Privacy Policy

1. Who we are and what this covers

This policy explains how Tantra Technologies, which owns and operates SORA ("Tantra Technologies", "we", "us", "our") handles personal data in connection with the SORA website and applications. It is published in accordance with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023 ("DPDP Act") as and to the extent in force.

We act in two different roles. For the personal data of people who deal with us directly — visitors, people who enquire or register, and the users of a customer account — we decide why and how it is used. For the personal data our customers put into the Service about their own customers, leads, employees and vendors, the customer decides and we act only as its processor: that data is governed by the customer's own privacy notice and our Data Processing Terms, and requests about it should go to that customer.

2. What we collect

• Account and contact details: name, business name, email, phone, role, address, GSTIN and similar business identifiers.

• Billing details: plan, invoices and payment status. Card and bank credentials are handled by our payment provider; we do not receive or store full card numbers.

• Usage and device data: log-in times, pages and features used, IP address, browser and device type, and security logs.

• Location, camera and files, only where a user chooses to use a feature that needs them — for example attendance check-in, a site survey or uploading a document.

• What you send us: enquiries, support messages and feedback.

• Customer Data: whatever a customer enters or uploads, which may include personal data of its own customers and staff, electricity bills, identity and bank details, photographs and location.

3. Why we use it, and on what basis

We use personal data to provide, secure and support the Service; to create and administer accounts; to bill and collect payment; to send service messages; to prevent fraud, abuse and automated extraction; to meet legal and tax obligations; to improve our products; and, where you have agreed, to send marketing.

We rely on your consent, on what is necessary to perform our agreement with you, on compliance with law, and on the legitimate uses the DPDP Act permits. Where we rely on consent you may withdraw it at any time; withdrawal does not affect what was done before it, and some features may stop working.

4. Who we share it with

We do not sell personal data. We share it only with: service providers who process it for us under contract (hosting, file storage, email and messaging, payments, mapping and imagery, analytics and support); our affiliates, where needed to operate the business; professional advisers; a buyer or successor in a merger, acquisition or reorganisation; and authorities where the law requires or to protect rights, safety and security.

5. Where it is kept and for how long

Data is stored with reputable cloud providers and may be processed in India and in other countries where they or we operate, subject to any restriction notified under the DPDP Act. We keep personal data for as long as the account is active and afterwards for as long as needed for the purposes above, to resolve disputes, and to meet legal, tax and accounting requirements, after which it is deleted or anonymised.

6. Security

We use reasonable technical and organisational measures — encryption in transit, access controls, separation of each customer's data, logging and monitoring. No system is perfectly secure and we cannot guarantee absolute security. Users are responsible for keeping their credentials confidential. If a personal data breach occurs we will notify affected persons and authorities as the law requires.

7. Your rights

Subject to law, you may ask for a summary of the personal data we hold about you and how it is processed, for it to be corrected, completed, updated or erased, to withdraw consent, to nominate another person to exercise your rights, and to have a grievance redressed. Write to the address below. We may need to verify your identity, and may decline a request the law permits us to decline. If you are not satisfied with our response you may complain to the Data Protection Board of India.

8. Cookies

We use cookies and local storage that are necessary to sign you in, keep you signed in and remember preferences, and limited measurement to understand use of our public pages. See the Cookie Policy.

9. Children

The Service is for businesses and is not directed to anyone under eighteen. We do not knowingly collect their personal data.

10. Changes and contact

We may update this policy; the date at the top shows the current version, and we will give notice of material changes.

Privacy questions and requests: support@tantratechnologies.com. Grievance Officer: Krishna Palde, support@tantratechnologies.com. We acknowledge grievances within forty-eight hours and aim to resolve them within one month.