Privacy Policy

This policy explains how <Company legal name> (“we”) handles personal data in SolarStudio, in line with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000.

1. Our two roles

• For your account (your name, email, workspace, billing) we are the data fiduciary.
• For your customers' data that you enter (names, addresses, phone numbers, electricity bills, site photos) your business is the data fiduciary and we are its data processor, acting only on your instructions.

2. What we collect

• Account data: name, email, password (stored only as a bcrypt hash), Google account id if you sign in with Google.
• Workspace and billing data: company name, GSTIN, billing address, invoices. Card/UPI details are collected by Razorpay, not by us.
• Project data: site locations, designs, energy and finance inputs, proposals and their view/acceptance events.
• Technical data: IP address and device information for security (e.g. login rate limiting), and logs kept for a limited period.

3. Why we use it (purpose and legal basis)

• To provide the Service you signed up for, on the basis of your consent given at signup and to perform our contract with you.
• To bill you and meet tax and accounting law (GST records are retained for the period the law requires).
• To keep the Service secure and prevent fraud and abuse.
• To send transactional emails (verification, password resets, invites, receipts). Product updates only if you opt in.

We do not sell personal data or use your customers' data to market to them.

4. Who we share it with

• Processors that run the Service: hosting and database (<hosting provider, region>), email delivery (Resend), payments (Razorpay).
• Public data providers receive only the coordinates or addresses needed for a lookup (OpenStreetMap/Nominatim, Overpass, PVGIS, NASA POWER, elevation services).
• Systems you connect (PVERP, your webhooks, API clients) — at your direction.
• Authorities, when the law requires it.

Where data is processed outside India, we do so only to countries not restricted by the Central Government under section 16 of the DPDP Act.

5. How long we keep it

For as long as your account is active, then deleted or anonymised within <90> days of closure, except where we must keep records longer by law (e.g. invoices).

6. Security

Encryption in transit, hashed passwords and single-use tokens, role-based access within workspaces, rate limiting, and access to production data limited to staff who need it. If a personal data breach occurs we will notify the Data Protection Board of India and affected people as the DPDP Act requires.

7. Your rights

You can ask to access a summary of your personal data, correct or complete it, erase it, withdraw consent (which stops processing that relies on it, and may mean closing the account), nominate someone to exercise your rights, and raise a grievance. Your customers should contact the installer whose proposal they received; we will help that installer respond.

8. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly process children's data.

9. Grievance officer

<Name>, Grievance Officer, <Company legal name>, <Registered address> · <privacy email>. We acknowledge grievances within 48 hours and resolve them within the period the law sets. If you are not satisfied you may approach the Data Protection Board of India.

10. Changes

We will post changes here and email account owners about material ones before they take effect.