Consent and applicable law

By using our website or app, you consent to the collection and use of your personal data as described in this Privacy Policy. This policy is published in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

You may withdraw your consent at any time by writing to us at the contact below. Withdrawal does not affect processing already done, and we may be unable to provide the service if you withdraw consent that is needed to run your account.

Information we collect

We collect only the personal data needed for the purposes in this policy. At the point of collection we tell you what is asked and why.

Account details: name, company name, email address, phone number and address when you register.
Workspace content: records, tables, files and other data that you or your team enter into Recordbook. You remain the owner of this data.
Billing details: plan, transaction and invoice identifiers, and GSTIN if you provide it. We do not store your card, UPI PIN or net-banking credentials; payments are handled by our payment partners.
Communications: messages you send us, including support and refund requests.
Technical data: IP address, browser and device type, ISP, date and time stamps, referring pages and approximate location derived from IP.

How we use your information

We process personal data only for lawful purposes, namely to:

provide, operate and maintain Recordbook and your account;
process payments, issue invoices and handle refunds;
send service, security and support messages;
improve the product, understand usage and develop new features;
show plans and prices relevant to your region;
detect, prevent and investigate fraud, abuse and security incidents; and
comply with legal obligations, including tax, accounting and lawful requests from government authorities.

Cookies and analytics

We use cookies and similar technologies, including analytics tools such as Google Analytics and Microsoft Clarity, to understand how visitors use the site. Clarity may record anonymised interaction data such as clicks and scrolling. You can disable cookies in your browser settings; some features may then not work as intended.

Log files

Like most websites, we keep server logs that record IP addresses, browser type, ISP, date and time stamps and referring pages. We use them to administer the site, analyse trends and keep the service secure.

Sharing and disclosure

We do not sell your personal data. We share it only:

with service providers who process data on our behalf, such as cloud hosting, payment, analytics and communication providers, under confidentiality and security obligations;
with your team members and workspace administrators, as set by your workspace roles and permissions;
when required by law, court order or a lawful request from a government or regulatory authority; and
in connection with a merger, acquisition or sale of assets, with notice to you.

Data retention and deletion

We keep personal data only as long as needed for the purpose it was collected, or as required by law (for example, tax and accounting records). When you delete your account or ask for erasure, we delete or anonymise your data unless we must retain it by law. Backups are overwritten in the normal backup cycle.

Data security and breach notice

We apply reasonable security safeguards to protect personal data, as described on our Security page. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as required by the DPDP Act, and report cyber incidents to CERT-In as required by law.

Storage and cross-border transfer

Your data may be stored and processed on servers located in or outside India. We transfer personal data outside India only to countries and under conditions that are not restricted by the Government of India under the DPDP Act.

Your rights under the DPDP Act

As a data principal you have the right to:

access a summary of the personal data we process and the parties we share it with;
correct inaccurate or incomplete data and update outdated data;
request erasure of data that is no longer needed for its purpose;
withdraw consent at any time;
have your grievance redressed (see Grievance Officer below); and
nominate another person to exercise these rights if you die or become incapacitated.

Children's information

Recordbook is a business tool and is not meant for persons under 18. We do not knowingly process the personal data of a child without verifiable consent of a parent or lawful guardian, and we do not track or target children. If you believe a child has given us data, contact us and we will delete it.

Third-party links

This policy does not apply to third-party websites or services that we link to or integrate with. Please read their privacy policies.

Grievance Officer

In accordance with the IT Act and the Consumer Protection (E-Commerce) Rules, 2020, our Grievance Officer handles privacy complaints. We acknowledge a complaint within 48 hours and resolve it within one month of receipt. If you are not satisfied, you may complain to the Data Protection Board of India.

Changes to this policy

We may update this policy from time to time. We will post the updated version with a new date and, for material changes, notify you by email or on the site.

Contact Us

For questions, complaints or to exercise your rights under this Privacy Policy, contact:

Grievance Officer — Mensa Labs Private Limited

abhishek@rekord.in