Privacy Policy

1. Who we are

1.1 [PRODUCT NAME] is provided by Ouranos Technologies Private Limited, a company incorporated in India, having its registered office at Sixth Floor, 617, Satyamev Eminence, Science City Road, Near Sukan Mall Cross Road, Thaltej, Ahmedabad, Gujarat 380059, India, and GSTIN 24AACCO0079L1ZE ("Company", "we", "us" or "our").

1.2 This Policy applies to two categories of personal data, and our role differs between them.

(a) Account Data. This is personal data about the persons who register for, sign in to or otherwise use the Service: the owner of an Account, the members and sub-agents the owner invites, and persons who begin a sign-up. For Account Data, we are the Data Fiduciary within the meaning of the DPDP Act.

(b) Customer Data. This is personal data that a Customer (an agency or an individual agent) enters into or uploads to the Service about its own clients, including policy holders, insured persons, nominees, family members and prospects. For Customer Data, the Customer decides why and how the data is processed and is the Data Fiduciary. We process Customer Data only on the Customer's behalf and on its instructions, as a Data Processor.

1.3 If you are a client of an insurance agent or agency that uses the Service, your agent is responsible for telling you how your personal data is used and for obtaining any consent the law requires. Please contact your agent first in relation to your personal data. Where we receive a request from you directly, we will refer it to the relevant Customer and assist the Customer in responding to it.

2. What we collect

2.1 Account Data. We collect the following Account Data:

(a) identity and contact details: name, email address and mobile number;

(b) account details: whether the Account is held by an agency or an individual, the agency's name, workspace address, the role assigned to each member, and invitations sent and accepted;

(c) billing details: the billed name and legal name, GSTIN (where provided), billing address and state, the plan and billing term chosen, invoices, and records of payments and refunds;

(d) payment information: a reference to the payment method held by our payment service provider, being its type, brand, the last four digits of a card or a masked UPI identifier, and its expiry where applicable. We do not receive or store full card numbers, card verification codes or UPI credentials;

(e) sign-in and security information: the time of each sign-in, the browser and device used, an identifier for a device you have used before, and the approximate place (city or region) from which you signed in, as described in paragraph 2.3;

(f) consent records: the version of this Policy and of the Terms of Service you accepted and the time of acceptance; and

(g) communications: messages, issue reports and attachments you send to us through the Service or by email.

2.2 Customer Data. Customer Data is whatever a Customer chooses to record in the Service. Depending on the Customer's use, it may include names, contact details, dates of birth, addresses, government identifiers such as PAN, vehicle details, bank account details, details of insurance policies, premiums, claims and commissions, and documents uploaded against those records. Customer Data may include personal data of children and other persons who have no direct relationship with us.

2.3 Approximate location at sign-in. When you sign in, we derive an approximate place (city or region) from the internet protocol (IP) address of the request. We use it to show you where your Account is signed in and to alert you to a sign-in from a new browser. We store the approximate place only. We do not store or log the IP address itself.

2.4 Cookies and similar technologies. We use only those cookies and browser storage that the Service needs in order to work:

(a) a session cookie that keeps you signed in, which ends when you sign out or the session expires;

(b) a device cookie that allows us to recognise a browser you have used before, which lasts for up to 90 days and is stored by us only in hashed form;

(c) a short-lived cookie, lasting up to 30 minutes, that remembers the plan you selected on our website while you complete sign-up; and

(d) settings such as your preferred appearance, which are kept in your browser.

We do not use advertising cookies or third-party tracking cookies.

3. Why we use it

3.1 We process Account Data on the basis of the consent you give when you create an Account or accept an invitation, and, where the DPDP Act permits, for the legitimate uses recognised under section 7 of that Act, including compliance with law. We use Account Data to:

(a) create and administer your Account and verify your identity when you sign in;

(b) provide the Service, including sending you the reminders, notices and messages that form part of it;

(c) process payments, issue tax invoices and credit notes, and maintain books of account;

(d) keep the Service and your Account secure, including detecting and preventing fraud and unauthorised access;

(e) respond to your requests, issue reports and complaints;

(f) send you service communications about your Account, your plan and changes to the Service or to these terms; and

(g) comply with our obligations under applicable law, including tax law, and with lawful requests of public authorities.

3.2 We process Customer Data only to provide the Service to the Customer and in accordance with the Customer's instructions. We do not use Customer Data for our own marketing, we do not sell it, and we do not use it to build profiles of the Customer's clients or to train models for any other customer.

3.3 We do not send marketing communications to the clients of our Customers.

4. Who we share it with

4.1 We do not sell personal data. We disclose personal data only as described in this section.

4.2 Service providers. We engage the following categories of service providers to process personal data on our behalf, under written terms that restrict their use of it to the services they provide to us:

(a) cloud hosting and database providers, with data centres in India;

(b) network, content delivery and security providers that protect the Service from attack;

(c) email delivery providers that send sign-in codes, reminders and service emails;

(d) Razorpay Software Private Limited, which processes payments to us and holds payment methods for recurring payments; and

(e) where a Customer uses them, providers of SMS and WhatsApp messaging that deliver messages the Customer sends to its clients.

A current list of these providers is available on request from the contact given in section 7.

4.3 Within a Customer's Account. Personal data entered into an Account is visible to the members of that Account in accordance with the roles and permissions the Customer assigns.

4.4 Legal requirements. We may disclose personal data where we are required to do so by law, by order of a court or tribunal, or on a lawful request of a government authority, or where disclosure is necessary to protect the rights, property or safety of the Company, our Customers or others.

4.5 Business transfers. If the Company is involved in a merger, amalgamation, acquisition or sale of all or part of its business, personal data may be transferred to the successor entity, which will be bound by the terms of this Policy.

4.6 Location of processing. We store personal data on servers located in India. We do not transfer personal data outside India except where a service provider in paragraph 4.2 requires it to provide its service and the transfer is permitted under the DPDP Act.

5. How long we keep it

5.1 We keep Account Data for as long as your Account is active, and after that only for as long as is necessary for the purposes in section 3 or as required by law.

5.2 When an Account is closed, the Customer may export its data for 30 days. After that period, we delete or irreversibly anonymise the Account Data and Customer Data of that Account within [NUMBER] days, except as provided in paragraph 5.3.

5.3 We retain invoices, credit notes and records of payments and refunds for the period required under the Central Goods and Services Tax Act, 2017 and other applicable law, even after an Account is closed. Security and audit records are retained for [NUMBER] years.

5.4 Deleted data may persist in encrypted backups for up to [NUMBER] days, until those backups are overwritten in the ordinary course.

6. Your rights

6.1 Subject to the DPDP Act and the rules made under it, you have the right to:

(a) obtain a summary of the personal data about you that we process and of the processing activities we undertake with it;

(b) have inaccurate or misleading personal data corrected, incomplete personal data completed, and personal data updated;

(c) have personal data erased where it is no longer necessary for the purpose for which it was collected, unless retention is required by law;

(d) withdraw your consent at any time, with the same ease with which it was given. Withdrawal does not affect processing carried out before it. As the Service cannot be provided without the Account Data described in section 2.1, withdrawal of consent will result in the closure of your Account;

(e) have your grievances redressed in accordance with section 7; and

(f) nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

6.2 Many of these rights can be exercised from your profile in the Service. Otherwise, write to us at the contact given in section 7. We may need to verify your identity before acting on a request.

6.3 Requests that concern Customer Data should be made to the Customer concerned. We will assist the Customer in responding to them.

6.4 Children. The Service is intended for use by adults in the course of their business. A person under the age of 18 years may not create or use an Account.

7. Grievances and complaints

7.1 If you have any question, request or complaint about the processing of your personal data, please contact our Grievance Officer:

[GRIEVANCE OFFICER NAME] Grievance Officer, Ouranos Technologies Private Limited Sixth Floor, 617, Satyamev Eminence, Science City Road, Near Sukan Mall Cross Road, Thaltej, Ahmedabad, Gujarat 380059 Email: [GRIEVANCE EMAIL]

7.2 We will acknowledge your grievance and respond to it within the period prescribed under applicable law.

7.3 If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India in accordance with the DPDP Act.

8. Changes to this policy

8.1 We may revise this Policy from time to time. Each revision carries a new version number and the date from which it is in force.

8.2 Where we make a material change, we will notify you and ask you to accept the revised Policy the next time you sign in. You may decline, in which case you will be signed out and no change will be made to your Account or its data until you accept. A revision that does not change the substance of this Policy, such as a correction of a typographical error, will not require fresh acceptance.

8.3 The version of this Policy in force at any time is available at [WEBSITE URL]/legal/privacy.