Privacy & Data Protection Notice

Privacy Policy

Last Updated: October 2026 • Compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act) & IT (SPDI) Rules, 2011

Data Fiduciary Commitment:

StitchOps is developed and operated by Jeel Asalalia, India. We act as a Data Fiduciary for account administrator credentials and a Data Processor for your factory operational records. We never sell, rent, or monetize your factory records or contact information to any third party.

1Categories of Data Collected

We collect only the minimum data required to deliver operational textile ERP software:

  • Account Credentials: Owner full name, business email address, WhatsApp mobile number, factory name, factory physical address, and password (hashed with Argon2id).
  • Business & Tax Identifiers: GSTIN and PAN provided by you for invoice letterhead generation.
  • Operational Factory Records: Inward challans, outward deliveries, jobwork partner ledgers, machine counters, design names, and stitch calculations.
  • Payment Transaction References: Cashfree gateway transaction IDs, order IDs, and payment mode. We never store or receive your credit card number, debit card number, or bank PIN.

2Purpose of Data Processing

Your data is processed strictly for the following legitimate purposes:

  • Provisioning your factory partition, generating activation keys, and authenticating logins.
  • Processing one-time subscription advance orders via our payment partner Cashfree.
  • Delivering activation support and customer onboarding communications via WhatsApp or Email.
  • Recording audit trails (`AuditLog`) for internal security and forensic compliance.

3Security Safeguards & Password Protection

In compliance with Section 8(5) of the DPDP Act 2023, StitchOps deploys robust technical safeguards:

  • Argon2id Password Hashing: User passwords are encrypted using state-of-the-art Argon2id, resistant to GPU-accelerated dictionary attacks.
  • Multi-Tenant Database Isolation: Operational records are segmented by unique organization UUIDs, preventing cross-tenant leakage.
  • Transport Layer Security: All API communication is strictly encrypted via HTTPS/TLS.

4Storage Limitation & 30-Day Inactive Purge

Under Section 8(7) of the DPDP Act (Storage Limitation), personal data must not be stored once the purpose is served. If a user discontinues their subscription, organization records are placed in encrypted inactive storage for thirty (30) days to allow renewal. After 30 consecutive days of inactivity, the entire organization partition is permanently purged from the database.

5Rights of the Data Principal

Under the DPDP Act 2023, you have the right to:

  • Access & Summary: Review the personal data held in your account settings.
  • Correction & Update: Modify factory profile, phone number, and owner details at any time in Settings.
  • Erasure: Request immediate deletion of your organization account by emailing our Grievance contact.

6Grievance Redressal Officer

In compliance with the Information Technology Act, 2000 and Section 12 of the DPDP Act, 2023, any privacy concern or grievance may be submitted directly to our designated contact:

Grievance & Privacy Redressal Contact:

Jeel Asalalia, Founder & Developer
India
Email: support@stitchops.com
Response Window: Acknowledged within 48 hours; resolved within 30 days.