Privacy Policy

1. Who we are and what this covers

DEKCLOUD LLP ("DEKCLOUD", "we", "us"), Plot#65, Tripura Enclave, Hyderabad, Telangana 502032, India, builds and operates the Dek family of cloud business software. This one policy covers:

• this website, dekcloud.in;
• every Dek product and its web app, admin console, mobile app and marketing site: RetailDek (retaildek.in), DineDek (dinedek.in), PharmaDek (pharmadek.in), InteriorDek (interiordek.in), HRDek (hrdek.in), and any further Dek product we launch;
• the DEKCLOUD Backups Google integration used by those products (section 6).

A product's own website may carry a shorter policy for that product. Where the two differ, this policy is the complete statement and prevails.

2. Two roles

Dek products serve businesses ("Vendors"). Under the DPDP Act we act in two different capacities:

3. What data we hold

• Account data: username, display name, email, mobile number, a hashed password (never stored in readable form), role, and an audit trail of actions taken in the app.
• Vendor business data (processed on the Vendor's behalf): customer, supplier and staff details (names, phone numbers, addresses, GST numbers), inventory, sales and purchase documents, projects, attendance and payroll records, and product photos. Staff records may include Aadhaar numbers, PAN numbers and bank details where the Vendor chooses to record them.
• Website visitors: this site has no account, no form and no tracker. Our web servers and our security provider keep standard access logs (IP address, browser, pages requested) for a short period to keep the service running and safe.
• We do not sell, rent or share any of this data with advertisers or data brokers.

4. How data is protected

• Encryption in transit: every connection uses HTTPS/TLS.
• Field-level encryption at rest: identity-sensitive fields (Aadhaar number, PAN number, bank account number) are stored AES-256 encrypted; a copy of the database file does not reveal them.
• Encrypted backups: database backups are AES-256 encrypted with a key unique to each Vendor.
• Isolation: every Vendor's data lives in its own separate database; nothing is shared between businesses.
• Access control: role-based permissions govern every screen and action; passwords are hashed with bcrypt; sign-in attempts are rate-limited; changes are audit-logged; our administrators sign in with hardware-key-protected accounts.

5. Where data is stored and who helps us

Data is stored on secured cloud servers with hardened access (key-only administration, firewalled network, intrusion banning). A small number of service providers process data for us, each only for the purpose named:

6. Google account data and Drive backups

Dek products offer an optional backup of a Vendor's data to the Vendor's own Google Drive. The Google application that performs this is named DEKCLOUD Backups and is shared by every Dek product.

• You connect, you own. A Vendor connects their own Google account through Google's official sign-in. Backups land in a folder named after the product (for example "RetailDek Backups") in that Drive. DEKCLOUD never uploads to a Google account of its own.
• What we ask Google for. Only two permissions: drive.file, which lets the app create and manage files it created itself and nothing else in your Drive, and your email address, used solely to show which account is connected in Settings.
• What we store. The connection token Google issues, encrypted, inside the Vendor's own database, plus the connected email address and the time of the last backup. We keep no copy of your Drive contents.
• What we do with it. Upload the Vendor's backup file, encrypted before it leaves our servers; list and delete only the backup files the app created, keeping the most recent seven. Nothing is read for advertising, profiling or any other purpose, and no person at DEKCLOUD views it except with your explicit consent for support, where needed for security, or where the law requires.
• Limited Use. DEKCLOUD's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Disconnecting. Disconnect at any time from the product's Settings, which deletes the stored token, or revoke access from your Google Account permissions. Existing backup files stay in your Drive under your control; delete them there whenever you wish.

7. WhatsApp, SMS and email messages

Dek products send two kinds of messages. Service messages to you: one-time sign-in codes and account notices, by email or WhatsApp, to the address or number on your account. Business documents to a Vendor's customers: invoices, orders and bills a Vendor chooses to send, delivered through DEKCLOUD's WhatsApp Business number on the Vendor's behalf. For those, the Vendor is the Data Fiduciary and we act as processor. Each document link is signed and expires.

8. Mobile apps

• Our apps ask for the camera only to scan barcodes and take product or document photos, and for storage only to save files you export. Permissions are requested when a feature needs them and can be withdrawn in your phone's settings.
• The apps contain no advertising or analytics SDK. Crash and error reports go to DEKCLOUD's own servers and carry the app version, device model and the error, not your business data.
• Signing in on a phone creates the same session as the web app and is covered by the same rules.

9. Retention and deletion

• Data is retained for as long as the Vendor's subscription or free account is active, and for the read-only grace period stated in each product's terms.
• Vendors can correct or delete individual records (customers, suppliers, staff) inside the application at any time.
• On termination the Vendor may request a complete copy of their data in standard, openly documented formats, and/or its deletion. Encrypted backups are decryptable with a key we hand to the Vendor. Data is never locked in.
• Server access logs are kept for a short, fixed period and then discarded.

10. Your rights under the DPDP Act

• Access: obtain a summary of the personal data held about you.
• Correction and erasure: have inaccurate data corrected, or data no longer required erased.
• Grievance redressal: raise a complaint with our Grievance Officer and receive a response within the statutory timeline.
• Nomination: nominate a person to exercise these rights on your behalf.

If you are a customer, patient, guest or employee of a business that uses a Dek product, please direct requests to that business first. They are the Data Fiduciary of the records they keep about you. We support them in fulfilling such requests.

11. Grievance Officer

12. Cookies and measurement

In the applications, we use one strictly necessary session cookie to keep you signed in. The applications have no advertising cookies and no third-party trackers.

On this website, dekcloud.in, we set no cookies and run no analytics. On a product's marketing site we may use measurement tools from Meta (the Meta Pixel) and Google (Google Analytics, Google Ads) to understand which advertisements bring people to that product; that site's own policy describes them. You can block or delete cookies in your browser and manage advertising through your Meta and Google settings.

13. Children

Dek products are services for businesses. We do not knowingly collect data from, or show advertising to, anyone under 18.

14. Changes to this policy

We may update this policy as the law or the products evolve. The "Last updated" date above always reflects the current version; material changes are highlighted inside the applications.

15. Governing law

This policy is governed by the laws of India. Courts at Hyderabad, Telangana have exclusive jurisdiction.