Privacy Policy
1. Who we are
RetailDek is a cloud-hosted retail management platform provided by DEKCLOUD LLP ("we", "us", "the Provider"), Plot#65, Tripura Enclave, Hyderabad, Telangana 502032, India. This policy explains what personal data we handle, why, how it is protected, and the rights you hold under the Digital Personal Data Protection Act, 2023 ("DPDP Act").
2. Two roles — an important distinction
RetailDek serves businesses ("Vendors"). Under the DPDP Act we act in two different capacities:
| Data | Our role | What it means |
|---|---|---|
| Your RetailDek account (login name, role, activity records) | Data Fiduciary | We decide how this data is processed and carry the duties for it. |
| Business records a Vendor enters (their customers, suppliers, staff, sales) | Data Processor | The Vendor is the Data Fiduciary of their customers' and employees' data. We process it only on the Vendor's behalf, to run the software — never for our own purposes. |
3. What data the platform holds
- Account data: username, display name, hashed password (never stored in readable form), role, and an audit trail of actions taken in the app.
- Vendor business data (processed on the Vendor's behalf): customer and supplier details (names, phone numbers, addresses, GST numbers), inventory, sales and purchase documents, and staff records — which may include Aadhaar numbers, PAN numbers, and bank details where the Vendor chooses to record them.
- We do not sell, rent, or share any of this data with advertisers or third parties.
4. How data is protected
- Encryption in transit: all connections use HTTPS/TLS.
- Field-level encryption at rest: identity-sensitive staff fields (Aadhaar number, PAN number, bank account number) are stored AES-256 encrypted; even a copy of the database file does not reveal them.
- Encrypted backups: database backups are AES-256 encrypted with a key unique to each Vendor.
- Isolation: every Vendor runs in a separate, isolated instance with its own database — no shared data between businesses.
- Access control: role-based permissions govern every screen and action; passwords are hashed with bcrypt; login attempts are rate-limited; all changes are audit-logged.
5. Where data is stored
Data is stored on secured cloud servers with hardened access (key-only administration, firewalled network, intrusion banning). Backup copies are additionally uploaded — in encrypted form — to a Google Drive account that the Vendor connects and owns.
6. Google Drive integration
- Connecting Google Drive is optional and done by the Vendor with their own Google account through Google's official sign-in.
- We request the narrowest permission Google offers (
drive.file): the app can only see files it created itself — it cannot read your other Drive files, photos, or documents. - We also request your email address solely to display which account is connected.
- RetailDek's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
- You may disconnect at any time from Settings; existing backup files remain in your Drive under your control.
7. Retention and deletion
- Data is retained for as long as the Vendor's subscription is active.
- Vendors can correct or delete individual records (customers, suppliers, staff) inside the application at any time.
- On termination of service, the Vendor may request a complete copy of their data (standard, openly documented formats) and/or its deletion. Encrypted backups are decryptable with a key we hand over to the Vendor — their data is never locked in.
8. Your rights under the DPDP Act
- Access: obtain a summary of the personal data held about you.
- Correction and erasure: have inaccurate data corrected or data no longer required erased.
- Grievance redressal: raise a complaint with our Grievance Officer (below) and receive a response within the statutory timeline.
- Nomination: nominate a person to exercise these rights on your behalf.
If you are a customer or employee of a business that uses RetailDek, please direct requests to that business first — they are the Data Fiduciary of the records they keep about you. We support them in fulfilling such requests.
9. Grievance Officer
Mr. Kumara Swamy · Grievance Officer
DEKCLOUD LLP
Plot#65, Tripura Enclave, Hyderabad, Telangana 502032, India
Email: [email protected] · Phone: +91 703 2255 259
10. Cookies and tracking
The application uses a single, strictly necessary session cookie to keep you signed in. There are no advertising cookies, no third-party trackers, and no analytics that identify you personally.
11. Changes to this policy
We may update this policy as the law or the product evolves. The "Last updated" date above always reflects the current version; material changes will be highlighted inside the application.
12. Governing law
This policy is governed by the laws of India. Courts at Hyderabad, Telangana shall have exclusive jurisdiction.