This Privacy Policy explains how Tatvarth Systems LLP ("Tatvarth Systems", "we", "us") handles personal data through Sampreshan, our website inquiry management software. It follows India's Digital Personal Data Protection Act, 2023 (DPDP Act). It covers Sampreshan only. Our website is covered by the company Privacy Policy.
Who we are and who controls what
Tatvarth Systems LLP builds and operates Sampreshan. The business that owns a connected website decides what its inquiry form asks for and why. For the inquiries people send through that form, the business is the Data Fiduciary under the DPDP Act, and we process them only on its instructions as its Data Processor. For the sign-in details of the people who use a website's dashboard, Tatvarth Systems is the Data Fiduciary.
Our commitments as a processor are set out in the order form or data processing terms agreed with the business. If they conflict with this policy on how inquiries are handled, those agreed terms prevail.
What we collect
Through Sampreshan we hold:
- Inquiry data: what a visitor enters in the form on a connected website, which is their first and last name, email address and message, and, where the form asks for them, a phone number, company and subject. We also hold the time it was sent.
- Work done on inquiries:the status, internal notes and tags added by the business's team, and the replies sent from the dashboard, including the recipient, subject and text.
- Sign-in data:the email address used to sign in to a website's dashboard, a salted and hashed password (never the password itself), and the session records that keep a person signed in.
- Technical data: the IP address of a request, used for bot checks and rate limiting, and the result of the bot check. We do not store IP addresses with inquiries.
Why we use it
We use this data only to provide, secure and support Sampreshan for the business: to receive and store inquiries, show them in the dashboard, send notifications and replies, produce analytics and exports, keep the sign-in secure, and block spam and abuse. We do not use inquiries for any purpose the business has not asked for, we do not use them for advertising, and we do not sell any of it.
Who we share it with
We share data only with the sub-processors needed to run Sampreshan, and where the law requires it:
- Cloudflare for hosting, the database, queues, storage and Turnstile, the bot check on the inquiry form;
- Resend for sending notification and reply emails.
Both act only on our instructions. We will tell the business by email before adding or replacing a sub-processor that handles inquiries, so it can raise an objection. Sampreshan uses no advertising trackers or third-party analytics.
Cross-border transfer
Sampreshan runs on Cloudflare's global network and sends email through Resend, so data may be processed outside India. The DPDP Act permits this unless the Government of India restricts transfer to a specific country. We follow any restriction that applies.
How long we keep it
Inquiries and the work done on them are kept while the business is using Sampreshan, until the business deletes them. Deleting an inquiry from the dashboard first moves it to trash, where it stays until the business restores it or deletes it permanently. Sampreshan does not delete inquiries automatically.
Sign-in data is kept while the sign-in is active and removed on request once it is no longer needed. Password reset links expire after an hour and work once. After the business stops using Sampreshan and the 30-day export window in the Terms has passed, we delete its data from our live systems within 90 days, and from backups as they roll off, except for anything the law requires us to retain.
Security
Each website's inquiries are kept separate, and a signed-in user can only see the inquiries for their own website. Passwords are stored only as salted hashes. Sign-in attempts and password reset requests are rate limited, submissions pass a bot check, and a form only accepts submissions from the website it was set up for. Data is encrypted in transit and at rest using our hosting provider's standard encryption.
If a personal data breach affects a business's data, we will notify the business without undue delay and, where we are the Data Fiduciary, the Data Protection Board of India and affected individuals as the law requires. We aim to tell the business within 72 hours of confirming a breach.
Your rights
If you have the sign-in for a Sampreshan dashboard, you have the rights of a Data Principal under the DPDP Act: to know what sign-in data we hold about you, to correct or update it, to have it erased once it is no longer needed, to withdraw consent you gave us, to have a grievance addressed, and to nominate someone to exercise these rights if you die or become incapacitated.
If you sent an inquiry through a business's website form, send your request to that business, since it controls that data. We will help it act on your request. You may also complain to the Data Protection Board of India once it is operational, after raising the matter with the Data Fiduciary first.
Grievance Officer
Darshan Chobarkar, Grievance Officer, Tatvarth Systems LLP. Email privacy@tatvarthsystems.com. We acknowledge grievances within 48 hours and aim to resolve them within 30 days, and in any case within the period the law allows.
Children
Sampreshan is business software. No sign-in is created for anyone under 18, and we do not knowingly collect personal data from children. A business whose website is used by children is responsible for handling their data in line with the DPDP Act, including verifiable parental consent where it applies.
Changes to this policy
We may update this policy as Sampreshan or the law changes. For material changes we email the sign-in address for each website at least 14 days before they take effect, and publish the new version with a new effective date and version number.
Contact
Tatvarth Systems LLP
LLPIN ACZ-0405, registered in Maharashtra, India
privacy@tatvarthsystems.com