Scope and controller
This notice applies to the Agnicode company website, customer platform, public forms, support channels, and product transactions that link to it. Agnicode Technologies Private Limited is the controller or data fiduciary for the processing described here.
A linked product, employer-managed workspace, payment provider, or external service may be independently responsible for some processing and provide an additional notice. Organization administrators also control account membership, roles, and workspace content.
This notice is published in English. If you would prefer a copy in another language listed in the Eighth Schedule to the Constitution of India, ask the Privacy and Grievance Desk at grievance.officer@agnicodetechnologies.com and we will provide one.
Personal data we collect, and why
Each category below is collected for the purpose written beside it and for nothing else. The legal basis for each purpose is in the next section.
| Category | What it includes | Why we collect it |
|---|---|---|
| Identity and account | Name, email, authentication identifiers, account preferences, security settings, and session state. | To create and secure your account, sign you in, and keep your settings. |
| Mobile numbers and messaging | A mobile or WhatsApp number you add, the one-time verification code sent to it, whether it was verified, and delivery receipts for the SMS, WhatsApp, and email messages we send. | To verify that the number is yours and to deliver the account, billing, and security messages you have chosen to receive. Delivery is through MSG91 in India. |
| Organization and entitlement | Workspace, role, invitation, license, subscription, and product-access records. | To give you and your organization the products and access levels you have bought or been granted. |
| Transaction | Billing contact, business address, tax-related fields, order, invoice, payment status, credit balance, and refunds. The payment provider handles card and bank credentials under its own terms; we never see them. | To bill and invoice you, keep the accounting and tax records the law requires, and handle refunds and disputes. |
| Communications | Contact forms, support tickets, feedback, satisfaction responses, privacy requests, and correspondence. | To answer you, resolve support and privacy requests, and keep a record of what was asked and answered. |
| Device and operations | IP-derived security and rate-limit signals, request IDs, browser and device information, logs, performance measures, error categories, abuse indicators, and Cloudflare Turnstile challenge results on public forms. | To keep the service secure, stop abuse, investigate faults, and meet incident-reporting duties. |
| Anonymous audience measurement | Aggregate counts of page views, main call-to-action clicks, and scroll depth, with the referring website's name, a broad device type, and country. No cookie, identifier, or IP address is used. | To know which public pages are useful. Decline or Global Privacy Control switches it off. |
| Optional analytics | With your permission only: Google Analytics (visits, sessions, pages viewed, clicks, scroll depth, time spent) and Grafana Faro request tracing, page performance, and security-policy violation reports. | To understand how the site and product are used. |
| Error reporting | When a page breaks, the error type, the page path with identifiers removed, and the browser's name and version, grouped under a random id held only in that page's memory. Nothing is stored on your device. | To find and fix faults. It holds no account or location data and does not depend on your analytics choice. |
Where data comes from
We receive data directly from you; from an organization administrator who invites or manages you; automatically from your device and service use; and from configured identity, commerce, CRM, support, messaging, and product providers. We may also receive transaction confirmations and fraud or security signals from providers involved in a requested transaction.
Purposes and legal bases
| Purpose | Legal basis where required |
|---|---|
| Provide accounts, products, licenses, billing, and support | Contract performance and steps you request before contract |
| Verify a mobile number and deliver account, billing, and security messages by email, SMS, or WhatsApp | Contract performance for the messages the service needs; your choice, changeable at any time, for the channels and optional messages you turn on |
| Authenticate users, authorize tenants, prevent abuse, and secure services | Legitimate interests, contract, and legal obligations |
| Maintain invoices, tax, accounting, complaint, and audit records | Legal obligations and legitimate interests |
| Answer inquiries and requested pre-contract questions | Requested pre-contract steps and legitimate interests |
| Anonymous audience measurement (aggregate totals) | Legitimate interests, with no identifiers and an opt-out |
| Optional analytics (Google Analytics, Grafana Faro tracing) | Consent |
| Browser error reporting (Grafana Faro) | Legitimate interests, balanced against user rights: errors only, with no identifier stored on your device |
| Improve reliability, usability, and product operations | Legitimate interests, balanced against user rights |
Service providers and disclosure
We use the providers below. Each receives only the data needed for its role and is bound by its contract with us and by applicable law. The region is where that provider stores our data.
| Provider | What it does for us | Region |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, databases, storage, backups, and operational logs. | India (Mumbai, ap-south-1) |
| Amazon Cognito | Sign-in, passwords, passkeys, and multi-factor codes. | India (Mumbai, ap-south-1) |
| Amazon CloudFront | Serves profile and organization images from a content delivery network. | Stored in India; served from edge locations in Asia, Europe, the Middle East, and Africa |
| Zoho Billing, Zoho Desk, and Zoho CRM | Invoicing and subscriptions, support tickets, and leads. | India (zoho.in datacentre) |
| Razorpay | Card, UPI, and bank payments through the Zoho Billing hosted checkout. Razorpay, not Agnicode, holds your payment credentials. | India |
| MSG91 | Delivers our email, SMS, and WhatsApp messages. | India |
| Grafana Cloud (Grafana Labs) | Server logs and traces, browser error reporting, and, with your consent, browser tracing. | India (Mumbai, ap-south-1 stack). Grafana Labs is a United States company. |
| Cloudflare | Turnstile bot check on public forms, which receives the visitor's IP address; content delivery and TLS termination for the website. | Global network |
| Google Analytics | Optional site analytics, only after you allow it. | Global (Google may process outside India) |
We may also share data with professional advisers under confidentiality, and may disclose data to an organization administrator; to comply with law or lawful process; to protect users, rights, and services; or in a merger, financing, reorganization, or sale with appropriate safeguards. We do not sell personal information, and this site does not use cross-context behavioural advertising.
International transfers
Agnicode operates from India, and our primary systems, Cognito, Zoho, Razorpay, and MSG91 store data in India. Three providers are outside India or global:
- Grafana Labs is a United States company; our Grafana Cloud stack and its data are in Mumbai, but Grafana Labs staff may access it for support from other countries.
- Cloudflare and Google run global networks and may process the limited data they receive (the Turnstile check, TLS traffic, and consented analytics) outside India.
- Amazon CloudFront caches profile and organization images at edge locations in Asia, Europe, the Middle East, and Africa so they load quickly where they are viewed.
Where transfer rules apply, we rely on an available lawful mechanism such as adequacy, the provider's data-processing terms and standard contractual clauses, or another permitted safeguard. Contact us for information about the safeguards relevant to your data.
How long we keep it
We keep data for the shortest period the account, transaction, security, support, or legal purpose needs. These are the periods we have set:
| Record | How long | Why |
|---|---|---|
| Profile, preferences, and organization membership | Until you delete your account | Scrubbed when the account is deleted; the rows below survive that deletion. |
| Privacy requests and their correspondence | 3 years (a nomination stays for the life of the account) | Evidence that a right was exercised and answered. |
| Consent records and notification-preference change history | 3 years after account deletion | Proof of what was consented to, or switched off, and when. |
| Notification events and delivery receipts | 90 days (in-app notifications 30 days) | Diagnose delivery problems and abuse. |
| Workspace invitations | Until accepted, revoked, or 7 days after they expire | Let the invitee join; then nothing to keep. |
| Business inquiries from the public contact form | 90 days | Answer the inquiry; follow-up only with separate consent. |
| Administrative audit trail | 3 years | Who changed what on an account or organization. |
| Support tickets and their conversations | 3 years, then anonymised. Deleting your account anonymises your support contact at once | Answer the request and keep a record of what was asked and done. |
| Organization activity log: changes to a workspace, its members, billing and licenses, and who made them | 1 year | Let a workspace's owners and admins see what changed, and who changed it; each member sees only what their role allows. |
| Financial records: invoices, payments, credit notes, and credit wallet history | 8 years from the end of the financial year, and the same period after an account or workspace is deleted | Books of account under section 128 of the Companies Act, 2013 and GST record-keeping rules. |
| Backups | 35 days | Disaster recovery. Production backups are locked and cannot be altered; deleted data leaves them within this period. |
| Application, security, and media access logs | 1 year | Security monitoring and the 180-day log duty under the CERT-In directions. |
| Platform event archive | 1 year | Recovery and fraud investigation. |
| Superseded profile and organization images | 30 days | Undo a mistaken upload, then removed. |
Account deletion removes your profile immediately, deletes your personal workspace with it, and ends your sign-in. It does not remove records we must keep for billing, tax, audit, disputes, or security, which stay for the periods above and are then deleted or de-identified. AI credits and the unused part of a paid plan are lost with the account, as the refund and cancellation policy explains.
Withdrawing consent
You can withdraw the consent you gave at sign-in from Privacy requests in your account, with one click. Withdrawing is as easy as giving. It does not affect processing already done.
What changes when you withdraw: optional analytics stop, and any processing that rested only on your consent stops. What continues: processing we do to provide the service you have contracted for, to keep the records the law requires, and to secure the platform, which rests on those grounds rather than on consent. If you want that to stop too, delete your account.
Because the account cannot operate without the notice having been accepted, you will be asked to read and accept it again the next time you sign in.
Security
We use organizational and technical controls including server-held sessions, tenant authorization, constrained browser APIs, encryption in transit and at rest, input validation, rate limits, logging, locked backups, and security testing. No system is absolutely secure. Report a suspected vulnerability through our private security channel without including credentials or other secrets.
Your rights and choices
Depending on the law that applies to you, you may access, correct, update, erase, restrict, or object to processing; withdraw consent; receive a portable copy; nominate another person to exercise your rights if you die or become incapacitated; and complain. Rights may be limited by exemptions and other legal duties. We verify requests proportionately and do not discriminate for exercising a privacy right.
Signed-in users can do all of this from Privacy requests, including downloading a copy of their data. Anyone can use Privacy choices to make a request by email or change the optional analytics permission. California residents can also use that channel for applicable consumer requests. We treat Global Privacy Control as a decline for optional analytics; browser “Do Not Track” signals are not otherwise standardized for this service.
Automated decisions
Agnicode does not use the processing described in this notice to make a decision based solely on automated processing that produces legal or similarly significant effects about a user.
Children
The company site and customer platform are intended for business users aged 18 or older and are not directed to children. We do not knowingly ask a child who cannot lawfully provide data or consent to create an account or submit a business inquiry. Contact us if you believe a child provided data.
Complaints
Raise a concern with our Grievance Officer first: Vishal Srivastava, Director and Grievance Officer, at grievance.officer@agnicodetechnologies.com or +91-9211426296, or by post to the registered office below. The grievance process sets out what to include and how long we take: we acknowledge within 48 hours and answer a verified privacy request within 30 days.
If you are not satisfied with our answer, or we do not answer in time, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023. Residents of the European Union, the United Kingdom, or California may instead complain to their own data-protection authority.
Changes
We update this notice when processing or legal requirements materially change and show the current effective date above (currently October 15, 2026). Your consent is recorded against that revision. When the revision changes, you will be asked to read and accept the new notice the next time you sign in; material changes may also be announced in-product or by email.
Questions can be sent to the Privacy and Grievance Desk at grievance.officer@agnicodetechnologies.com.