Privacy Policy

1. Who is responsible

Swastika Systems is responsible for the personal data used to register, provision, secure, bill and support Jhapu accounts. A customer organisation remains responsible for the business records and personal data that its users enter into its Jhapu workspace. We process that customer-controlled data to provide the requested service and according to the customer's authorised instructions.

2. Information we collect

Depending on how you use Jhapu, we may collect:

• Registration and organisation details, including name, work email, mobile number, organisation name and type, address, state, city, PIN code, GSTIN or PAN when supplied, expected users and stated requirements.
• Account and security data, including tenant code, user roles, permissions, authentication records, audit events and security alerts. Passwords are stored as protected password hashes, not as readable passwords.
• Customer content, including accounting and ERP records, module definitions, uploaded files and images, print layouts, reports, automation settings and other information entered by authorised users.
• Commercial records, including plan, subscription dates, tax and invoice details, AI-credit orders, payment status and gateway transaction references. Payment-card or bank credentials are handled by the payment provider and are not stored by Jhapu.
• Usage and technical data, such as IP address, browser, device type, login time, pages and features used, API activity, error logs, storage use and diagnostic information.
• Communications, including support requests, feedback and messages exchanged with us.
• Advertising enquiries, including the contact, company, professional-profile and requirement information you choose to submit through a LinkedIn Lead Gen Form or another Jhapu campaign form.

3. How we use information

We use information to:

• verify registrations and create isolated tenant workspaces;
• operate ERP, Module Builder, reporting, integrations and AI features;
• authenticate users, enforce permissions and protect the service;
• manage plans, usage limits, payments, taxes, invoices and accounting;
• provide support, investigate errors and improve reliability;
• send service, security, billing, inactivity and policy notices; and
• meet legal, tax, fraud-prevention and dispute-resolution obligations.

Where applicable, processing is based on your consent, the steps needed to provide the service you requested, compliance with law, and legitimate security and operational needs permitted by law.

4. Customer responsibilities

If you enter information about employees, customers, vendors, donors or other people, you must have the authority and any required notice or consent to do so. Customer administrators control their users, permissions, modules, integrations, retention choices and the recipients of messages sent from their workspace.

5. AI and customer integrations

When an authorised user invokes an AI feature, the prompt and the minimum relevant context may be sent to the configured AI provider to produce the requested result. Users should not include unnecessary sensitive or confidential personal data in a prompt and should review AI output before using it.

When a customer configures email, SMS, WhatsApp or another external integration, the data needed to perform that action is sent to the selected provider. The customer is responsible for its recipient lists, templates, consents and provider account.

6. When information is shared

We may share the minimum necessary information with:

• cloud hosting, database, storage, backup and email providers;
• payment gateways and financial service providers used at checkout;
• AI or communication providers used for a feature you invoke or configure;
• professional advisers and contractors under confidentiality obligations;
• authorities where disclosure is required by valid law or legal process; or
• a successor in a merger, acquisition or transfer, subject to appropriate notice and protection.

Jhapu does not sell or rent personal data for advertising.

7. Advertising enquiries and LinkedIn Lead Gen Forms

Jhapu may use LinkedIn advertising to invite business users, consultants and potential partners to request information or a demonstration. If you submit a LinkedIn Lead Gen Form, LinkedIn provides the fields you deliberately submit, such as your name, work contact details, organisation, job title and answers about your interest in Jhapu. LinkedIn separately processes data under its own privacy terms.

We use this information to respond to your enquiry, understand your business requirement, arrange a demonstration, discuss a customer or partnership opportunity and measure campaign effectiveness. We do not ask for sensitive personal, financial, government-identification or account-credential data in an advertising form. You may withdraw optional contact consent or ask us to delete an advertising enquiry by emailing privacy@jhapu.com, subject to any record that law requires us to retain.

8. Cookies and similar technology

Jhapu may use cookies or local storage needed for sign-in, security, session continuity and user preferences. We do not use advertising cookies. If we introduce optional analytics or marketing technology, we will update this notice and provide any consent choice required by law.

9. Storage, transfers and security

Information may be processed in India and in other locations where our infrastructure or service providers operate. Where required, we use contractual and technical safeguards for such processing.

We use measures designed to protect data, including tenant isolation, access controls, logging, encrypted transmission, protected credentials and backup procedures. No internet or storage system can be guaranteed to be completely secure, so customers must also protect administrator accounts, passwords and devices.

10. Retention and deletion

Active tenant content is retained while needed to provide the service. Inactive Free workspaces are handled under the Free Usage Policy, including secure archival after the stated inactivity period. Subscription, invoice, tax, security and transaction records may be retained for the period required by law, audit, fraud prevention or dispute resolution.

When data is no longer required, we delete, anonymise or securely isolate it. Residual copies may remain temporarily in protected backups until the normal backup cycle completes. A verified customer may request account or tenant-data deletion, subject to legal retention requirements and the rights of other affected parties.

11. Your choices and rights

Subject to applicable law, you may ask to access, correct, update or erase your personal data, withdraw consent for optional processing, close your account or raise a grievance. We may verify your identity and authority before acting. For data controlled by a customer organisation, requests may need to be directed to that organisation's administrator.

Jhapu intends to handle personal data in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 and the rules brought into force under it.

12. Children

Jhapu is business software and is not intended for anyone under 18 years of age. We do not knowingly invite children to create accounts. If you believe a child has provided personal data directly to us, please contact us so the matter can be reviewed.

13. Changes to this policy

We may update this policy as Jhapu, its providers or applicable law changes. The revised date will appear above. Material changes may also be announced by email or inside Jhapu before they take effect where appropriate.

14. Contact and grievance requests

Swastika Systems
Hatpukur, GIP Colony
Howrah, West Bengal 711112, India

Privacy and grievance email: privacy@jhapu.com