1. Scope & Operator
This Policy explains how UBXTY Unboxing Technology ("Eehsaas", "we", "us") handles personal data in connection with Eehsaas, the business operating system used by restaurants, contractors, PG and hostel operators, retailers, hotels and point-of-sale businesses.
The operator of record is UBXTY Unboxing Technology, Faridkot, Punjab, India. Our Grievance Officer and Data Protection contact is reachable at grievance@eehsaas.com.
This Policy applies to personal data we process in two distinct roles. As a platform operator, we process account, billing and technical data about you and the people who work with you. As a service provider to a business operating on Eehsaas, we process the personal data that business records about its own customers, residents, workers, students or staff — a diner, a PG resident, a contractor's labourer, a hotel guest, a shop's customer. In that second role the business is the controller and we act on its documented instructions, as set out in our Data Processing Addendum.
Because Eehsaas serves many verticals under one agreement, this Policy applies to every vertical. The categories of personal data a given business records vary by what that business does — a restaurant records orders and covers, a PG operator records resident and guardian contacts — but our handling of that data does not.
2. What We Collect
As platform operator we collect: your name, business email, phone number, password (stored hashed, never in plain text), the Business and Sites you operate, your subscription plan and billing history, and the content of messages you send us.
We also collect technical data automatically: IP address, device and browser type, operating system, app version, pages or screens viewed, timestamps, error and diagnostic logs, and a session identifier. We use cookies and similar technologies for this — see our Cookie Policy.
As service provider to a business, we process whatever personal data that business records on Eehsaas. Depending on the vertical, that may include a customer's name, phone number and email; the items, quantities and amounts of an order; a resident's identity, institution, guardian name and guardian phone number; a worker's identity, role, attendance and wage or payment records; a student or guest's identity; and any document a business uploads, such as an identity document, a photograph, or a bill.
We do not knowingly collect personal data from children. If you believe a child's data has been submitted to us, contact grievance@eehsaas.com.
We do not collect sensitive personal data unless a feature genuinely requires it — for example, where a business records a bank account to make a payment. Where a feature requires it, we ask for it specifically and use it only for that purpose.
3. How We Use It
To provide the Services: to authenticate you, operate the Business and Sites you have chosen, record and display the Content your business creates, generate the invoices, ledgers and reports that business needs, and send you service messages about your account.
To take payment and meet our own obligations: to process subscriptions through Razorpay, issue invoices, administer credits, and keep the accounting records we are required by law to keep.
To secure and support the Services: to detect fraud and abuse, enforce rate limits, investigate incidents, diagnose faults, and respond to your support requests.
Where you have asked for it, to send you product news, feature announcements, or marketing. You can unsubscribe at any time, and unsubscribing does not affect service messages about your account.
To improve the Services: in aggregate and de-identified form, to understand which features are used, where the product fails, and how to prioritise work. We do not sell personal data, and we do not use the Content a business records about its customers to build advertising profiles.
To comply with law and our legal obligations, including responding to valid legal process and enforcing our agreements.
4. Lawful Basis
Under the DPDP Act, 2023 we rely on performing our contract with you as the basis for processing needed to operate your account and subscription.
For personal data recorded by a business about its own customers, residents, workers or guests, the business is the controller and selects the lawful basis; we process on its instructions. We require that business to identify the basis, and we will suspend processing rather than process on a basis we consider unlawful.
Where consent is the basis — for example a marketing communication, or a non-essential cookie — you may withdraw it at any time without affecting processing carried out before withdrawal.
Where processing is necessary to comply with a legal obligation, or to establish, exercise or defend legal claims, we rely on that obligation or legitimate interest as applicable.
6. International Transfers
We operate from India. Some sub-processors named in clause 5 operate outside India, which means personal data may be transferred to another country.
Where a transfer leaves India, we rely on an appropriate safeguard — an adequacy ruling where one applies, or standard contractual clauses combined with a transfer impact assessment — and we limit what is transferred to what is necessary for the purpose.
Data subject to these Terms may be accessed from outside India by us or our sub-processors. You can request details of the countries involved at grievance@eehsaas.com.
7. Retention
We keep personal data only for as long as it is needed for the purpose it was collected, and then for as long as we are required to keep it.
Account and Content: retained while your subscription is active. Following termination you may export your Content for a period stated in your account or on request; after that period we delete it from our primary systems, and from backups on our normal backup rotation.
Billing and tax records: retained for the period required by Indian tax and accounting law, which is generally eight years from the end of the financial year to which they relate.
Security and diagnostic logs: retained for a limited period sufficient to investigate incidents, after which they are deleted.
Records a business holds about its own customers, residents, workers or guests: retained for as long as that business instructs, and deleted when the business deletes them or its account ends. Where you are the individual concerned, the business is the right first point of contact, and we will assist it in responding.
Where we delete data, it is removed from primary systems immediately and ceases to be recoverable from backups as those backups rotate out.
8. Your Rights (DPDP & GDPR)
Where we act as platform operator, you may ask us to: confirm what personal data we hold about you and provide a copy; correct anything inaccurate or incomplete; complete incomplete information; delete data we no longer need; or withdraw consent you have given, where processing relies on consent.
Where you are an individual recorded by a business on Eehsaas — a customer, resident, worker or guest — the business is the controller for that data. Direct your request to that business in the first instance. We will assist it in locating and acting on the request, and will not refuse assistance because the request came from us rather than from the business.
You may also object to, or ask us to restrict or stop, processing where our basis is legitimate interest, and you may ask for a portable copy of data you gave us.
You may complain to the relevant supervisory authority. In India that is the Data Protection Board. We would rather you raise it with us first, at grievance@eehsaas.com, so we can try to resolve it.
We respond to a request within the period required by applicable law and will tell you if we need more information. We do not charge for a request unless it is manifestly unfounded or excessive, and we will explain any charge before making it.
9. Security
We protect personal data with encryption in transit and at rest, role-based access controls, per-Business isolation so one tenant cannot read another's records, audit logging of access to sensitive data, and environment separation between development and production.
Access to production data is restricted to staff who need it, granted individually and reviewed periodically. No system is treated as secure by default; we test, patch and monitor on a defined schedule.
No system is entirely secure. If a breach affects your personal data, we will notify you and any authority within the time required by applicable law, and tell you what we know and what we are doing.
Our security commitments for personal data are also documented in the Data Processing Addendum.
11. Children
Eehsaas is a business tool and is not directed at children. We do not knowingly collect personal data directly from a child.
A business using Eehsaas may legitimately record the details of a person under 18 — a student in a PG or hostel, for example — but that is the business's decision and its responsibility to make lawfully. Where such a record is made, the business is the controller and must establish a valid basis and any consent required for a minor. Contact grievance@eehsaas.com if you believe a child's data has been used improperly.
12. Changes to this Policy
We may update this Policy as the Services or the law change. Where a change materially affects how we handle personal data, we will give you at least thirty days' notice by email and, where the change is significant, an in-app notice before it takes effect.
We will record the date of each material revision on this page and make prior versions available on request.
13. Grievance Officer / DPO
Under India's DPDP Act, the Grievance Officer of record is reachable at grievance@eehsaas.com. Data requests can also be raised via the contact form.
Operator of record: UBXTY Unboxing Technology, Faridkot, Punjab, India. Questions about these Terms can be sent to legal@eehsaas.com.