Privacy Policy

DRAFT for review by Raghu Chinnannan / A2 Ventures. This is not legal advice and has not been reviewed by a lawyer. Do not publish until it has been reviewed.

Last updated: [DATE]. This policy explains how A2 Ventures, a sole proprietorship owned by Raghu Chinnannan, based in Sankari, Salem District, Tamil Nadu, India ("A2 Ventures", "we", "us") handles personal data in RenewRoster. [REVIEW: Digital Personal Data Protection Act, 2023 (India) and its Rules. If serving EU/UK users, GDPR/UK GDPR.]

What we collect

• Account data: name, email, hashed password, agency name, team memberships.
• Service data you add: client names, client contact emails, domains, hostnames, renewal costs and notes.
• Waitlist data: email, agency size and confirmation status.
• Billing data: handled by Razorpay. We receive subscription and payment status, but never your full card number.
• Technical data: IP addresses and request logs, used for security and rate limiting. Free-tool lookups are not linked to an identity.

How we use it

To provide the Service (checks, alerts, reminders, reports), secure it, bill you, and send service emails. With your consent, we also send product updates, which you can unsubscribe from at any time. We do not sell personal data.

Where it's stored

Data is stored in a MySQL database on servers controlled by A2 Ventures [hosting provider, region: REVIEW]. Backups are kept [encrypted, for N days].

Processors we use

• Razorpay (payments, India)
• [Email delivery provider, e.g. Resend/SMTP host]
• Cloudflare (DNS and Turnstile bot protection)

Lookups query public registries (RDAP/WHOIS servers) and connect to the hosts you add.

Client contacts

Agencies that enable client reminders provide their clients' email addresses to us. We act on the agency's instructions for that data. Each reminder lets the recipient contact the agency directly by replying.

Retention

Account data is kept while your account is active and deleted within [30] days of closure, except records we must keep for tax and legal reasons. Check history is kept for [12 months].

Your rights

You can request access, correction or deletion of your data, or withdraw consent, by emailing [email protected]. Grievance officer: Raghu Chinnannan, [email protected]. [REVIEW: DPDP grievance requirements]

Security

Passwords are hashed with bcrypt. Session, invite and reset tokens are stored as hashes. Connections use HTTPS, and access is restricted by role.

Cookies

We use one essential session cookie for signed-in users, and no advertising or tracking cookies. Cloudflare Turnstile may process browser signals to detect bots.

Changes

If we make material changes to this policy, we'll notify account owners by email.