This Privacy Policy explains how Purposix Private Limited ("Purposix", "we") collects, uses, discloses, and protects your information when you use our products and websites, including VitaranLink, BillMitra POS, and InstituteDesk (collectively, the "Services"). This policy is published in accordance with the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 (India), and is designed to also support GDPR-style obligations where applicable.
1. Information We Collect
- Account data: name, email, phone, organisation, role, password (hashed).
- Business data: records you create within the Services — customers, orders, invoices, students, inventory, etc.
- Payment data: billing name, address, GSTIN, last 4 digits of card and payment method reference. Full card numbers, CVV, UPI PIN, and net-banking credentials are entered directly into our payment partners (Stripe, Razorpay, Cashfree) and are never stored on Purposix servers.
- Technical data: IP address, device, browser, OS, timezone, locale, cookies, in-app events.
- Communications: support requests, demo bookings, feedback.
2. How We Use Information
- To provide, operate, and maintain the Services.
- To process subscription payments and prevent fraud.
- To send transactional notifications (invoices, renewals, security alerts).
- To provide customer support.
- To improve features, debug, and conduct internal analytics.
- To comply with legal obligations (tax, accounting, regulatory).
3. Payment Partners
We share the minimum payment information required to process transactions with our payment partners. Each partner is independently certified to applicable security standards (e.g. PCI-DSS Level 1) and acts as a data controller for the payment data it collects directly from you.
- Razorpay: see razorpay.com/privacy.
- Cashfree: see cashfree.com/privacy-policy.
- Stripe: see stripe.com/privacy.
4. Other Sharing
- Service providers: cloud hosting, email/SMS/WhatsApp delivery, analytics, customer support tooling — all bound by confidentiality.
- Legal: when required by law, court order, or to protect rights, safety, or property.
- Business transfers: in connection with a merger, acquisition, or sale of assets, with notice to you.
We do not sell personal information to advertisers.
5. Data Retention
We retain account and business data for the duration of your subscription plus a reasonable archival period required by law (typically 7 years for tax and accounting records in India). You may request deletion at any time, subject to legal retention obligations.
6. Security
We use TLS in transit, encryption at rest, role-based access control, audit logging, and per-tenant data isolation. No system is 100% secure; you are responsible for keeping credentials confidential.
7. Your Rights
- Access, correct, or delete your personal data.
- Export your data in a portable format.
- Withdraw consent for non-essential processing.
- Lodge a complaint with the Data Protection Board of India or your local supervisory authority.
To exercise these rights, contact support@purposix.com. We respond within 30 days.
8. Cookies
We use essential cookies to keep you signed in and analytics cookies to understand product usage. You can disable non-essential cookies in your browser without losing core functionality.
9. Children
The Services are not directed at children under 18. We do not knowingly collect data from minors.
10. International Transfers
Data is primarily processed in India. Where partners process data outside India (e.g. Stripe), they are bound by contractual safeguards equivalent to applicable data protection laws.
11. Changes
We may update this policy. Material changes will be notified in-product or by email.
12. Grievance Officer
As required by Indian law, our grievance officer can be reached at grievance@purposix.com, Purposix Private Limited, Kolhapur, Maharashtra, India.