LEGAL
Privacy policy
What personal data we handle, why, where it is kept, and how to exercise your rights under India’s Digital Personal Data Protection Act. Written to be read, not skimmed past.
Last updated
AT A GLANCE
- What we collectYour enquiry, your account, and the business data your business puts in.
- Never soldNot sold, not rented, not used for advertising.
- Stored in IndiaAWS Mumbai, with recovery copies in Hyderabad.
- AI drafts, people decideYour business data does not train models for other customers.
- Your rightsAccess, correct, erase, withdraw consent, nominate.
- One person to write toThe Grievance Officer, at grievance@quan.co.in.
A plain-language summary. The full text below is what applies.
01 Who we are and what this covers
OneSuite is built and run by QUAN Technologies (“QUAN”, “we”, “us”), based in Mumbai, Maharashtra. This policy explains how we handle personal data on this website and in the OneSuite service.
We play two different roles, and the difference matters:
- For this website, for enquiries you send us, and for the accounts of people who sign in to OneSuite, we decide why and how the data is used. Under the DPDP Act 2023 we are the Data Fiduciary.
- For the business data a customer puts into OneSuite — its customers, suppliers, employees, invoices and so on — the customer decides why and how that data is used. The customer is the Data Fiduciary; we are its Data Processor and act only on its instructions.
If a business you deal with uses OneSuite and you have a question about your data, it is usually quickest to ask that business first. We will help them answer you.
02 What we collect
On this website. The site has no sign-in, no analytics and sets no cookies of its own. Our hosting provider receives the technical details every web request carries — IP address, browser type, the page requested and the time — and keeps them briefly to deliver pages and protect against abuse.
The forms on our contact and partners pages do not send anything to us. What you type stays in your browser until you press the button, which writes it into a draft WhatsApp message and opens WhatsApp. Nothing is stored by this site or sent to our servers. The draft travels in the link that opens WhatsApp, so WhatsApp — run by Meta — receives it in order to show it to you, under Meta’s own privacy policy; it reaches us only if you press send inside WhatsApp, and we then handle it as described below.
When you contact us — by email, phone, WhatsApp or one of those forms — we receive whatever you choose to send: typically your name, phone number, email address, business name and the content of your messages.
When your business uses OneSuite, we process:
- Account data: name, work email, phone number, role and the departments you have access to.
- Business data: whatever your business puts into OneSuite, which may include personal data about its customers, employees and suppliers.
- Security and usage data: sign-in times, IP addresses, device and browser details, and the audit trail of actions taken in the product.
- Billing data, once a paid subscription begins: the billing contact, GSTIN and invoice history. We do not store card numbers; payments are handled by a regulated payment provider.
03 Why we use it
We use personal data only for purposes you would reasonably expect, and each rests on your consent or on a legitimate use permitted by section 7 of the DPDP Act:
- To reply to your enquiry and, if you ask us to, show you OneSuite.
- To provide the service: sign you in, apply your roles and approvals, and run the features your business has switched on.
- To keep the service secure: detect misuse, investigate incidents and keep the logs the law requires.
- To bill for the service once the free first year ends, and to meet tax and accounting obligations.
- To tell you about changes to the service or these policies.
- To comply with Indian law and with lawful requests from government authorities.
We do not sell personal data, rent it, or use it for advertising. Where we rely on consent, you can withdraw it as easily as you gave it — withdrawal does not affect processing that already took place.
04 How OneSuite’s AI uses data
OneSuite’s AI reads the business data your business has put into the product so that it can analyse it and draft work — a reminder, a reorder, a reconciliation. It does not send, pay or change anything on its own: every draft waits for a person with the right role to approve it.
Your business data is not used to train AI models for any other customer, and it is processed in the same Indian region where it is stored.
AI output can be wrong. It is a draft for a person to check, not a decision about anyone.
05 Where it is kept
OneSuite data is stored and processed in India, in the AWS Asia Pacific (Mumbai) region, with recovery copies in AWS Hyderabad. The details are on our security page.
This website is served by our hosting provider through a global content delivery network, so the technical request details described above may be processed outside India.
Where any personal data is transferred outside India — for example, by an email provider — we do so only as section 16 of the DPDP Act permits, and never to a country the Central Government has restricted.
07 How long we keep it
- Enquiries: for as long as the conversation is active, then for up to two years so we have the context if you come back.
- Account and business data: for the life of the subscription, plus 90 days for you to export it. It is then deleted from the live system within 30 days and is gone from backups within a further 35 days.
- Security logs: 180 days, within India, as the CERT-In directions require.
- Billing and tax records: for as long as Indian tax and company law requires — currently up to eight years.
When the purpose is served and no law requires us to keep it, we erase it.
08 How we protect it
Encryption in transit and at rest, role-based access, approval before action, multi-factor sign-in, an audit trail, and tested backups. The security & trust page sets out what is in place and what is still on the roadmap.
If a personal data breach occurs, we will inform the Data Protection Board of India and the people affected as the DPDP Act and Rules require, and report cyber-security incidents to CERT-In within six hours. Where the data belongs to a customer’s business, we tell that customer without delay so it can meet its own obligations.
09 Your rights
Under the DPDP Act you have the right to:
- Access a summary of the personal data we process about you and how we process it.
- Correct, complete or update it.
- Have it erased, unless the law requires us to keep it.
- Withdraw consent you have given, at any time.
- Have your grievances addressed — see the grievance officer page.
- Nominate someone to exercise these rights for you in the event of your death or incapacity.
To exercise any of these, write to grievance@quan.co.in. We may need to confirm your identity before acting. If your request concerns business data a customer holds in OneSuite, we will pass it to that customer and help them respond.
10 Children
OneSuite is a business product and this website is meant for businesses. We do not knowingly process the personal data of anyone under 18 other than as part of a customer’s business records, and where that happens, it is the customer’s responsibility to obtain verifiable parental consent as section 9 of the DPDP Act requires.
12 Changes to this policy
We will update this policy when what we do changes. The date at the top of the page always shows the latest version. If a change materially affects how we use your data, we will tell OneSuite customers in advance by email.
13 Contact and grievances
For anything in this policy, write to our Grievance Officer. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
- NAME
- [Grievance Officer name]
- DESIGNATION
- Grievance Officer, QUAN Technologies
- grievance@quan.co.in
- PHONE
- +91 91364 50883
- ADDRESS
- [Registered office address], Mumbai, Maharashtra, India
- HOURS
- Monday to Friday, 10:00 to 18:00 IST, except public holidays
THE OTHER POLICIES