Privacy Policy

1. Legal Framework & Data Fiduciary Role

Arthixora Technologies Private Limited ("Arthixora", "we", "us", or "our") is committed to protecting the privacy, confidentiality, and security of digital personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

Under the DPDP Act 2023:

• Arthixora acts as a Data Fiduciary with respect to subscriber administrative account details (user credentials, subscription billing history, contact information).
• Arthixora acts as a Data Processor / Technology Facilitator with respect to the business records, invoices, client lists, and accounting ledgers stored by subscriber tenants inside their private workspaces.

2. Categories of Data Collected & Processed

To deliver cloud ERP and accounting services, we process the following categories of information:

3. Purpose Limitation & Processing Grounds

We process personal and business data strictly on valid legal grounds:

• Performance of Contract: To provision your dedicated multi-tenant business workspace, manage user access roles, enforce double-entry validation, calculate GST reports, and synchronize native desktop day-book records.
• Statutory Compliance: To satisfy Indian statutory audit mandates under the Companies Act, 2013 and Goods and Services Tax (GST) laws requiring retention of financial transactions.
• Transactional Communication: To dispatch critical account alerts, invoice copies, and password resets via authenticated transactional email (Brevo) or customer communications.

4. Enterprise-Grade Security Architecture

Arthixora implements strict technical and organizational safeguards in accordance with Section 43A of the IT Act, 2000:

• Data Isolation: Strict multi-tenant row-level database isolation guarantees that no business tenant can view or access data belonging to another tenant.
• Encryption: All database storage in Neon PostgreSQL is encrypted at rest using AES-256 encryption. All network communications are encrypted in transit using TLS 1.3.
• Session Security: Session authentication tokens are signed with HMAC-SHA256 cryptographic hashes and transmitted using HttpOnly, Secure, and SameSite=Lax cookie flags.
• Payment Card Industry Compliance: Payment processing is handled directly by Razorpay Software Private Limited (PCI-DSS Level 1 certified). Arthixora never stores credit card numbers, CVVs, or netbanking passwords on its servers.

5. Data Retention & Preservation of Accounting Books

In accordance with Section 36 of the Central Goods and Services Tax (CGST) Act, 2017 and Section 128 of the Companies Act, 2013, every registered entity is required to maintain true and correct accounts and records for a minimum period of 72 months (6 years) to 8 years from the due date of filing of the relevant annual return.

To protect your business from statutory non-compliance, Arthixora maintains a 100% Data Preservation Guarantee: even if a trial expires or a paid subscription is paused, your accounting ledgers, vouchers, and customer records remain safely stored and exportable.

6. Rights of Data Principals under DPDP Act 2023

As a Data Principal under Indian law, you have the right to:

• Request a summary of personal data being processed by Arthixora.
• Request correction or updating of inaccurate or misleading personal details.
• Request erasure of personal data, subject to statutory tax retention mandates under Indian law.
• Nominate an individual to exercise rights on your behalf in the event of incapacity.
• Register a grievance with our Grievance Redressal Officer.

7. Grievance Redressal Officer & Contact

For privacy inquiries, rights requests, or grievance redressal under the DPDP Act 2023, please contact our designated Grievance Officer: