1. Who we are
Cayanide Labs sells ready-to-deploy business systems, deployment services, managed maintenance plans and NAS hardware, operating from India and serving customers primarily in India.
For the purposes of the Digital Personal Data Protection Act, 2023, Cayanide Labs is the Data Fiduciary for the personal data described in this policy. In other words, we decide what is collected and why, and we are accountable for it.
2. What we collect
You give us directly
- Account details: name, email address, mobile number and password (stored only as a salted hash, never in a readable form)
- Order details: billing and shipping address, and GSTIN if you supply one for a tax invoice
- Enquiries: anything you type into our contact form, along with your name and email
- Deployment details: where you ask us to deploy on your behalf, the domain names and configuration you provide
We collect automatically
- Technical data: IP address, browser and device type, and pages visited
- Session data: cookies needed to keep you signed in and to hold your cart
- Download records: which template releases you downloaded and when, used to enforce licence terms
3. Why we use it
We use your data only for these purposes:
| Purpose | Data used |
|---|---|
| Fulfilling your order | Name, email, address, order details |
| Issuing GST-compliant invoices | Billing address, GSTIN |
| Delivering digital licences | Email, entitlement and download records |
| Managing subscriptions | Email, plan and billing status |
| Answering your enquiries | Name, email, message content |
| Preventing fraud and abuse | IP address, device type, submission timing |
| Meeting legal and tax obligations | Invoice and transaction records |
We do not sell your personal data, and we do not share it with advertisers or data brokers.
4. Payment information
Payments are processed by Razorpay, an RBI-authorised payment aggregator. When you pay, your card, UPI or banking details are collected by Razorpay directly.
We receive only a payment identifier, the amount, the status, and the last four digits and card network where applicable. That is enough to reconcile your order and process a refund, and nothing more. We could not charge your card again on our own if we wanted to.
For Cayanide Care subscriptions, the recurring mandate is held by Razorpay under the authorisation you give at signup. Cancelling through your account revokes it.
5. Who we share it with
We share data only with processors who need it to run the service:
| Processor | What they receive | Why |
|---|---|---|
| Razorpay | Payment and billing details | Processing payments and refunds |
| Google Workspace | Email address and message content | Sending and receiving email |
| Amazon Web Services | All application data | Hosting the site and database |
| Shipping partners | Name, address, phone | Delivering hardware orders only |
We may also disclose data where we are legally required to, for example in response to a valid order from a court or authority. If that happens we will tell you unless we are legally barred from doing so.
6. Cookies
We use a small number of cookies, all functional:
- Session cookies keep you signed in as you move between pages
- CSRF token cookies protect forms from cross-site request forgery
- Cart cookies remember what you have added before you sign in
We do not use advertising or cross-site tracking cookies. You can block cookies in your browser, but sign-in and checkout will not work without the functional ones.
7. How long we keep it
| Data | Retention |
|---|---|
| Account details | Until you delete your account |
| Invoices and tax records | 8 years, as required by Indian tax law |
| Enquiries and correspondence | 3 years after the enquiry is closed |
| Licence and download records | For the life of the licence |
| Server and access logs | 90 days |
When you delete your account we remove your personal data, but we must keep invoices for the statutory period above. Those retained records are locked down and used only for tax and audit purposes.
8. How we protect it
- All traffic is encrypted in transit with TLS
- Passwords are stored as salted hashes and cannot be recovered, only reset
- Administrative access is restricted by role and requires separate authentication
- Download links for digital products are signed and short-lived rather than permanent
- Databases are backed up regularly and backups are encrypted
No system is perfectly secure. If a breach affects your personal data we will notify you and the Data Protection Board of India as required by the DPDP Act.
9. Your rights
Under the DPDP Act, 2023 you have the right to:
- Access a summary of the personal data we hold about you and what we do with it
- Correct anything inaccurate, incomplete or out of date
- Erase your data where we no longer need it for the purpose it was collected or to meet a legal obligation
- Withdraw consent at any time, where processing is based on consent
- Nominate another person to exercise these rights if you die or become incapacitated
- Complain to the Data Protection Board of India
To exercise any of these, email cayanidelabs@gmail.com or raise a request through the contact form. We respond within 30 days. We do not charge for this and we will not make the service worse for you because you asked.
10. Children
Our services are not directed at children under 18, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
We may update this policy as the service changes. The "last updated" date at the top always reflects the current version. If a change materially affects how we use your data, we will email registered customers rather than relying on you to notice.
12. Contact us
For any privacy question, request, or complaint, reach our Grievance Officer at cayanidelabs@gmail.com.
We acknowledge every privacy request within 1 business day and give you a reference so you can track it.
Questions about your data?
Ask us anything about what we hold and why. We will give you a straight answer, and you can have it deleted whenever you want.