Introduction and Scope

This Privacy Policy describes how Rupioo ("Rupioo", "we", "us" or "our") collects, uses, stores, shares, protects and otherwise processes information in connection with the Rupioo website, web-based Distribution Management System (DMS), Warehouse application, Customer application, Salesperson application, Collection/Collector application, Delivery Boy/Delivery Personnel application, administrator dashboards, and related services (together, the "Services"). It applies to visitors, business customers, their authorised personnel, customers, suppliers, delivery workers and other individuals whose personal data is processed through the Services. Where a particular app has additional data practices or requests device permissions, we provide appropriate in-app notices and seek permissions as applicable.

Parties and Responsibilities

For data that a business customer uploads or instructs us to process through DMS, that business customer ordinarily determines the purposes and means of using the data, and we process it to provide the contracted Services, subject to applicable law and contractual arrangements. We may independently determine purposes and means for certain account administration, platform security, billing, support and website data. The appropriate legal roles depend on the actual processing activity and applicable law. Business customers are responsible for lawful collection, accuracy, access rights and required notices/permissions for information they submit and manage. We remain responsible for obligations imposed on us by applicable law and for security and privacy measures within our control.

Categories of Information

Depending on use and configured functions, we may process: (a) identification and contact details, including name, business name, user ID, work email, phone number, designation and billing address; (b) business records, including customer/supplier details, GST and invoice data, quotations, orders, sales, purchases, inventory, warehouse transfers, payments, receipts, credit notes, ledgers, transport and delivery records; (c) employee/workforce information, such as assigned roles, attendance or work activity if enabled by the customer; (d) account credentials in protected form, authentication events, OTP verification status, timestamps, approximate or precise location where enabled and permitted, and security audit logs; (e) app data including uploaded documents, images, invoices, proofs of delivery, customer-provided files, and support messages; (f) website analytics, cookies and usage diagnostics where deployed and disclosed. We do not need to store users' plain-text passwords, OTP codes after use, or private authentication keys. Actual data collected varies by app and permissions granted.

Purposes of Processing

We use information to provide account access and user management; process orders, invoices, inventory, collections and deliveries; enable customer/salesperson/warehouse workflows; provide business reports; authenticate users and authorised devices; detect abuse, fraud and security incidents; maintain backups and disaster recovery; troubleshoot errors; provide support; manage subscriptions and legal obligations; and improve reliability and performance. Marketing communications, if any, must comply with applicable rules and preferences. We do not sell customer business databases to advertisers.

App-Specific Processing and Device Permissions

The Customer App may display account balances, orders, invoices and payment history. The Salesperson and Collector Apps may process customer assignments, collection information, receipts and verification status. The Cashier function may process cash handovers, denominations and reconciliation records. Warehouse and Production Apps may process inventory, packaging, movement, production tasks and related worker activity. The Delivery Personnel App may process delivery assignments, recipient details, proof of delivery, location during delivery where enabled, and OTP confirmation status. The Authenticator/Security App may process registered-device verification, app integrity results, network/IP checks, geolocation with permission, hardware-backed public keys and approval records. Camera, notifications, location or other operating-system permissions are requested only when relevant to a feature and subject to platform rules. Permission denial may limit the corresponding feature. No continuous background location tracking should be claimed or activated unless the deployed app actually performs it with appropriate notice and permission.

Data Storage and Third-Party Infrastructure

To operate the Services, we may engage specialist third-party cloud hosting, database, data storage, backup, network and security infrastructure providers. These may include MongoDB Atlas or other MongoDB-based managed database services, along with cloud, object-storage and backup providers selected for the deployed environment. Such service providers process or store information on our behalf or under applicable contractual arrangements to deliver infrastructure services. We seek to use reasonable technical and organisational measures, including access controls, encryption where appropriate, restricted administrative access, monitoring and backup/recovery arrangements. The security of hosted data is a shared responsibility between the relevant infrastructure provider, our platform operations and the business customer/user, according to their respective roles.

Third-party infrastructure may experience outages, service interruptions, hardware or software failure, cyber incidents, data corruption or other events outside our direct operational control. Although we take reasonable steps to select, configure and oversee service providers and to support continuity and recovery, no electronic storage or transmission method can be guaranteed completely secure, continuously available or free of loss. We therefore do not promise uninterrupted access, absolute data preservation or a zero-risk environment. This statement does not exclude or reduce any responsibility, remedy, consumer protection, privacy obligation or liability that cannot lawfully be excluded, including obligations for breaches attributable to our own acts or omissions. Any contractual service-level commitments, backup/recovery objectives and lawful liability limitations are set out in the applicable Services Agreement or Terms, not replaced by this Privacy Policy.

Security Measures

Depending on the deployment and risk, we implement or plan to implement measures such as transport encryption, access controls, least-privilege roles, segregation of customer environments, administrator MFA/passkeys, registered-device verification for privileged accounts, password hashing, credential management, monitoring, security logs, backups and recovery testing. Describing a measure here does not mean every proposed control has already been deployed; the final published version must reflect controls actually operating. Users should safeguard their devices, credentials, OTPs and recovery factors, immediately report suspected compromise and restrict access to authorised personnel.

Disclosure and Sharing

Information may be disclosed to authorised users within the relevant customer organisation; contracted cloud/database/backup/infrastructure and communications suppliers; payment and messaging partners where integrated; professional advisers or auditors bound by suitable obligations; and competent authorities where lawfully required. We do not disclose one customer's confidential business records to another customer except where authorised by the relevant customer or required by law. Vendors receive only data/access reasonably necessary for their service, subject to appropriate arrangements.

Location and International Transfers

Data may be processed in the regions selected for our hosting and service providers, which may include locations in India and, where lawful and required for support or infrastructure services, other jurisdictions. Exact locations and transfer mechanisms depend on actual infrastructure and applicable restrictions. We will provide further details where required by law. Location data collected by mobile applications is used only for the disclosed business or security purpose and relevant permissions; it should not be treated as infallible proof of a person's physical presence.

Data Retention, Backups and Deletion

We retain personal data for the period reasonably necessary to provide the Services, fulfil customer instructions, maintain security, resolve disputes and meet accounting, tax or other legal obligations. Different categories may have different retention periods. Backup copies may persist for a limited rotation period before expiry, subject to legal holds and recovery needs. Upon a valid deletion request or contract termination, we will handle data deletion/export as required by law and our contract, including applicable exceptions for records we must retain. A user may request account deletion through sending an email to the registered rupioo support Gmail support@rupioo.in. Deleting an app or disabling an account does not itself erase information retained lawfully in the customer organisation's business records.

Individual Rights and Requests

Subject to applicable law, individuals may have rights to request information regarding processing, correction, updating, erasure, grievance redressal and other applicable statutory remedies. Requests about business records administered by a customer organisation may need to be directed to that organisation; we will provide reasonable assistance where appropriate. Contact support@rupioo.in. We may verify the requester's identity before fulfilling requests and may decline or limit requests as permitted or required by law.

Customer and User Responsibilities

Business customers must ensure that they have authority to provide data and instruct its processing, issue required notices, configure appropriate user roles, promptly remove access for departing staff, and maintain accurate financial, tax, stock and customer records. Users are responsible for their own entries, lawful use, device security and protecting login credentials. The Services are tools supporting business workflows; users should independently verify critical accounting, tax, operational and financial decisions. These responsibilities do not eliminate the platform provider's independent duties under law or any contractual commitments.

Data Breach and Service Incidents

Where we become aware of a security incident affecting personal data, we will investigate, contain, remediate and make notifications to customers, affected individuals or authorities as required by applicable law and our contractual arrangements. Notice timing and content depend on the incident and relevant laws. We cannot warrant that all incidents can be prevented or that all affected data can be restored in every scenario.

Cookies and Website Technologies

The website may use essential cookies/session technologies for login and security and, where implemented, analytics or preference cookies. The final published cookie disclosure must accurately identify categories and consent choices where legally required. Do not claim advertising or analytics cookies unless they are actually in use.

Children

The Services are primarily business-oriented and are not directed to children. If a service is made available to minors, the operator must implement applicable age, parental-consent and protection requirements before doing so.

Changes to this Policy

We may revise this Policy to reflect legal, technical or operational changes. The effective date and latest version will be shown on the website. Where required, we will provide advance notice or obtain fresh consent for materially changed processing.

Contact and Grievance Redressal

Data protection contact / grievance officer: Daksh Jain
Legal entity: Rupioo
Registered/business address: 92 M/S Road, Opp GMC Market Complex, Fancy Bazar, Guwahati, Assam, 781001
Privacy email: rupioo.in@gmail.com
Support email: support@rupioo.in
Website: https://rupioo.in
Grievance submission: support@rupioo.in
Effective date: 19th November 2026 | Version: 1.0