Privacy Policy

1. Who we are

Viamione ("Viamione", "we") provides the Viamione ERP. For the personal data described below that we collect to run our website, sign-ups and billing, we are the "data fiduciary" under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). For the personal data you put into your own installation (your customers, staff, suppliers), you decide why and how it is used and we act only as your processor.

2. What we collect

We collect only what we need:

• Sign-up and account: name, work email, phone number (if you give it), company name, address, state, GSTIN (if any), and the installation administrator's name and email
• Billing: plan, invoices, payment status and the Razorpay payment reference. Card, UPI and bank details are entered with Razorpay and are never stored by us
• Usage and security: IP address, device and browser details, sign-in events, audit logs of actions in the Service, and error logs
• Communication: your demo and support requests, and emails we send you with delivery status
• Cookies and similar: only those needed to keep you signed in and remember preferences such as light/dark theme. We do not run third-party advertising cookies on the Service

3. Why we use it

Each use below is based on your consent or on a legitimate use permitted by the DPDP Act (such as performing the contract with you, complying with law, or keeping the Service secure):

• create and verify your account (including one-time passwords by email), provision your installation and sign you in
• issue proformas, GST invoices and receipts, take payment and keep tax records
• provide support, send service and security notices, and (with your consent) product news you can opt out of at any time
• prevent abuse and fraud, including captcha and rate limiting at sign-up
• meet legal obligations and respond to lawful orders

4. Consent

Where we rely on consent we ask for it clearly, for a stated purpose, and you can withdraw it at any time by writing to us or using the unsubscribe link. Withdrawing consent does not affect earlier lawful use, and may mean we can no longer provide parts of the Service.

5. Who we share it with

We do not sell personal data. We share it only with:

• service providers who process it for us under contract: payment processing (Razorpay), email delivery, cloud hosting and storage, captcha (Cloudflare Turnstile), and monitoring
• your own installation's users, for data you put there
• authorities, courts or regulators where the law requires, or to protect rights and safety
• a successor, in a merger or sale of the business, on the same privacy terms

6. Where it is stored

Data is hosted on infrastructure we control or contract. Each customer's installation uses its own database. Some of our service providers may process data outside India; where they do, we use only the transfers the DPDP Act permits and require protection no weaker than this policy.

7. How long we keep it

We keep account and billing records for as long as you are a customer and afterwards for the period needed to meet tax and accounting law (generally up to 8 years for invoices and books). Unpaid draft installations and abandoned sign-ups are deleted after they lapse. After an installation ends, you can ask support for an export of its data for 30 days, after which it is deleted or anonymised, except what we must retain by law. Security and audit logs are kept for a limited period.

8. Security

We use reasonable security practices as required by Section 43A of the IT Act and its SPDI Rules: a separate database per customer, encrypted connections, encrypted storage of secrets and credentials, hashed passwords, role-based access, rate limiting, audit logs and backups. No system is perfectly secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the law requires.

9. Your rights

Under the DPDP Act you have the right to:

• obtain a summary of the personal data we process and the parties we share it with
• have inaccurate data corrected, incomplete data completed and outdated data updated
• have personal data erased when it is no longer needed for the purpose or you withdraw consent, unless the law requires us to keep it
• have your grievance redressed, and to nominate another person to exercise your rights if you die or become incapacitated

10. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal data of children; if you think we have, tell us and we will delete it.

11. Data in your installation

If you are a customer, you are responsible for the personal data of your own customers, staff and suppliers that you store in your installation, including notices and consents. We process it only to provide the Service and on your documented instructions, keep it confidential, help you respond to requests from the people concerned, and delete or return it when the relationship ends.

12. Grievance officer and contact

Questions, requests under section 9, or complaints: Grievance Officer, support@viamione.com. We acknowledge within 48 hours and aim to resolve within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India once it is constituted and the law allows.

13. Changes

We may update this policy and will show the date above. We will tell you about material changes by email or in the Service.