Privacy Policy

1. Information We Collect

We collect information in the following categories:

2. How We Use Your Data

We use the information we collect for the following purposes:

• Account management: Creating, maintaining, and securing your workspace account
• Service delivery: Providing all features of your subscribed ERP module
• Billing: Processing subscription payments and generating invoices
• Customer support: Responding to queries, troubleshooting, and technical assistance
• Security monitoring: Detecting and preventing fraudulent, abusive, or unauthorised activity
• Service improvement: Analysing usage patterns to improve platform performance and features
• Legal compliance: Meeting our obligations under applicable Indian law
• Communications: Sending transactional emails, billing notifications, and important service updates

We do not use your data for advertising purposes, behavioural profiling, or any purpose unrelated to operating your ERP service.

3. Data Storage & Security

Your data is stored on secure cloud infrastructure. We implement the following technical and organisational security measures:

• AES-256 encryption of all data stored at rest
• TLS 1.3 encryption of all data transmitted between your browser and our servers
• Automated encrypted daily backups retained for a minimum of 30 days
• Role-based access control (RBAC) restricting employee access to the minimum necessary
• Firewall rules and intrusion detection systems
• Secure, isolated workspace environments per customer organisation

4. Multi-Tenant Isolation

Matrixgrow operates a strict multi-tenant architecture. Each customer organisation is provisioned an entirely isolated workspace with its own data partition, enforced at the database level using Row-Level Security (RLS) policies. This means:

• No other customer can access, read, or modify your data
• Our platform code enforces workspace-scoped queries on every database operation
• Administrators of other workspaces have zero visibility into your workspace
• There is no data sharing between separate customer organisations

5. Employee Access Controls

Access to customer data by Matrixgrow personnel is strictly controlled on a need-to-know basis. Only authorised technical staff and support personnel who require access to resolve a specific support issue or maintain system infrastructure are permitted to access customer data, and only with appropriate justification.

All Matrixgrow employees and contractors are bound by confidentiality agreements. Access is logged, reviewed, and monitored. We do not access customer workspace data for marketing, sales, or competitive intelligence purposes under any circumstances.

6. Audit Logging

We maintain comprehensive audit logs of all significant events within the platform, including: user login/logout events, data exports, permission changes, billing transactions, and any administrative actions performed by Matrixgrow staff on customer data. These logs are retained for a minimum of 12 months and are used for security monitoring, dispute resolution, and compliance purposes.

7. Data Sharing Policy

Matrixgrow does not share your personal or business data with third parties for advertising, marketing, or any commercial purpose. We share data only in the following limited circumstances:

• Service providers: Cloud infrastructure providers, database hosting platforms, and email delivery services that operate under strict data processing agreements
• Payment processors: Payment gateway providers for processing subscription fees only
• Legal requirements: When required by a valid court order, law enforcement request, or applicable Indian law
• Business transfers: In the event of a merger, acquisition, or sale of assets, with prior notice to customers

8. Payment & Financial Data

Matrixgrow does not process online credit card transactions, CVV entries, or banking credentials through this web application. All subscription billing is conducted offline or via direct invoice bank transfer. We never collect, store, or process your credit/debit card numbers or bank account access credentials on our servers.

9. Retention Periods

10. Account Deletion

You may request deletion of your account and all associated data at any time by contacting support@matrixgrow.in. Upon receiving a valid deletion request:

• Your workspace will be deactivated immediately
• All workspace data will be immediately and permanently deleted from all active databases and servers
• Billing records required for statutory compliance may be retained as required by law

We strongly recommend exporting your data before requesting deletion, as this action is irreversible.

11. Your Rights

Under the Digital Personal Data Protection Act 2023 (DPDP Act) and other applicable laws, you have the following rights with respect to your personal data:

To exercise any of these rights, submit your request to support@matrixgrow.in. We will respond within 30 days of receiving a valid request.

12. Withdrawal of Consent

You may withdraw your consent to our data processing at any time by contacting us. Please note that withdrawal of consent may result in our inability to continue providing the ERP service to you, as processing of certain data is a prerequisite for service delivery. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal.

13. Children's Data

Matrixgrow services are designed for business operators and are not directed at children under the age of 18 as account holders. We do not knowingly solicit or collect personal data from children under 18 for account creation purposes.

However, School ERP customers may legitimately process student records that include minors' data as part of their educational administration. This data is processed strictly on the school's instructions as a data processor, under the school's responsibility as the data fiduciary. See Section 14 for specific provisions applicable to educational data.

14. Educational Data (Schools)

Schools and educational institutions using Matrixgrow School ERP are responsible for obtaining appropriate consent from students, parents, and guardians in accordance with applicable law before entering any personal data into the system. As the data processor, Matrixgrow:

• Processes student data only on the explicit instructions of the school
• Does not use student data for any purpose other than operating the school's ERP workspace
• Maintains strict isolation of each school's student data
• Does not share student records with any third party without the school's written authorisation
• Supports the school's compliance with applicable educational data protection requirements

15. Cross-Border Data Processing

Matrixgrow primarily stores and processes data within India. Where we use third-party cloud infrastructure or service providers that may process data outside India, we ensure that adequate safeguards are in place (including data processing agreements and contractual clauses) in compliance with the Digital Personal Data Protection Act 2023 (DPDP Act) and any rules issued thereunder.

16. Security Incident Notification

In the event of a data security incident (including a breach, unauthorised access, or accidental disclosure) that affects your workspace data, Matrixgrow will:

• Investigate and contain the incident as promptly as possible
• Notify affected customers via email within 72 hours of discovery, where feasible
• Provide details of the nature of the breach, data affected, and steps taken to address it
• Report to the Data Protection Board of India as required under applicable law

17. AI Features

Matrixgrow may introduce AI-powered features in future platform updates (such as automated report generation, attendance pattern analysis, or scheduling suggestions). If and when such features are introduced, we will:

• Update this Privacy Policy at least 30 days before the feature becomes active
• Clearly disclose what data is used and how AI models process it
• Allow customers to opt out of AI-powered features if they choose
• Never use customer data to train external AI models without explicit written consent

Currently, no AI models process customer workspace data.

18. Indian Privacy Compliance

Matrixgrow is committed to compliance with Indian data protection law, including the:

• Digital Personal Data Protection Act 2023 (DPDP Act) and rules issued thereunder
• Information Technology Act 2000 and the IT (Amendment) Act 2008
• IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011

We will update our practices as new rules and guidance are issued under the DPDP Act.

19. Grievance Officer

In accordance with the Information Technology Act 2000 and the DPDP Act, the following individual has been designated as our Grievance Officer:

You may also escalate complaints to the Data Protection Board of India once operational under the DPDP Act framework.

20. Privacy Policy Updates

We review and update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will:

• Update the "Effective Date" and "Version" at the top of this page
• Notify registered customers by email at least 14 days before changes take effect
• Where required by law, request renewed consent for material changes to how we process personal data

Continued use of Matrixgrow services after the effective date of a policy update constitutes your acceptance of the revised terms.