Legal
AftrBase Website Privacy Policy
Effective date: 22 October 2026 · Last updated: 22 October 2026
This Privacy Policy explains how AftrBase (“we”, “us” or “our”), with its registered office at 432 B-8, Paryatan Vihar, Vasundhara Enclave, East Delhi, Delhi 110096, India, collects, uses, shares, and protects personal data when you visit aftrbase.com (the “Website”) or contact us through it.
We handle personal data in accordance with the Digital Personal Data Protection Act, 2023 and the rules made under it (the “DPDP Act”), the Information Technology Act, 2000 and its rules, and, where it applies to you, the EU/UK General Data Protection Regulation (“GDPR”).
1. What this Policy covers
1.1 This Policy covers personal data we collect through the Website: from visitors, and from prospective customers who submit an enquiry.
1.2 It does not cover personal data processed through the AftrBase platform (including platform.aftrbase.com, smart receipts, surveys, CRM, and related products) on behalf of our business customers. For that data, the business customer decides why and how the data is used and is responsible for notifying and obtaining consent from its own customers. We act as a data processor under a separate agreement. If you received a smart receipt or survey from a business and want to exercise your rights over that data, please contact that business first. We will also help you find the right contact if you write to us.
2. Who is responsible for your data
For personal data collected through the Website, AftrBase is the Data Fiduciary under the DPDP Act (and the controller under GDPR). Our contact details are in Section 13.
3. Personal data we collect
3.1 Data you give us
When you fill in the “Tell us about your business” form or otherwise contact us, we collect:
- full name;
- business name;
- work email address;
- phone number (optional);
- number of stores and business type (retail, F&B, hospitality, or other);
- the product or plan you are interested in; and
- any message or other information you choose to include.
If you write to us by email or phone, we also keep the content of those communications and the contact details you used.
3.2 Data collected automatically
When you use the Website, we and our service providers may automatically collect:
- IP address, approximate location derived from it, browser type and version, device type, operating system, and language settings;
- pages visited, links clicked, time spent, referring website or campaign source, and the date and time of your visit; and
- information collected through cookies and similar technologies (see Section 7).
3.3 Data we do not seek
We do not ask for sensitive personal data (such as health data, financial account details, or government identifiers) through the Website. Please do not include such information in the contact form.
4. Why we use your data
We use personal data only for specified purposes, and only as permitted by law:
| Purpose | Examples | Basis |
|---|---|---|
| Responding to enquiries and arranging pilots | Replying to your form submission, scheduling a call, sharing a quotation | Your consent, given when you submit the form |
| Sales and relationship management | Recording your enquiry in our CRM, following up on your interest | Your consent; legitimate interests (GDPR) |
| Operating, securing, and improving the Website | Preventing abuse, diagnosing errors, understanding which pages are useful | Legitimate uses; legitimate interests (GDPR); consent for non-essential cookies |
| Communications about AftrBase | Product updates or invitations, only where you have opted in | Your consent; you can withdraw it at any time |
| Legal and compliance | Meeting legal obligations, responding to lawful requests, establishing or defending legal claims | Legal obligation or legal claims |
We will not use your personal data for a purpose that is materially different from the ones above without telling you and, where required, obtaining fresh consent.
5. Consent
5.1 Where we rely on consent, we ask for it clearly before or when we collect your data, for example by a notice linked to the contact form.
5.2 You can withdraw your consent at any time by emailing us at the address in Section 13, or by using the unsubscribe link in any marketing email. Withdrawal does not affect the lawfulness of processing before withdrawal. After withdrawal we will stop the relevant processing and delete the data unless we are required or permitted by law to keep it.
6. Who we share your data with
We do not sell your personal data. We share it only as follows:
- Service providers that help us run the Website and our business, under written obligations to protect the data and use it only on our instructions. These currently include website hosting and infrastructure, email and communication tools, CRM and sales tools, scheduling tools, and analytics providers.
- Professional advisers, such as lawyers, auditors, and insurers, where needed.
- Authorities and legal process, where we are required by law, court order, or a lawful request from a government authority, or where needed to protect our rights, users, or the public.
- Business transfers, if AftrBase is involved in a merger, acquisition, financing, or sale of assets. We will make sure the receiving party continues to protect your data in line with this Policy.
7. Cookies and similar technologies
7.1
Cookies are small files stored on your device. The Website currently uses essential cookies only — the ones needed for it to work and stay secure. These do not need your consent. We do not use analytics or advertising cookies; if we add any non-essential cookies later, we will ask for your consent before setting them and update this section.
7.2
You can block or delete cookies in your browser settings, though parts of the Website may then not work properly.
7.3
We do not track visitors across other websites, so “Do Not Track” browser settings have no effect on the Website.
8. International transfers
Our service providers may store or process data on servers located outside India. Where we transfer personal data outside India, we do so in line with the DPDP Act and any restrictions notified by the Government of India. Where GDPR applies, we use appropriate safeguards such as Standard Contractual Clauses where required.
9. How long we keep your data
We keep personal data only as long as needed for the purpose it was collected, or as required by law.
- Enquiry and sales data: for as long as we are in discussion with you, and up to 24 months after our last interaction, unless you become a customer or ask us to delete it sooner.
- Customer relationship records: for the term of the contract and the period required by applicable law (for example, tax and accounting requirements).
- Analytics and log data: up to 14 months, or as set by the relevant tool.
- Marketing preferences and suppression lists: until you withdraw consent, plus the minimum needed to honour your opt-out.
When data is no longer needed, we delete or irreversibly anonymise it.
10. Security
We use reasonable technical and organisational safeguards to protect personal data, including encryption in transit, access controls, and limiting access to personnel who need it. No system is completely secure. If a personal data breach affects you, we will notify you and the relevant authority as required by law. See also our Security page.
11. Your rights
11.1 Under the DPDP Act
If you are in India, you have the right to:
- access a summary of the personal data we process about you and the identities of those we have shared it with;
- correct, complete, or update your personal data;
- erase your personal data when it is no longer needed for the purpose it was collected, unless we must retain it by law;
- withdraw consent at any time, as described in Section 5;
- grievance redressal, by contacting our Grievance Officer (Section 13), and, if you are not satisfied, to approach the Data Protection Board of India; and
- nominate another person to exercise your rights in the event of your death or incapacity.
11.2 Under GDPR (EEA and UK visitors)
If GDPR applies to you, you also have the right to restrict or object to processing, to data portability, and not to be subject to solely automated decisions with legal effects. You may lodge a complaint with your local data protection authority.
11.3 How to exercise your rights
Email us at the address in Section 13. We may need to verify your identity before acting on a request. We will respond within the time required by applicable law, and in any case within 30 days. Your duties as a data principal include providing accurate information and not making false or frivolous complaints.
12. Children
The Website is intended for businesses and is not directed at children. We do not knowingly collect personal data of anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
13. Contact and Grievance Officer
For questions about this Policy, to exercise your rights, or to raise a complaint:
We aim to acknowledge complaints promptly and resolve them within the period required by law.
14. Third-party websites
The Website may link to other websites. We are not responsible for the privacy practices or content of those sites. Please read their privacy policies before sharing your data with them.
15. Changes to this Policy
We may update this Policy from time to time. The latest version will always be on this page with the “Last updated” date. If we make material changes, we will take reasonable steps to notify you, and where required, ask for your consent again.