Privacy Policy

We collect only what we need to deliver ResellerOS reliably:

• Account data — your name, business name, work email, phone number, and password (stored hashed).
• Business identifiers — GSTIN, PAN, state, and address — for GST-compliant invoicing.
• Operational data — leads, customers, quotes, invoices, subscriptions, payments, and bank transactions you createin ResellerOS.
• Communication logs — emails / WhatsApp messages sent via our platform, including their delivery status.
• Technical data — IP address, browser type, device, and timestamps (server logs, kept for 90 days for security).

• To deliver core ResellerOS functionality (CRUD, reporting, automations).
• To process payments and issue GST-compliant invoices on your behalf.
• To send transactional emails (quotes, renewals, receipts) you initiate.
• To respond to support requests.
• To detect fraud, abuse, and security incidents.
• To comply with our legal obligations under Indian law.

We do not sell your data. We do not use your customer or lead data to train AI models. We do not run advertising.

We use the following carefully selected service providers. Each is contractually bound to data protection standards equivalent to or stricter than the DPDP Act:

Your data lives on Supabase Postgres in Mumbai (asia-south1), with Row-Level Security ensuring each tenant only sees their own data. Application servers run on Google Cloud Run in the same Mumbai region. Backups are encrypted at rest and replicated within India.

We retain your operational data as long as your account is active. If you cancel, we keep your data for an additional 90 days in case you want to reactivate, then permanently delete it (except records we’re legally required to keep, such as GST invoices for 6 years under CGST Section 36).

You have the right to:

• Access the personal data we hold about you
• Correct any inaccurate or incomplete data
• Erase your data (subject to legal retention requirements)
• Withdraw consent for non-essential processing at any time
• Grievance redressal — see Section 9 for our DPO contact
• Nominate another person to exercise these rights in case of death/incapacity

To exercise these rights, email privacy@resellersos.in. We respond within 7 working days (DPDP requirement: 30 days).

• All data in transit is encrypted with TLS 1.3
• Database backups encrypted at rest (AES-256)
• Row-Level Security on every table — no cross-tenant data leakage
• Passwords stored using bcrypt (salted)
• OAuth sessions use HTTPOnly + Secure + SameSite cookies
• Service-role keys never exposed to client browsers

We use only essential cookies required to keep you signed in and maintain your session. No third-party advertising cookies, no behavioural tracking. Plausible Analytics (if enabled) is cookie-less and IP-anonymised.

Data Protection Officer:
Pardeep Sharma
ANUTECH DIGITAL PVT LTD
Plot no. B-9/54 Sector 5, Rohini, Delhi, 110085, India
Email: privacy@resellersos.in

If you’re dissatisfied with our response, you may approach the Data Protection Board of India (when constituted under the DPDP Act).

We’ll update this page with the new effective date if we change how we handle your data. Material changes will be emailed to all tenant owners at least 7 days in advance.