Privacy Policy

1. What we collect and why

• Account — email, name, password hash: to operate your account.
• Billing — plans, invoices, credit balance, payment references: to bill you. Card/UPI details go to Stripe/Razorpay; we never store them.
• Support — tickets and messages: to help you.
• KYC — name, date of birth, Aadhaar (last-4 shown, full number encrypted), PAN (encrypted), ID/address photos (encrypted): to verify identity before paid use. Required by us to prevent fraud.
• Usage — server CPU/RAM/network metrics: to display in your dashboard.

We do not read the contents of your virtual machines.

2. Your consent

At registration — or at first login, if your account was created for you — you consent to Account, Billing, Support and KYC processing under this notice version. Marketing emails are strictly opt-in and can be withdrawn anytime from Account → Privacy, where withdrawing is as easy as opting in — and we stop processing for a purpose once its consent is withdrawn. If this notice changes, we will ask you to review and accept it again before continuing to use the service. Complaints you cannot resolve with our Grievance Officer (section 6) may be taken to the Data Protection Board of India.

3. Your rights

Under the DPDP Act you may request access to your data, correction, erasure, nomination, and grievance redressal — free from the Privacy & Data Rights page. We acknowledge requests within 24 hours and resolve them within 7 days (provisional DPDP Rules alignment — these windows are shown on every request you file). Erasure deletes your account and personal data once servers are terminated and invoices settled; invoices and security audit entries are retained as required by law, detached from your identity.

4. Data retention

Account data lives while your account is active. Consent withdrawals are honoured immediately (marketing) or via erasure (required purposes). KYC documents are deleted with your account.

5. Security & breaches

Passwords are Argon2id-hashed; KYC documents, SSH keys and secrets are encrypted at rest; access is logged. If a personal-data breach occurs we notify the Data Protection Board and affected users within 72 hours.

6. Grievance Officer

For privacy questions or complaints, contact the Grievance Officer through Support (category: Privacy) or file a grievance directly from Account → Privacy. Unresolved grievances may be taken to the Data Protection Board of India.

7. Cross-border processing

Your data may be processed outside India by our service partners — payment processors (Stripe, Razorpay) and the email provider that delivers transactional mail. By using SelfTech Cloud you consent to these transfers, limited to what each partner needs to perform its function; we never sell your data.