employees.

For data about website visitors and about account holders (who signs in, who pays, who we talk to), OpsGrids is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"): we decide why and how that data is processed.

For the data a customer puts into the products, such as employee records, attendance, invoices, tickets or their own customer lists, the customer decides the purpose and is the Data Fiduciary. OpsGrids processes that data only on the customer's instructions and to provide the product. If you are an employee or a contact of one of our customers, ask that organisation first about its use of your data; we will help it answer.

Most duties under the DPDP Act and the Digital Personal Data Protection Rules, 2025 take effect in stages up to May 2027. Until then, section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 also apply. We already honour the rights described below.

From website visitors. opsgrids.com has no forms. We collect:

• Usage data through Google Analytics 4, only if you click Accept on the cookie banner: pages viewed, approximate location derived from your IP address, device and browser type, referring site, and an identifier stored in a cookie.
• Technical request data that our host, Vercel, records when your browser loads a page, such as IP address, time of request and user agent.
• Whatever you send us when you choose to contact us: your email address and message if you write to zionna@opsgrids.com, your phone number if you call +91 90195 27568 or +91 89492 63849, and your WhatsApp number, name and message if you write to us on WhatsApp at +91 90195 27568.

From account holders. When an organisation signs up at app.opsgrids.com/signup or uses the products, we collect the details of the people who sign in, such as name, work email, phone number, organisation name and role, their sign-in and activity records, and the communication history of the account. If an organisation pays us, we also keep the billing name, address, GSTIN and payment records needed for a tax invoice. Card and UPI details are entered with the payment provider, not stored by us.

Data customers put into the products. This depends on which products a customer uses and what it enters, and can include employee records and attendance data, location data captured by geo-fenced check-in in HRMS, invoice and GST details, support tickets, customer and supplier contacts, orders, project tasks, timesheets and marketing contact lists. The customer or its users provide this data, not OpsGrids.

Some of this may be sensitive personal data or information under the IT Rules, 2011, such as passwords and financial information like the bank account details customers enter for payments and invoicing. We process it only to provide the product and disclose it only as described in this policy or as the law requires.

• Analytics on the website, to understand which pages are read and fix what does not work: on the basis of your consent, given through the cookie banner. You can withdraw it at any time.
• Replying to you when you email, call or message us: because you gave us your details for that purpose, a legitimate use under section 7(a) of the DPDP Act.
• Creating and running your account, signing you in, providing support and sending service messages about the account: because you or your organisation asked us to provide the products, which is a use you have consented to, and the legitimate uses permitted by section 7 of the DPDP Act where they apply.
• Keeping the website and products secure, preventing abuse, and meeting our obligations under Indian law, including tax and accounting records: as required or permitted by law.
• Processing data customers put into the products: only to provide the product to that customer, on its instructions.

We do not sell personal data, and we do not use it for advertising. We do not use data customers put into the products for our own purposes.

opsgrids.com loads Google Analytics only after you click Accept on the cookie banner. Google Analytics then sets first-party cookies named _ga and _ga_<id>. Your choice is stored in your browser's local storage under the key og-consent, not in a cookie. You can change it at any time through the "Cookie settings" link in the footer. There are no other cookies, no advertising or retargeting pixels and no social media embeds on the site.

The full list is on our cookie policy.

We share personal data only with service providers that process it for us:

• Vercel Inc., which hosts opsgrids.com and receives the technical request data described above.
• Google LLC, which provides Google Analytics and receives usage data only after you consent.
• Amazon Web Services, which hosts app.opsgrids.com and stores account data and data customers put into the products.
• Google LLC, which provides Google Workspace, the email service for opsgrids.com addresses.
• The email and WhatsApp delivery services that send the notifications customers set up in the products.
• A payment provider, if an organisation pays us online, which processes the payment details directly.

If you contact us on WhatsApp, WhatsApp (Meta) processes your messages under its own terms and privacy policy, which you accepted when you joined WhatsApp.

We may also disclose personal data when Indian law requires it, for example to a court, a regulator or a law enforcement agency acting under lawful authority.

The products store data in AWS us-east-1 (N. Virginia, USA), which is outside India. Vercel and Google may also process website data in the United States and other countries. The DPDP Act allows transfer outside India except to countries the Central Government restricts by notification. We will review where data is stored if the United States, or any country our providers use, is restricted.

• Google Analytics data: up to 14 months. The _ga cookies expire in your browser after up to two years unless you clear them or withdraw consent.
• Emails, call notes and WhatsApp messages from people who do not become customers: up to 24 months after the last contact.
• Account data: for as long as the account is active, then deleted within 90 days of closure, except where Indian law requires a longer period, such as for tax and accounting records.
• Data customers put into the products: available to export for 30 days after the account closes, then deleted within 90 days of closure. Copies in backups are deleted as those backups expire.

When the purpose is served and no law requires us to keep the data, we delete it. Indian law requires us to keep some logs of access and activity for a minimum period, currently 180 days under the CERT-In Directions, 2022, and up to one year once the DPDP Rules on retention are in force.

We take reasonable security measures to protect personal data from loss, misuse and unauthorised access, as required by the IT Rules, 2011 and, as its rules come into force, the DPDP Act. These include encrypted connections (HTTPS) to the website and the products, each customer's data kept separate from every other customer's, permissions checked on the server for every request, and an audit log of changes. No system is completely secure. If a personal data breach occurs, we will report it to CERT-In as Indian law requires and, once the DPDP Act's breach rules are in force, inform the Data Protection Board of India and the affected people within the time those rules set.

Under the DPDP Act, as a Data Principal you have the right to:

• get a summary of the personal data we process about you, the processing we do, and who we have shared it with;
• have inaccurate or incomplete data corrected and updated;
• have your data erased once it is no longer needed for the purpose it was collected for, unless the law requires us to keep it;
• withdraw consent at any time, as easily as you gave it; for website analytics, use the "Cookie settings" link in the footer;
• have a grievance addressed by us;
• nominate another person to exercise these rights if you die or become unable to.

To exercise any of these, email zionna@opsgrids.com from the address we hold for you, or call us. We may ask you to confirm your identity before acting. If your data is in a customer's account, such as your employer's HRMS, we will pass your request to that customer, which decides on it.

If you are not satisfied with our response to a grievance, you can complain to the Data Protection Board of India once that route is in force, through the Board's online complaint portal. You need to raise the matter with us first.

opsgrids.com and the products are meant for businesses and are not directed at anyone under 18. We do not knowingly collect personal data of children. If a customer needs to enter a child's data into the products, the customer is responsible for obtaining verifiable consent from a parent or lawful guardian, as the DPDP Act requires once its rules on children are in force. If you believe we hold a child's data as Data Fiduciary, write to us and we will delete it. If it is in a customer's account, we will pass your request to that customer.

When we change this policy, we will publish the new version here and update the date at the top. If a change affects how we use data we already hold, we will email account owners at least 30 days before it takes effect and, where the law requires, ask for consent again.