Privacy Policy

This Privacy Policy describes how ElasticServe (“we,” “our,” or “us”), the operator of the Stockrect platform, collects, uses, discloses, and safeguards your information when you visit our website www.stockrect.com or use the Stockrect platform and services (collectively, the “Services”).

By using the Services, you consent to the practices described in this Privacy Policy. If you do not agree with the practices described here, please do not use the Services.

ElasticServe is a company incorporated in India under the Companies Act- 2013 (18 of 2013), having its primary place of business at 1103, Titanium One, S.G. Highway, Near Pakwan Cross Road, Bodakdev, Ahmedabad 380054, Gujarat, India.

3.1 Personal Information

When you sign up for our Services or communicate with us, we may collect the following personal information about you:

• Full name and job title
• Business email address
• Phone number
• Company name and GSTIN
• Business address
• Payment information (processed by third-party payment processors)

3.2 Business and Transactional Data

When you use the Services to operate your business, we process business and transactional data on your behalf, including:

• Customer master records
• Vendor master records
• SKU catalog and inventory data
• Sales orders, purchase orders, and related transactions
• Financial data related to your operations
• GST-related documents (invoices, e-way bills, returns)

You retain full ownership of this business data. Under the Digital Personal Data Protection Act 2023 you are the Data Fiduciary for it and we act as your Data Processor: we process it only on your documented instructions, do not use it for our own benefit, apply reasonable technical and organizational safeguards, and limit access to authorized personnel on a need-to-know basis.

3.3 Technical Information

When you access the Services, we automatically collect certain technical information:

• IP address and general location
• Browser type and version
• Device type and operating system
• Access times and usage patterns
• Referring website or application

3.4 Cookies and Similar Technologies

We use cookies and similar technologies to operate the Services, remember your preferences, and improve your experience. See our Cookie Policy for detailed information about the specific cookies we use.

We use the collected information for the following purposes:

• To provide, maintain, and improve the Services
• To process your account registration and manage your subscription
• To communicate with you about your account, Services, and support requests
• To send you administrative information such as updates to our terms and policies
• To send you marketing communications (with your consent, where required)
• To detect, prevent, and address security or technical issues
• To comply with applicable laws, regulations, and legal processes
• To enforce our terms and protect our rights
• To produce anonymized or aggregated statistics for security monitoring, analytics, performance optimization and statistical purposes, with no personal data or identifying attributes revealed

Under the Digital Personal Data Protection Act 2023, we process your personal data based on:

• Your consent, where you have provided it (e.g., for marketing communications)
• Performance of the contract between you and us (to provide the Services you have subscribed to)
• Compliance with legal obligations (e.g., tax records, GST filings)
• Legitimate interests (such as improving the Services, preventing fraud, and ensuring security), balanced against your privacy rights

We do NOT sell your personal information to third parties. We may share your information with:

6.1 Service Providers

We share information with trusted third-party service providers who help us operate the Services, including:

• Cloud infrastructure providers (for hosting)
• GST Suvidha Providers (GSPs) for e-invoicing and e-way bill generation
• Payment processors for subscription billing
• Communication providers (email, SMS, WhatsApp)
• Analytics providers to help us understand Service usage

All service providers are bound by contractual obligations to maintain the confidentiality and security of your information.

6.2 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request, including in response to court orders, subpoenas, or requests from law enforcement or regulatory authorities.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice before your information becomes subject to a different privacy policy.

We retain your information for as long as necessary to provide the Services and fulfill the purposes outlined in this Privacy Policy, and as required by applicable laws (including GST record-keeping requirements which mandate specific retention periods).

Our standard retention periods are:

• Active account data — retained for the duration of your subscription. On Cloud SaaS you may request an export of your data in a standard readable format (CSV, Excel or SQL dump) within fifteen (15) days of termination; after that period we may permanently delete it unless retention is required by law.
• Backups — where we host the Services, database backups are taken daily (incremental) and weekly (full) and retained for a minimum of 7 to 30 days depending on the hosting configuration, stored in encrypted form.
• Financial and tax records — invoices, payment records and GST filings are retained for the period required by applicable Indian tax and company law.
• On-premise and customer-hosted deployments — your data resides entirely on infrastructure you control; retention and deletion are governed by your own policies.

We implement reasonable technical and organizational security measures to protect your information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data at rest using industry-standard encryption
• Encryption of data in transit using TLS 1.3 or higher
• Access controls with role-based permissions
• Regular security assessments and monitoring
• Backup and disaster recovery procedures
• Employee training on data protection

If personal data we process on your behalf is subject to unauthorized access, disclosure, alteration, loss or compromise, we will notify you without undue delay and in any case within seventy-two (72) hours of becoming aware of it, provide all reasonable details available, and cooperate in any required remedial, forensic, legal or regulatory action. As Data Fiduciary you remain responsible for regulatory reporting to the Data Protection Board of India and for notifying affected data principals.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

As a data principal (data subject) under the Digital Personal Data Protection Act 2023, you have the following rights:

9.1 Right to Access

You have the right to request confirmation of whether we are processing your personal data and access to that data.

9.2 Right to Correction

You have the right to request correction of inaccurate or incomplete personal data.

9.3 Right to Erasure

You have the right to request erasure of your personal data, subject to legal retention requirements.

9.4 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used format.

9.5 Right to Grievance

You have the right to file a grievance with our data protection contact or with the Data Protection Board of India.

9.6 Exercising Your Rights

To exercise any of these rights, please contact us at support@stockrect.com. We will respond to your request within the timelines prescribed by applicable law. Where your request concerns business data that we process on behalf of one of our customers, we will promptly refer it to that customer and respond only on their written instruction.

The Services are primarily hosted in Indian data centers. However, some of our service providers may process data outside India. Where personal data is transferred outside India, we ensure appropriate safeguards are in place in compliance with applicable data protection laws.

Customer data on Cloud SaaS is processed and stored in data centers located in India. Backups are stored in encrypted form on cloud storage within India or in other compliant geographical regions. Certain third-party services that the platform relies on — SMS and WhatsApp gateways, email delivery services, cloud platforms and payment or API providers — may process limited data such as phone numbers, email addresses and message content on their own infrastructure. Any such provider is bound by contractual safeguards no less protective than this Privacy Policy and by applicable Indian data protection law.

The Services are intended for business use by adults. We do not knowingly collect personal information from children under 18 years of age. If we become aware that a child has provided us with personal information, we will take steps to delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated Privacy Policy on our website and updating the “Effective Date” at the top.

Your continued use of the Services after any changes to this Privacy Policy will constitute your acceptance of the changes.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: