Privacy Policy
How Indoria Office handles your personal data
Template - not legal advice. This document was drafted for Indoria Technologies Private Limited to match how the software actually works. Company details are filled in. Have an advocate in India review it before launch, especially the Digital Personal Data Protection Act 2023 sections, the handling of students under 18, and the limitation of liability.
1. Who is responsible for your data
- Your organisation (school, college, company): when you use Indoria Office through an organisation, the organisation decides why your files and member details are used. It is the "Data Fiduciary" for that content and we act as its "Data Processor" under a Data Processing Agreement.
- Indoria: we are the Data Fiduciary for the account and security data needed to run the Service (sign-in, protection against abuse, legal compliance) and for people who create their own organisation on our hosted service.
- If you are unsure who your organisation's administrator is, ask them. They can see the member list, roles and activity described below.
2. What we collect
| Data | Examples | Why | Source |
|---|---|---|---|
| Account details | Name, e-mail address, password (stored only as a salted scrypt hash) | Create and secure your account, send service e-mails | You |
| Organisation details | Organisation name, your role, apps enabled, invitations | Provide multi-user access and administration | You / your admin |
| Your files | Documents, spreadsheets, presentations, notes you save to Indoria Cloud, with names, sizes, version history | Store and sync your work | You |
| Sign-in and security records | Sign-in time, IP address, browser/device description, failed attempts, actions such as invite, role change, delete, export | Keep accounts safe, let administrators and you review activity | Automatically |
| Usage counts | Which app was opened, when, and by which account (no document content) | Show your administrator how the Service is used; plan capacity | Automatically |
| Local data on your device | Draft autosave, preferences, cached pages, the sign-in cookie | Make the apps work offline and keep you signed in | Your device |
We do not collect your phone contacts, location, microphone or advertising identifiers. The camera is used only when you tap Scan to read a barcode; the picture is read on your device and is never uploaded or stored. We do not use advertising or analytics trackers, and we do not sell personal data. The editors do not send what you type to us unless you save a file to Indoria Cloud.
3. Why we may process it (legal basis)
- Consent: you give it when you create an account, or your organisation obtains it for you (for students under 18, from a parent or guardian - see section 8).
- Legitimate uses permitted by the DPDP Act, for example complying with law, responding to a medical or safety emergency, and, for employees, employment-related purposes.
- You can withdraw consent at any time. Withdrawal does not affect earlier processing, and we may then be unable to provide the Service to you.
4. Who we share data with
- Your organisation's administrators: member list, roles, last sign-in, file names, owners, sizes and sharing settings, activity records and usage counts. Administrators cannot read the content of files you keep private.
- Other members: files you share as "Organisation can read/edit" and your name next to them.
- Service providers acting on our instructions: hosting/cloud infrastructure, Razorpay (payments), e-mail delivery (SMTP provider), backup storage, and, only where your organisation turns it on, Meta Platforms (WhatsApp Business Cloud API). Current list: Hostinger (server hosting, India), and the SMTP e-mail provider and backup storage that the operator configures for the server (these are named in the organisation's own administrator settings).
- Authorities where required by law or a lawful order, or to protect rights and safety.
- A buyer or successor if the business is transferred, on terms that keep this policy in force.
Personal data is stored on servers located in India. If we transfer data outside India we will do so only as the DPDP Act and any government notification allow.
5. How long we keep it
| Data | Retention |
|---|---|
| Account details | While your account exists; deleted when you delete the account |
| Files | Until you or your organisation delete them. Deleted files stay in trash for 30 days and are then removed. Up to 10 older versions of each file are kept and removed with the file |
| Sign-in sessions | Until they expire (30 days) or you sign out |
| Verification, reset and invitation tokens | Expire after 3 days, 1 hour and 7 days; used or expired tokens are cleaned up automatically |
| Activity (audit) records | For the life of the organisation, for security and accountability. When you delete your account, your name and IP address are removed from them |
| Usage counts | Up to 400 days |
| Outgoing e-mail log (only if e-mail is not configured) | 30 days |
| Invoices and payment records | 8 years, because tax and company law require it, even if you delete your account (your name is kept only on the invoice) |
| Backups | Server backups are taken every night and the last 14 are kept by default (so deleted data can remain in a backup for up to 14 days), then overwritten. A file you download yourself with Backup and export is yours to look after |
We may keep data longer where the law requires it.
6. Your rights
Under the DPDP Act you may: get a summary of the personal data we process and who we share it with; ask us to correct, complete, update or erase it; withdraw consent; use our grievance process; and nominate another person to exercise your rights if you die or become unable to. In the product:
- Account > Your data > Download my data - a JSON copy of your account, memberships, sessions, file list and activity.
- Account > Your data > Delete my account - needs your password. If you are the only owner of an organisation with other members, make someone else an owner first.
- Account > Profile and Change password - correct your details.
- Account > Where you are signed in - sign out other devices.
For anything else write to contact@indoriatechnologies.in. We will reply within 15 days. If your data is held by your organisation as Data Fiduciary, we will pass your request to them.
7. Security
We protect data with HTTPS, salted password hashing, hashed session tokens, rate limiting and account lockout, strict browser security headers, per-organisation access checks and audit records. No system is perfectly secure. If a personal data breach happens we will inform affected people and the Data Protection Board of India as the law requires. See the Security and Incident Response Policy.
8. Children and students under 18
- A person under 18 is a "child" under the DPDP Act. Before a child's personal data is processed, verifiable consent of the parent or lawful guardian is required, unless a legal exemption applies.
- Indoria Office is intended for use by children only through a school, college or other organisation that is responsible for obtaining that consent (or relying on an exemption available to educational institutions) and that has signed our Data Processing Agreement. We do not knowingly open stand-alone accounts for children.
- We do not track or monitor the behaviour of children and we do not show them advertising.
- If you are a parent or guardian and believe your child has an account without proper consent, write to contact@indoriatechnologies.in and we will act promptly.
9. Cookies and local storage
We use one strictly necessary cookie to keep you signed in and some browser storage so the apps work offline. See the Local Storage and Cookie Notice.
10. Grievance Officer
Sahil Indoria, Managing Director and Grievance Officer, Indoria Technologies Private Limited, Surajgarh, Jhunjhunu, Rajasthan, India. E-mail: contact@indoriatechnologies.in. Working hours: Monday to Saturday, 10:00 to 18:00 India Standard Time. We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you are not satisfied you may complain to the Data Protection Board of India once it is operating, at the address it publishes.
11. Changes
We will post changes here and tell you in the Service or by e-mail before material changes take effect. The date at the top shows the current version.