Legal

Privacy Policy

Effective 16 October 2026 · replaces the policy dated 6 July 2025

This policy explains what personal data 0todeploy collects, why, who we share it with and the choices you have. It covers this website (0todeploy.com), our WhatsApp chat, and the products we run for customers, including 0todeploy VMS. We follow India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Who we are

0todeploy (GSTIN 29COMPA5356P2Z7), No. 21-1, 3rd Floor, Kanakpura Main Road, K Chudahalli, Bengaluru, Karnataka 560116, India. Email: [email protected].

2. Our role for your data

  • Website visitors, enquiries and customers: we decide how this data is used, so we are the Data Fiduciary for it.
  • Data inside 0todeploy VMS: visitor and staff records are collected by the company that uses VMS (our customer). That company is the Data Fiduciary; we process the data on its behalf and on its instructions, as its Data Processor. If you visited an office that uses VMS, please contact that company first about your data — we will help them respond.

3. What we collect

Contact form and email

  • Your name, email address and the message you write.

WhatsApp chat on this website

  • Your name, WhatsApp number, company (optional) and message.
  • When you press Send on WhatsApp, we send your enquiry to our team and send you one confirmation message on WhatsApp from our business number. Our team then replies from +91 63618 39139. Messages are sent through Meta’s WhatsApp Business Platform.
  • We only message you about your enquiry. To stop, reply “STOP” or ask us at [email protected].

Collected automatically on this website

  • Security and delivery: our website is served by Cloudflare, which processes your IP address and browser details to deliver pages and block attacks.
  • Bot check: our forms use Cloudflare Turnstile, which checks your browser to tell people from bots.
  • Analytics: we use Cloudflare Web Analytics, which counts page views without cookies and without building a profile of you.

0todeploy VMS (for companies that use it)

  • Visitor details: name, phone, email, company, purpose of visit, the host you are meeting and visit times.
  • If the company requires it: a photo, the type of ID shown, the ID number (stored only as a one-way hash, not in readable form), a picture of the ID document, and laptop details such as serial number or MAC address.
  • Activity records: QR badge scans, check-in and check-out events, approvals and audit logs. A company may also mark a visitor as not permitted to enter.
  • Staff accounts: username, email, role, site, password (stored only as a secure hash) and two-factor authentication settings.
  • Billing: the plan, amounts and Razorpay order and payment references. Card, UPI and bank details are entered with Razorpay and are never stored by us.

Our mobile app

  • The app may ask for Internet access and push notifications. Push tokens (Firebase Cloud Messaging) are used only to deliver notifications and are not linked to your identity. The app does not include advertising or analytics SDKs.

0signer and custom integrations

  • 0signer runs on your own computer: documents and digital signature certificates stay on your machine and are not sent to us.
  • For integrations we build for you (for example Tally Sync), we only access your data as needed to build and support the work, under our agreement with you.

4. How we use it

  • To reply to your enquiry and send quotes, proposals and support.
  • To provide our products and services to customers, including running VMS for the companies that use it.
  • To keep our website and products secure and to prevent spam and abuse.
  • To bill customers and meet legal, tax and accounting requirements.

We do not sell personal data, we do not use it for advertising, and we do not send marketing messages without your consent.

5. Who we share it with

We share personal data only with service providers that help us run our services, and only as much as they need:

  • Cloudflare — website hosting, security, Turnstile bot checks and Web Analytics.
  • Hostinger — the servers that run VMS and our messaging service, located in Mumbai, India.
  • Meta (WhatsApp Business Platform) — sending and receiving WhatsApp messages.
  • Microsoft 365 — business email, including VMS emails such as visitor invites and QR badges.
  • Razorpay — payment processing for VMS subscriptions.
  • Google Firebase — push notifications for our mobile app.

Some of these providers may process data outside India under their own safeguards. Inside VMS, a company’s data is visible only to that company’s authorised users. We may also disclose data where the law requires it.

6. Where it is stored and how it is protected

  • VMS data and our messaging service run on servers in India.
  • All traffic is encrypted with HTTPS. Passwords and ID numbers are stored only as one-way hashes.
  • Each company in VMS has its own isolated workspace, with role-based access, optional two-factor authentication and audit logs.
  • Access to production systems is limited to the people who need it to run the service.

No system is perfectly secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the DPDP Act requires.

7. How long we keep it

  • Enquiries (form, email, WhatsApp): for as long as needed to respond and follow up, and normally no longer than 24 months after our last conversation, unless you become a customer.
  • VMS data: for as long as the customer company uses VMS, or as that company instructs. When a subscription ends, we delete or return the company’s data on request.
  • Billing records: for as long as Indian tax and accounting laws require.

8. Your rights

Under the DPDP Act you can:

  • ask what personal data we hold about you and how we use it;
  • ask us to correct, complete, update or erase it;
  • withdraw consent you have given — this does not affect anything done before you withdrew it;
  • nominate someone to exercise these rights for you if you die or become unable to;
  • raise a grievance with us, and if you are not satisfied with our answer, complain to the Data Protection Board of India.

Email [email protected] to use these rights. We aim to reply within 30 days. For data inside VMS, we pass your request to the company concerned and help it respond.

9. Cookies and local storage

  • We do not use advertising or tracking cookies.
  • Your browser stores your light/dark theme choice and whether you have accepted our cookie notice. Cloudflare may set short-lived security cookies that are needed for bot protection.

10. Children

Our website and products are meant for businesses and adults. We do not knowingly collect data from children under 18 without verifiable consent from a parent or guardian.

11. Changes to this policy

We will update this page when our practices change and change the effective date at the top. For significant changes, we will also tell VMS customers directly.

12. Contact and grievance officer

Archith, Founder, 0todeploy
Email: [email protected]
No. 21-1, 3rd Floor, Kanakpura Main Road, K Chudahalli, Bengaluru, Karnataka 560116, India

Third-party websites linked from our site, such as Facebook, Instagram and X, have their own privacy policies.