Privacy Policy
Effective 6 September 2026
1.0 Introduction#
1.1 Brook Bytes Technologies, trading as BrookBytes ("we", "us", "our"), is a sole proprietorship carried on by Karthik Govindan, with its principal place of business in Chennai, Tamil Nadu, India. GSTIN 33DPVPG8294F1ZB.
1.2 This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have.
1.3 It is written to comply with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.
1.4 By using our website or our services, you confirm you have read this policy.
2.0 Two different roles — which one applies to you#
This distinction determines who is responsible for your data.
| If you are… | Our role | What it means |
|---|---|---|
| A visitor to our website, or a person who signs up for a BrookBytes account | We are the Data Fiduciary | We decide why and how your data is used. This policy governs it, and you exercise your rights against us. |
| An end-customer of a business that uses BrookBytes — for example, you messaged a company and their agent replied using our platform | We are a Data Processor | That business decides why and how your data is used. They are the Data Fiduciary, not us. Please contact them directly. We will pass on any request we receive. |
2.2 Sections 3 to 8 describe data for which we are the Data Fiduciary. Section 9 explains how we handle data belonging to our customers' end-customers.
3.0 What we collect#
3.1 Information you give us
| Data | When |
|---|---|
| Name and email address | When you create an account or contact us |
| Organisation name | When you create an account |
| Telephone number | Optional, when you provide it |
| Billing name, address and GSTIN | When you purchase a paid plan |
| The content of your messages to us | When you contact support or sales |
3.2 Information collected automatically
| Data | Purpose |
|---|---|
| IP address | Security, abuse prevention, approximate region |
| Browser and device type | Compatibility and troubleshooting |
| Pages visited and actions taken in the product | Improving the service |
| Log and error data | Diagnosing faults |
3.3 We do not collect payment card details. Payments are processed by our payment provider. Your card number never reaches our systems.
3.4 We do not knowingly collect data from children. Under the DPDP Act, processing a child's data requires verifiable parental consent; our services are intended for business use only and are not directed at children.
4.0 Why we use it, and on what basis#
| Purpose | Lawful basis under the DPDP Act |
|---|---|
| Creating and administering your account | Performance of our contract with you |
| Providing the services you have subscribed to | Performance of our contract |
| Taking payment and issuing tax invoices | Contract and legal obligation |
| Sending service and security notices | Legitimate use — you cannot opt out of these while you hold an account |
| Support and troubleshooting | Contract |
| Improving and securing the service | Legitimate use |
| Marketing email about our products | Your consent, which you may withdraw at any time |
| Complying with tax, accounting and legal obligations | Legal obligation |
4.2 We do not sell your personal data. We never have and we will not.
4.3 We do not use your personal data for automated decision-making that produces a legal or similarly significant effect on you.
5.0 Who we share it with#
5.1 We share personal data only with the following, and only as needed:
| Recipient | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, storage, email delivery | India (Mumbai) |
| Supabase | Account authentication | Outside India |
| Razorpay | Payment processing | India |
| Anthropic | AI-assisted features, only where enabled | Outside India |
| Zoho | Business email | India |
| Professional advisers | Accounting, audit, legal | India |
5.2 We may disclose personal data where required by law, by a court, or by a competent authority, and where necessary to protect our rights, our users, or the public.
5.3 If our business is transferred — including on conversion of the proprietorship into a company — personal data may transfer with it. You will be notified before that happens.
6.0 Where your data is held#
6.1 Our primary infrastructure is located in India.
6.2 Certain service providers listed in section 5.1 process data outside India. Where they do, we ensure an appropriate contractual basis is in place.
6.3 We do not transfer personal data to any country to which such transfer is restricted by the Central Government under section 16 of the DPDP Act.
7.0 How long we keep it#
| Data | Retention |
|---|---|
| Account data | For as long as your account is active |
| Account data after closure | 90 days, then deleted |
| Invoices and tax records | 8 years, as required by Indian tax law |
| Support correspondence | 3 years |
| Security and access logs | 12 months |
| Marketing consent records | Until consent is withdrawn, plus 3 years |
7.2 Where we are required by law to keep a record, we keep it for that period only, and continue to protect it.
8.0 Your rights#
8.1 Under the DPDP Act, you have the right to:
- Access — obtain a summary of the personal data we hold about you and how it is processed;
- Correction — have inaccurate or misleading data corrected;
- Completion and updating — have incomplete or out-of-date data completed;
- Erasure — have your data deleted where we no longer need it for the purpose it was collected, unless retention is required by law;
- Nominate — nominate another person to exercise your rights if you die or become incapacitated;
- Grievance redressal — complain to us first, and to the Data Protection Board of India if unsatisfied;
- Withdraw consent — where processing is based on consent, withdraw it at any time, as easily as it was given.
8.2 To exercise a right, contact our Grievance Officer at section 11. We will respond within the period required by law.
8.3 Withdrawing consent does not affect processing carried out before withdrawal, and may mean we can no longer provide part of the service.
9.0 Data belonging to our customers' end-customers#
9.1 Businesses use BrookBytes to talk to their own customers. Those conversations may contain personal data of people who are not our users.
9.2 For that data, we act only as a Data Processor. The business is the Data Fiduciary. We process it only on their instructions, under a Data Processing Agreement.
9.3 If you are one of those individuals, please contact the business you were dealing with. They control the data and can act on your request. If you contact us instead, we will tell you this and inform them without undue delay.
9.4 We do not use that data for our own purposes, and we do not use it to train any AI model made available to other customers.
10.0 How we protect it#
10.1 We apply security measures appropriate to the risk, including encryption in transit and at rest, role-based access on a least-privilege basis, multi-factor authentication on administrative access, a database not reachable from the public internet, audit logging, automated dependency scanning, and regular backups.
10.2 No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board of India as required by law.
10.3 You are responsible for keeping your own password confidential and for enabling multi-factor authentication where offered.
11.0 Grievance Officer#
11.1 The DPDP Act requires us to name a person you can contact.
| Grievance Officer | «Name» |
| Designation | «Designation» |
| «grievance@brookbytes.com» | |
| Postal address | «Registered Address», Chennai, Tamil Nadu, India |
| Response time | Within the period required by law, and in any event without undue delay |
11.2 If you are not satisfied with our response, you may complain to the Data Protection Board of India.
12.0 Cookies and similar technologies#
12.1 We use cookies that are strictly necessary to sign you in and keep your session secure. These cannot be disabled without preventing the service from working.
12.2 We use limited analytics to understand how the product is used. Where consent is required for a cookie, we ask for it before setting it.
12.3 You can control cookies through your browser settings. Blocking necessary cookies will prevent you from signing in.
13.0 Changes to this policy#
13.1 We may update this policy. The version number and effective date at the top of this document always show the current version.
13.2 Where a change materially affects your rights, we will notify you directly — by email or in the product — before it takes effect. We will not rely on a silent update to a web page.
14.0 Contact#
For any question about this policy or your personal data, contact the Grievance Officer named in section 11.
Other policies
Brook Bytes Technologies, trading as BrookBytes. A sole proprietorship registered in Chennai, Tamil Nadu, India. GSTIN 33DPVPG8294F1ZB.