Privacy Policy
What personal data Orvexa collects, why, who we share it with, how long we keep it, and how to use your rights under India's DPDP Act and the GDPR.
Plain-English summary (not part of the policy). We collect the details you give us to set up and bill your store, and basic technical data when you visit our site. We do not sell personal data. Analytics and marketing tools only run if you agree. You can ask us to show, correct or delete your data at any time, and you can complain to our Grievance Officer.
This policy explains how OrvexaTech Private Limited, SF.No.727/1A1, Vedhakara Street, Tiruvannamalai - 606705, Tamil Nadu, India ("Orvexa", "we", "us") handles personal data when you visit our website, join early access, sign up for Orvexa Cloud or contact us. It is written to meet India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, and also describes the rights people have under the EU and UK GDPR where they apply.
1. Two roles
- Our own data. For information about visitors, people on our waiting list, and businesses that hold an Orvexa account, we decide why and how it is used. We are the data fiduciary (the "controller" under the GDPR). This policy mainly covers that.
- Your shoppers' data. When a business uses Orvexa Cloud to run a store, the personal data of that store's shoppers belongs to the business. We process it only on the business's instructions, as its processor. If you are a shopper, please read the store's own privacy notice, and contact the store first about your data.
2. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Sign-up and waiting-list details | Brand name, store address you want, your name, email, mobile number, country, plan, what you sell, the platform and domain you are moving from | You, in our sign-up form |
| Consent and agreement records | That you accepted our Terms, which version, when; your marketing choice; your cookie choices; the IP address and browser type you used | Our systems, when you tick the boxes |
| Billing details | Subscription reference, plan, amount, payment status, GST details you give us | You and our payment provider, Razorpay. We do not receive your full card number or UPI credentials |
| Messages to us | Anything you send by WhatsApp, phone, email or our contact page | You |
| Visit data | IP address, device and browser type, pages visited, the page that sent you to us, campaign tags in links such as utm_source | Our servers and, only if you agree, analytics tools |
| Account and usage data | Login details, store settings, activity logs and security events | Your use of Orvexa Cloud |
We do not ask for sensitive information such as health or religion, and we ask you not to send it to us.
3. Why we use it, and our legal basis
| Purpose | Basis |
|---|---|
| Set up your store, run the service, and take payment | To perform our contract with you; under the DPDP Act, your consent or a use the Act permits for providing a service you asked for |
| Reply to you and give support | Contract, or your request |
| Keep the service secure, prevent fraud and misuse, and fix problems | Our legitimate interests; permitted uses under the DPDP Act |
| Keep tax, accounting and legal records | Legal obligation |
| Send news, offers and tips by email or WhatsApp | Your consent, which you can withdraw at any time |
| Understand how the site is used, and improve it | Your consent. We load analytics only after you agree |
| Prove that you agreed to our Terms and consents | Legal claims and our legitimate interests |
4. Cookies and similar technologies
Today our site keeps only a small amount of information in your browser, described in our cookie policy. Analytics and marketing tools are blocked until you agree, and you can change your mind at any time in Cookie settings, at the bottom of every page. We treat a Global Privacy Control signal from your browser as a refusal of optional tools.
5. Who we share it with
We do not sell personal data. We share it only with:
- Service providers who help us run Orvexa Cloud and are bound by contract: Razorpay for payments, cloud hosting and infrastructure providers, email and messaging providers, and customer-support tools.
- Analytics providers, such as Google Analytics, only if you accepted analytics.
- Advisers, such as lawyers, accountants and auditors, under a duty of confidence.
- Authorities and courts where the law requires it or to protect rights, safety and the security of our service.
- A buyer or successor if our business is sold or reorganised, who must keep to this policy.
6. Sending data outside India
Some of our providers may handle data in other countries. Where we send personal data outside India we do so as the law allows, and we use written terms that require the receiving company to protect it. Orvexa Cloud may also be used by businesses and shoppers in other countries, so data about them is processed in India.
7. How long we keep it
We keep personal data only as long as we need it for the purpose it was collected for.
| Data | Kept for |
|---|---|
| Waiting-list details (early access) | Until your country opens and you decide, or 24 months, or until you ask us to delete them |
| Account and store data | While your account is active, then the export period in our Terms, then deleted or made anonymous |
| Tax, billing and accounting records | For the period the law requires (generally several years) |
| Consent and agreement records | For as long as the agreement applies, plus the period in which a claim could be made |
| Server and security logs | About 90 days, unless needed to investigate an incident |
| Backups | Until they expire in the normal backup cycle |
8. Keeping it safe
We protect personal data with technical and organisational measures, including encrypted connections (HTTPS), access limited to staff who need it, a separate database for each store, and monitoring for misuse. We train the people who handle data and we have a process to respond to incidents. No online service is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.
9. Your rights
You can ask us to:
- show you the personal data we hold about you and how we use it;
- correct data that is wrong or out of date;
- erase your data, where we no longer need it or you withdraw consent;
- stop using it for marketing, or withdraw a consent you gave (this does not affect what we did before);
- nominate another person to exercise your rights if you die or cannot act, as the DPDP Act allows.
If the GDPR applies to you, you also have the rights to restrict or object to processing, to receive your data in a portable format, and to complain to your data protection authority. To use any right, write to our Grievance Officer (section 11) or to support@orvexacloud.in. We may need to confirm who you are first. We aim to answer within 30 days.
10. Children
Orvexa Cloud is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, write to us and we will delete it.
11. Grievance Officer
If you have a concern about how we handle your personal data, please contact:
- Name: orvexadmin
- Email: support@orvexacloud.in
- Address: SF.No.727/1A1, Vedhakara Street, Tiruvannamalai - 606705, Tamil Nadu, India
We will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India or, where the GDPR applies, to your local supervisory authority.
12. Changes to this policy
We may update this policy. We will change the date and version at the top, and for important changes we will tell you by email or on our site. Please check it from time to time.
13. Contact
- Privacy and data requests: support@orvexacloud.in
- General questions: support@orvexatech.in
- WhatsApp and phone: +91 95665 42389