This policy explains what personal information BusinessGrrix collects, why, who else handles it, how long we keep it, and the rights you have under Indian law.
Who we are
BusinessGrrix (“we”, “us”) is run by Deepa Katkar, Chandrapur, Maharashtra, India.
We offer two services, and this policy covers both, plus this website:
- the BusinessGrrix App at app.businessgrrix.com, software that studios use to run their projects, clients, bills and team;
- Website Creation, where we build and look after websites for businesses.
We handle personal information in line with the Information Technology Act, 2000 and its Reasonable Security Practices and Sensitive Personal Data or Information Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act) as its provisions come into force.
Words we use
- Personal information: anything that can identify a person, on its own or with other information, such as a name, phone number or email.
- Sensitive personal information: the kinds the law protects more strictly. In our services that means passwords and financial information: bank and UPI details printed on bills, and payment records and screenshots. We do not collect health, biometric or similar data.
- Studio: a business that uses the BusinessGrrix App, with its owner, team members and the clients it invites.
Whose data, and who decides
Your own details. When you contact us, book a demo, or open a studio account, we decide why and how your information is used. For this information we are responsible as the Data Fiduciary.
Your studio’s clients. Studios put details of their own clients, projects and payments into the app. That data belongs to the studio. The studio decides what to store and is responsible to its clients for it; we store and process it only to run the app for the studio. If you are a studio’s client and have a question about your data, ask the studio first; we will help the studio answer it.
Visitors to websites we build. A website we build for a business belongs to that business. Its owner decides what the site collects and needs its own privacy policy.
What we collect
On this website
- Book a demo: your name, business name, industry, city, phone (WhatsApp), email, team size, preferred date and time, and your message.
- Website enquiry: your name, business name, type of business, city, phone (WhatsApp), and if you give them, your email, the website type you want, your domain and your message.
- Spam check: Cloudflare Turnstile looks at technical signals from your browser to tell people from bots.
- Visits: Cloudflare Web Analytics counts page views without cookies and without identifying you.
In the BusinessGrrix App
- Account details of the studio’s owner and team: name, email, phone and role.
- Sign-in: passwords are stored only in scrambled (hashed) form; we can never read them. If you sign in with Google, we receive only your email address, to match it to your account.
- Security log: when someone signs in, we record the time and network (IP) address, to protect accounts, for example to block repeated wrong passwords.
- Studio details: business name, address, logo, GSTIN, PAN, UPI ID and bank details the studio chooses to print on its bills.
- The studio’s work: clients, projects or events, quotations, bills, payments, costs, files and photos the studio uploads.
- Subscription payments: the plan, amounts, dates, the UPI transaction ID if given, and the payment screenshot you upload. Screenshots are kept in private storage that only you and our admin can open.
- Error reports: when something breaks, the report we receive carries a numeric user ID, never names, emails, phone numbers or IP addresses.
When we build your website
- Your business details and the content you send us (text, photos, prices, logos), and the access you give us to your domain, Cloudflare and, for shops, your Razorpay account.
Technical logs
- Our hosting providers keep short-lived technical logs, such as IP address, browser type and the pages requested, to run the service and protect it from attacks.
We collect only what these purposes need.
Why we use it
| Purpose | Basis |
|---|---|
| Replying to your enquiry and arranging your demo | Your request, made by sending the form |
| Running the app for your studio: accounts, your data, the emails and PDFs you send from it | Our agreement with you (the Terms of Service) |
| Verifying payments, sending receipts and renewal reminders | Our agreement with you |
| Building, publishing and looking after your website | Our website agreement with you |
| Keeping the service secure and preventing fraud, such as reused payment proofs | A legitimate need to protect you and us |
| Accounting and tax records | The law |
| News about our products and offers | Only with your consent (see below) |
Consent and your choices
- You give consent by sending a form on this website, by accepting our terms when your studio account is created, or by signing a website agreement.
- We send account emails you need, such as invitations, receipts and renewal reminders. We send news or offers only if you agree, and every such message lets you stop them.
- You can withdraw consent at any time by emailing us (see the contact section). Withdrawing does not undo what was done before, and if you withdraw consent we need to run the app, we may no longer be able to provide it.
What we never do
- We do not sell personal information.
- We do not use it for advertising, and we do not look at a studio’s data except to support that studio, when it asks.
- One studio can never see another studio’s data.
Who else handles it
We use a few service providers. They process information only on our behalf, under their own terms that require them to keep it secure:
- Cloudflare: hosts this website and the app’s screens, stores files and photos, checks forms for spam, keeps copies of form submissions, counts visits.
- Render: hosts the app’s server and database.
- Brevo: sends emails (form notifications to us, and the app’s invitations, bills, receipts and reminders).
- Google: only if you choose to sign in with Google.
- Sentry: receives error reports, without personal details (see above).
- WhatsApp: when a studio chooses to share a bill or reminder with its client on WhatsApp.
We share information beyond these providers only:
- when the law requires it, such as a valid written request from a court or government authority, and only what that request needs;
- if our business is sold or merged, in which case your information moves with it under this policy, and we tell you before that happens;
- with your permission, for anything else.
Data stored outside India
Some of our providers store data on servers outside India. We use only established providers that protect it with security comparable to what Indian law requires. Information always travels encrypted, and our hosting providers store files and databases encrypted. We will follow any restriction the Government of India places on transfers to particular countries.
How long we keep it
- Demo bookings and enquiries: as long as needed to follow up, and no longer than 2 years.
- Studio data: for as long as the studio has an account. When a subscription ends, the studio stays read-only so it can still view its records and download its bills, quotations and reports. If the owner asks us to close the account, we delete the studio’s data within 90 days, except records we must keep by law.
- Payment records and receipts: as long as Indian tax and accounting law requires.
- Security sign-in logs and technical logs: only as long as needed to protect accounts and the service.
When information is no longer needed, we delete it or make it anonymous.
Your rights
You can ask us to:
- tell you what personal information we hold about you and how we use it;
- correct or complete information that is wrong or out of date;
- erase your information, except records we must keep by law;
- withdraw a consent you gave us;
- name someone to act for you if you cannot;
- complain to our Grievance Officer.
A studio owner can correct most details directly in the app, and can download its bills, quotations and reports at any time. We answer every request within 30 days.
How we protect it
- Every connection to this website and the app is encrypted (HTTPS).
- Each studio’s data is kept apart in the database, and we test that one studio cannot reach another’s.
- Team members see only what their role allows; a studio’s clients see only their own records.
- Passwords are never stored in readable form, and repeated wrong sign-ins are blocked.
- Payment screenshots are kept in private storage with no public link.
- Error reports and logs are cleaned of personal details before they leave our server.
- If a security incident affects your information, we will tell you and report it to the authorities as Indian law requires.
Links to other sites
Our website and app link to other services, such as WhatsApp, Google Maps and Google sign-in. Their own privacy policies apply there; we do not control them.
Children
Our services are for businesses and not meant for anyone under 18. We do not knowingly collect their information; if we learn we have, we delete it.
Grievance Officer and contact
For any privacy question, request or complaint, write to our Grievance Officer:
- Name: Vaibhav Katkar, CTO
- Email: admin@businessgrrix.com
- Address: Chandrapur, Maharashtra
We acknowledge complaints within 2 working days and resolve them within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
Changes to this policy
If we change how we handle personal information, we will update this page and the date at the top. For important changes, studio owners get an email at least 7 days before they apply. See also our Terms of Service.