Privacy Policy

1. Who is responsible and how to contact us

The service operator and privacy contact is Ramachandiran, operating SyncCommit ERP. Email: mramachandiran9@gmail.com. Telephone: +91 96299 39175. Address: 608, 2nd floor, 1st block, Mogappair West, Chennai, Tamil Nadu 600037, India.

For account, subscription and support information, we determine how that information is used. For employee, customer, supplier and other records an organization places in its ERP workspace, that organization determines the business purposes. Contact your workspace administrator first about those records; we can help route a verified request. Organizations needing a data-processing agreement or international deployment should contact us before uploading production personal data.

2. Information we collect

Account information includes your name, email address, password hash, workspace membership, role assignments, trial and subscription dates, verification status and sign-in activity. Passwords are hashed; they are not stored as readable passwords.

Workspace information consists of records, documents and other content you or your organization choose to upload. Depending on your use, this can include employee, customer, supplier, payroll and business contact information. Do not upload information you lack authority to use.

Payment records include order/payment/refund identifiers, amounts, currency, method, status, subscription period and receipts. Where supplied by the payment provider, we may store a card network and last four digits, bank name and a payment/refund reference. Support requests can include your explanation and an optional bank transaction reference.

Technical and security information includes IP-based rate-limit information, session identifiers, timestamps, application/audit events and relevant service logs. Cloudflare, AWS and the payment provider also process technical information necessary to provide their services.

3. Why we use information

We use information to create and secure accounts; enforce workspace permissions; provide requested ERP features; calculate access periods; reconcile payments and refunds; answer support requests; prevent fraud and abuse; keep audit records; and comply with applicable obligations.

Where a law requires a processing basis, purposes may rely on performing the service contract, complying with legal duties, legitimate operational/security interests where permitted, or consent for an optional activity where required. We do not use agreement to the service terms as blanket consent to unrelated processing.

4. Payment security

Razorpay hosts the payment authorization flow. Enter card details, CVV, banking credentials, OTPs and UPI PINs only in the bank/payment-provider flow. The ERP does not request or store full card numbers, CVVs, bank passwords, OTPs or UPI PINs. Do not include these in support messages.

A bank debit, payment capture, refund processing and settlement are separate stages. We reconcile provider records to avoid describing an unverified payment or refund as completed. Razorpay and the payer bank handle payment-network processing under their own applicable notices.

5. Who receives information

Authorized users of your organization can access workspace content according to their permissions. Authorized service personnel can access information when needed for support, security, maintenance or legal obligations.

Our service uses AWS for hosting/storage, Cloudflare for website delivery and security, and Razorpay for payments/refunds. An email delivery provider or AI provider is used only where that feature has been configured and requested. We do not sell personal information or send marketing campaigns through the current application.

The optional assistant sends the prompt you submit to its configured AI provider. Do not include secrets or sensitive information in prompts. The assistant does not automatically transmit your entire database. An unavailable integration is identified as unavailable rather than a delivered service.

We may disclose information when required by valid legal process, to protect legal rights or safety, or in a lawful business transfer with appropriate notice where required.

6. Storage and international processing

The current application server and primary database are hosted in AWS Mumbai, India. Service providers such as Cloudflare and optional integrations may process information in other locations. Global processing is subject to the applicable provider arrangements and law.

Organizations with data-localization, cross-border transfer, sensitive-data or regulated-sector requirements must confirm suitable contractual and technical arrangements with us before use. This notice does not represent that every jurisdiction or regulated deployment has already been approved.

7. Retention and deletion

We retain active account and workspace information to provide the service. Expiry or cancellation of Premium does not automatically delete workspace records. Ask your administrator about organization retention decisions or contact us to request closure, export or deletion.

Payment, refund, tax/accounting, security and dispute records may be kept for the periods necessary for the relevant obligation or claim. Retention depends on record type, purpose, legal requirements and dispute status. Access is limited to the relevant purpose.

Deleted information can remain in protected backup copies until those copies are replaced or retired. Backups are not used for ordinary access after deletion; if a backup is restored, relevant deletion requests must be reapplied. We do not promise instant erasure from every backup.

8. Your requests and choices

Contact mramachandiran9@gmail.com with the subject “Privacy request” to request information/access, correction, export, account closure or deletion; raise an objection or restriction request; withdraw an optional consent; or make a privacy complaint. Rights and exceptions depend on applicable law and your relationship to the workspace.

We may verify identity and your authority over organization data before acting. Do not email identity documents unless we explain why they are needed and provide an appropriate submission method. We aim to acknowledge requests within two business days and respond within the applicable legal period; we will explain any permitted extension or restriction. You may complain to the competent supervisory authority where applicable. Withdrawing optional consent does not undo processing already lawfully performed.

9. Cookies and local browser functions

The current application uses an essential session cookie to keep you signed in. It is HttpOnly and Secure on the production HTTPS site. Blocking it prevents authenticated use. We do not currently operate advertising cookies or a nonessential analytics-cookie program in the ERP.

The embedded payment provider may use its own cookies or storage for security and checkout. An essential-session notice is not consent to unrelated tracking. If optional tracking is introduced, we will provide the notice and choices required before using it.

10. Security, children and changes

We use measures including HTTPS, hashed passwords, access controls, private document access, audit records and encrypted backups. No internet service can guarantee absolute security. Report suspected exposure to the privacy contact promptly.

The service is intended for adult business users. Do not create an account if you are under 18. Organizations should not upload children’s personal information without the required authority, safeguards and prior agreement for the use case.

Material changes will be identified through an updated notice and appropriate communication where required. The effective date identifies this version. Mandatory rights under applicable law are preserved.