Privacy Policy
This Privacy Policy outlines how Leokraft Technologies Private Limited ("Company", "we", "us") processes personal data collected through rupybooks.com and its associated modules, under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000.
Scope
The Company acts as Data Fiduciary for the personal data of direct account signatories, billing contacts, and website visitors. Where the Customer enters employee data, payroll metrics, client lists, or other end-user data into the Platform, the Customer is the Data Fiduciary for that data, and the Company acts strictly as a Data Processor acting on the Customer's instructions.
Categories of personal data processed
Account and sign-up data: name, official email address, mobile number, job designation, company name, and identifiers such as PAN and GSTIN.
Operational and payroll data, processed on the Customer's behalf where Payroll and the Employee Self-Service (ESS) portal are used: employee names, addresses, PAN, Aadhaar/tax IDs, salary metrics, bank account details, emergency-contact information, and attendance logs.
Technical and telemetry data: IP addresses, browser signatures, login timestamps, device metadata, audit trails, and feature-interaction logs.
Payment data: handled by our PCI-DSS-compliant payment gateway, Razorpay. The Company does not store complete card numbers, CVVs, or banking passwords.
Grounds for processing & purposes
Personal data is processed under valid statutory grounds under the DPDP Act, 2023: the explicit consent given at registration, and legitimate use for legal compliance, contract execution, statutory reporting, and responding to judicial warrants.
Purposes: account activation, authentication, and access provisioning; generating the financial, tax, and payroll reports the Customer requests; transactional alerts, multi-factor authentication codes, and billing notifications; and fraud prevention, cybersecurity, and system-stability audits.
Data processors & sub-processors
We engage vetted service providers under data-processing agreements: Supabase Inc. (database hosting and authentication; encrypted account, tenant and payroll data; primary region AWS Mumbai), Cloudflare Inc. (web security, WAF and CDN; application traffic and IP addresses; global/India), Razorpay Software Private Limited (payment processing; billing metrics and transaction tokens; India), and Resend Inc. (transactional email delivery; email addresses and system notifications; US/global).
Data security, retention & purgation
We implement technical measures including TLS 1.3 encryption in transit, AES-256 encryption at rest, role-based access control, database row-level security, and continuous vulnerability monitoring.
Data is retained during the lifecycle of the active account. After cancellation or expiry, Customer Data remains available for export for sixty (60) days; after that grace period, Customer Data is permanently destroyed or overwritten from production databases within a further thirty (30) days, except for financial transactions retained under statutory rules such as Section 128 of the Companies Act, 2013.
Your rights under the DPDP Act, 2023
Data Principals whose data the Company processes directly as Data Fiduciary may: (a) request access to, and a summary of, personal data being processed and the sub-processors involved; (b) request correction of inaccurate or incomplete data, or erasure, subject to statutory retention limits; (c) withdraw consent at any time, resulting in cessation of the associated service; (d) seek redressal from the Grievance Officer; and (e) nominate an individual to exercise these rights in the event of death or incapacity.
Employees accessing the ESS portal must direct data-erasure or correction requests to their own employer (the Customer, as Data Fiduciary for that data), not to the Company.
Grievance Officer & contact
In compliance with the Information Technology Act, 2000 (Intermediary Guidelines) and the DPDP Act, 2023, the Grievance Officer is: Manish Jaiswal, Grievance & Data Protection Officer, Leokraft Technologies Private Limited, #674, GF, Club Series by Reliable Developer, Nirmala Vidyalaya Road, Gattahalli, Bangalore - 560099. Email: grievance@rupybooks.com or support@rupybooks.com. Grievances are acknowledged within 24 hours and resolved within 15 business days.
If a grievance remains unresolved, the Data Principal may submit a complaint to the Data Protection Board of India.
If we make a meaningful change to this Privacy Policy, we will ask you to accept the new version before you continue.
This Privacy Policy is part of our full Terms & Conditions.