Privacy Policy

Prodaxis (also referred to as “we”, “us”, “our”) is a sole-proprietorship technology services company registered as a Micro Enterprise under the Udyam (MSME) Development Act.

This privacy policy applies to the website prodaxis.in, our admin panel, our client portal, and all email/WhatsApp/SMS communications between you and Prodaxis.

Information you give us directly:

• Name, email address, phone number, company name — when you fill out our contact form, request an estimate, or are added as a client
• Project requirements and specifications you share during discussions
• Payment details — processed by Razorpay (we never see or store your card / UPI / bank credentials)
• Files and documents you upload to your client portal

Information collected automatically:

• Browser type, operating system, IP address, time of visit
• Pages visited and links clicked on prodaxis.in (basic analytics)
• Login activity and session timestamps in the client portal
• Email open / click events for emails we send you

We do NOT collect: Aadhaar number, full bank account number, PAN images, biometric data, or any sensitive personal information unless explicitly required for a specific contract and shared by you in writing.

We use your information only for the following purposes:

• To deliver the services you have engaged us for
• To send project updates, invoices, payment confirmations, and operational emails
• To verify your identity at login (via email OTP)
• To respond to enquiries, support requests, and feedback
• To improve our website and services (aggregated analytics, never personally identifiable)
• To comply with applicable Indian laws, including tax (GST), accounting, and consumer protection regulations

We will never sell your personal information to third parties. We will not use your project content (designs, code, documents) for marketing without your explicit written permission.

We share strictly limited data with trusted infrastructure partners required to operate Prodaxis:

• Supabase — database hosting (your account info, projects, invoices)
• Razorpay — payment processing (PCI-DSS compliant; they handle card data)
• Vercel / Netlify — website and application hosting
• Google (Gmail SMTP) — transactional email delivery
• WhatsApp / Meta — only when you explicitly opt in to WhatsApp notifications

Each of these sub-processors is bound by their own privacy and security policies. We do not authorise them to use your data for any purpose other than providing services to Prodaxis.

We may disclose information if compelled by a valid legal order from an Indian court or law-enforcement authority.

• All data in transit is encrypted using TLS / HTTPS (256-bit SSL)
• Passwords are hashed with bcrypt (12 rounds); we never store plaintext passwords
• Client logins use email-based OTP — no permanent password to leak
• Admin login is protected by password + email OTP two-factor authentication
• Database access is restricted via Supabase Row-Level Security policies
• Payment signatures are verified using HMAC-SHA256 with Razorpay keys stored only on our server
• We follow least-privilege access — only the founder has admin database access

You have the following rights over your personal data:

• Right of access — request a copy of all personal data we hold about you
• Right to correction — ask us to fix any inaccurate information
• Right to deletion — request that we erase your data (subject to legal/contractual retention requirements)
• Right to withdraw consent — for marketing emails, WhatsApp messages, or any optional communication, anytime
• Right to data portability — receive your data in a machine-readable format
• Right to grievance redressal — under India's IT Rules 2011 and the Digital Personal Data Protection Act, 2023

To exercise any right, email hello@prodaxis.in. We will respond within 30 days.

• Active client accounts: as long as the engagement is active
• Project deliverables & invoices: retained for 7 years to comply with Indian tax / accounting law
• Email logs: 12 months
• Login / OTP tokens: deleted within 24 hours of last use or expiry
• Contact form / lead enquiries: 24 months unless the lead converts to a client

After the retention period ends, data is securely deleted or anonymised.

We use only essential cookies needed for the website and portal to function:

• prodaxis_token — httpOnly authentication cookie (7-day expiry) for client and admin sessions
• No third-party advertising cookies
• No cross-site tracking

If we add analytics in the future (e.g. privacy-friendly Plausible), we will update this policy and clearly disclose it.

Prodaxis services are intended for businesses and adults aged 18+. We do not knowingly collect data from children under 18. If you believe a minor has shared personal data with us, please email hello@prodaxis.in and we will delete it.

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be communicated via email to active clients. Continued use of the site after changes constitutes acceptance of the revised policy.

For any privacy-related questions, complaints, or to exercise your rights:

• Email: hello@prodaxis.in
• WhatsApp: +91 83281 81362
• Postal Address: D.No: 75/26-4-1, Vijaya Durga Colony Road, Near Durgamma Temple, Kadapa, YSR District, Andhra Pradesh — 516003, India
• GSTIN: 37CAXPT6502R1ZG

The founder of Prodaxis acts as the Grievance Officer under India's IT Rules. Complaints will be acknowledged within 48 hours and resolved within 30 days.