Privacy Policy

1Who we are

1.1ExioCraftz is a business run by Krish Grover and Aagam Jain as partners, based in Dehradun, Uttarakhand, India. In this policy, “ExioCraftz”, “we” and “us” mean the two of them working under that name. We are the Data Fiduciary for the personal data described here.

1.2This policy is our notice under the Digital Personal Data Protection Act, 2023 (the DPDP Act) and its Rules, and under the Information Technology Act, 2000 and its rules on reasonable security practices.

1.3You can reach us at contact@exiocraftz.com, +91 98021 25000 or +91 95480 02405.

1.4You can ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India by writing to us.

2What this policy covers

2.1It covers personal data we handle when you visit www.exiocraftz.com, fill in our enquiry form, contact us by email, phone, WhatsApp or Instagram, or become a client.

2.2It doesn’t cover the websites, apps, delivery systems and queue systems we build for clients, even where they run on an exiocraftz.com address (for example rajsteels.exiocraftz.com). Each client’s own privacy policy applies to those, and our role is explained in section 10. Our own demo sites, solar.exiocraftz.com and ember.exiocraftz.com, are covered by this policy.

3What you give us

Please don’t send us sensitive data such as health information, banking passwords, or details of caste, religion or sexual orientation. We don’t need it.

4What we receive automatically

4.1Like every website, ours is delivered by a hosting provider (Vercel) that receives technical data when you visit: your IP address, browser and device type, the page requested, the page you came from and the time. It uses this to deliver the site and protect it from attacks.

4.2Our pages load code libraries from unpkg, so that service also receives your IP address and browser details. Our fonts are served from our own site.

4.3We don’t use Google Analytics, advertising pixels or any tracking service that follows you around the web.

4.4We use Vercel Web Analytics to count visits to our pages. It is cookie-free and collects anonymous, aggregated page-view data: the page visited, the referring page, and your approximate location, device type, browser and operating system. It builds no personal profiles and does no cross-site tracking. We use the counts only to see which pages people read and to improve the site.

5Cookies and browser storage

Our website sets no cookies. It keeps a few small settings in your own browser: whether you have seen the intro, your sound setting, a simple visit counter, a copy of enquiries you sent so they can be resent if sending failed, and the times you sent them, which limits how often the form can be used. These stay on your device. Only the enquiry form sends anything to us, to our private Google Sheet. You can remove them at any time by clearing your browser’s data for exiocraftz.com.

6How we use it, and why we’re allowed to

Under the DPDP Act we rely on your consent, or on a “legitimate use” in section 7 of the Act, such as data you choose to give us for a particular purpose.

We won’t use your data for a new purpose without telling you first, and asking for consent where it is needed.

7Consent and messages

7.1Where we rely on consent, we ask clearly, and you can withdraw it at any time by emailing us. Withdrawing doesn’t affect what we did before.

7.2Messages about your enquiry, project, invoices or security are part of working with us. They aren’t marketing.

7.3We only send offers or news if you opt in. Every email has an unsubscribe link, and you can reply STOP to WhatsApp or SMS messages.

7.4We message you on WhatsApp only if you contacted us there or asked us to. WhatsApp and Instagram are run by Meta, whose own privacy policy covers what Meta does with your data.

8Payments

8.1When we take payments online, they go through a payment gateway such as Razorpay (India) or PayPal (international clients). The gateway collects your card, UPI or bank details directly. We never see or store full card numbers, CVV, UPI PINs or banking passwords.

8.2From the gateway we receive the payer’s name, email or phone, the amount, the transaction ID and status, and masked payment details. For bank transfers, we see what your bank shares, such as the account name, and use it only to match your payment.

9Who we share it with

9.1We don’t sell personal data, and we don’t share it for advertising.

9.2We share it only with:

9.3Service providers may use your data only to provide their service to us, under their own terms and security commitments.

10Products we build for clients

10.1When we build, host or maintain a client’s website, app, delivery system or queue system, the client decides why and how its users’ data is used. The client is the Data Fiduciary and we are its Data Processor, working only on its instructions under section V of our Terms & Conditions.

10.2If you use a client’s app or website, please contact that business about your data. If you contact us instead, we will pass your request on to them, with your permission, and help them respond.

10.3Unless a client asks for something different, the products we build:

• collect delivery riders’ location only while a delivery is active, with the phone’s permission and a clear notice in the app, and keep trip history for 90 days;
• use customers’ location only when they allow it, to set an address or follow an order;
• use phone numbers and emails for order or queue updates, and delete queue data 30 days after the visit;
• ask for phone permissions (camera, photos, notifications, contacts) only when a feature needs them, and keep working if one is refused;
• let people delete their account inside the app, and request it from a web page, wherever they can sign up; and
• leave card details to the client’s payment gateway. We never store card data.

10.4When a client stops using our services, including when its monthly fee stops, we give the client an export of its users’ data if asked and delete our copies within 30 days. Backups are overwritten within 90 days. We keep only what the law requires.

11How long we keep it

When data is no longer needed and no law requires us to keep it, we delete or anonymise it. We may keep a short note that you asked us not to contact you, so that we respect it.

12Security and data breaches

12.1We protect personal data with reasonable security practices: HTTPS across our website, two-factor authentication and password managers on our accounts, access only for people who need it, secure coding, spam protection on our form, and confidentiality commitments from everyone who helps us.

12.2No system is completely secure. Please share files and logins only through the secure methods we suggest.

12.3If a data breach happens, we will tell the people affected and the authorities, as the law requires.

13Your rights

13.1Under the DPDP Act you can:

• get a summary of the personal data we hold about you, how we use it and who we have shared it with;
• correct, complete or update it;
• have it deleted, unless the law requires us to keep it;
• withdraw your consent at any time;
• complain to our Grievance Officer (section 16); and
• name someone to use these rights for you if you die or can’t act.

13.2To make a request, email contact@exiocraftz.com with “Privacy request” in the subject line. We may ask for a little information to confirm who you are. It’s free.

13.3We acknowledge requests within 48 hours and reply within 30 days. If a request is complicated we will tell you, and we will never take longer than the 90 days the DPDP Rules allow.

13.4If you aren’t happy with our answer, you can complain to the Data Protection Board of India after using our grievance process.

14Children

Our services are for businesses and adults. We don’t knowingly collect personal data from anyone under 18, the age of a “child” under the DPDP Act. If we find we have, we delete it. We don’t track children or target advertising at them.

15Changes to this policy

We will publish any update on this page with a new effective date. For important changes we give at least 30 days’ notice, by email to clients or with a notice on our website. Earlier versions are available if you ask.

16Contact and Grievance Officer

We acknowledge complaints within 48 hours and resolve them within 30 days.