Privacy Policy

The short version

We collect what we need to sell you a service, provision it, bill you and support it — and nothing beyond that. We do not sell your data to anyone, ever. We do not run advertising trackers. The organisations that do see parts of your data are named further down, because “trusted third parties” is not an answer.

What we collect

Because you gave it to us

• Your name and email address, when you create an account.
• Your business name, phone number and billing address, when you give them for an invoice.
• The configuration of what you buy — hostname, operating system, domain name, mailbox names.
• Anything you write to us in support: WhatsApp messages, emails, attachments.

Because the service produces it

• Which services are on your account, their status, IP addresses, and when they renew.
• Your order and payment history, and the invoices raised.
• Ordinary server logs: IP address, browser, pages requested, times. These are a by-product of running a website, and we use them for security and debugging.

What we never hold

Your card details.Card numbers, CVV and PINs are entered on PayU’s systems and never reach ours. We receive only a payment reference, the amount, and whether it succeeded. We could not leak your card if we tried, because we do not have it.

We also do not read the contents of your mailboxes, files or servers. We can see that a service exists and whether it is running. We cannot see what is inside it, and we will not go looking without your explicit request — for example when you ask us to debug something.

Why we are allowed to hold it

Under the Digital Personal Data Protection Act, 2023, we process your personal data on two grounds. Most of it is because you asked us to provide a service and we cannot do that without it. The rest — the transaction records — is because Indian tax law requires us to keep them whether either of us wants to or not.

Who else sees it

These are the only organisations that receive any part of your personal data, and only the part each one needs:

• Our infrastructure partners — the datacentre operators whose hardware runs the servers, storage and mailboxes we sell. They receive the technical configuration needed to build and run your service. If you need them named for a compliance review, ask us and we will tell you.
• PayU — payments. Receives your card details directly from you, plus the amount and order reference. We receive only the reference and whether it succeeded.
• Supabase — the database holding your account, orders and services. Our instance is hosted in Mumbai.
• Vercel — hosts this website and serves its pages.

We do not sell, rent or trade personal data. We share it outside this list only where the law compels us — a court order, a tax authority, a lawful police request — and we will tell you when that happens unless we are legally barred from doing so.

Where it lives

Your account and billing data is stored in Mumbai, India. The services you buy may run in other countries, because you chose them there — we sell servers in Singapore, France and elsewhere, and a server in France keeps its data in France. Which region a service runs in is shown before you buy it.

How long we keep it

• While you are a customer — for as long as your account is open.
• After you close your account — 30 days, so an accidental deletion can be undone. After that, deleted.
• Invoices and payment records — 8 years. This is not our choice; Indian tax law requires it, and a deletion request cannot override it.
• Server logs — 90 days.

What you can ask us to do

Email nilanjan@vyomananta.com and we will act within 30 days. You can ask us to:

• Send you a copy of everything we hold about you.
• Correct anything that is wrong.
• Delete your data — except the records tax law makes us keep, which we will name specifically rather than using them as a blanket excuse.
• Stop sending you anything that is not about a service you own.
• Withdraw a consent you previously gave.

If we get it wrong, you may complain to the Data Protection Board of India. We would rather you told us first, and we will say so plainly if we think you are right.

Cookies

We set one kind of cookie: the one that keeps you signed in. It is strictly necessary, it is not shared, and there is no advertising or analytics tracker on this site. That is why you have not been asked to accept anything.

Security, honestly stated

Traffic is encrypted in transit. Passwords are hashed, never stored in a readable form. Access to the database is restricted so that one customer cannot read another’s records, and that restriction is enforced by the database itself rather than by our code remembering to check.

No system is perfectly secure, and we are a small business rather than a bank. If we ever suffer a breach affecting your data, we will tell you and the Data Protection Board — quickly, and with what we actually know rather than a reassuring summary.

Children

These services are sold to businesses and adults. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, tell us and we will delete it.

Changes

If we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top always reflects the current version.