Privacy Policy

This policy explains how Naatchaal (OPC) Private Limited ("we", "us") handles personal data in NaatOps. It is our notice under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it, and our privacy policy under the Information Technology Act, 2000.

It applies to people who visit our website, create an account, use a workspace, are invited to one, sign off a release report, or write to us.

We are the data fiduciary for account data, billing data, website enquiries, support messages and the logs we keep to run the Service. We decide why and how that data is used.

The customer is the data fiduciary for everything in its workspace: stories, test cases, comments, documents, files, the names and emails of its staff and clients, and release sign-offs. We process that data only on the customer's instructions, as its data processor, under our Data Processing Addendum. If you want to access, correct or delete data in a workspace, ask the company that runs it. We will help them answer you, and if you write to us we will pass your request on.

We do not collect sensitive data such as health, financial account or biometric data about you, apart from what you choose to put into a workspace. We never see your full card number: you enter it on Cashfree's page.

We do not use your data for advertising, we do not sell it, and we do not use workspace content to train AI models.

Where we rely on your consent, it is your choice, and you can withdraw it as easily as you gave it: turn off notifications in Settings › Notifications or in your browser, or write to us to stop using your demo request. Withdrawing consent does not affect what we did before, and we stop the processing within a reasonable time, normally 7 days.

We send product and account emails (invitations, notifications you can switch off, invoices and renewal reminders). We do not send marketing email without your consent, and every marketing email has a way to stop.

When someone uses an AI feature, NaatOps sends the provider only the project details that the feature needs, such as issue titles, descriptions, sprint dates and test results. Paid plans use Claude by Anthropic, which processes data in the United States and does not use it to train its models under its commercial terms. The Free plan and the trial use DeepSeek, which processes data in China under its own terms.

Workspace owners can turn AI off in Settings › Billing › AI. Then nothing is sent to either provider. If your clients do not allow their information to leave India or to be processed in China, turn AI off or move to a paid plan before you put that information into NaatOps.

We use these service providers (sub-processors). Each one may use the data only to provide its service to us, under a contract that requires it to protect the data:

We also share data:

• with services your workspace connects, such as Slack, GitHub, GitLab or Jira, when someone in the workspace sets that up;
• with your browser's push service (run by Google, Mozilla, Apple or Microsoft) when you turn on notifications. The message is encrypted end to end;
• with a government agency or court when Indian law requires it, for example under section 69 of the IT Act or a lawful order. We share only what the order requires; and
• with a buyer of our business, who must keep this policy's promises.

We list sub-processors on the Sub-processors page and update it before we add one.

The app and its database run in India on CloudPe. Some providers above process data outside India: Cloudflare R2 for files and backups, Resend for email, Anthropic for AI on paid plans (all United States or global), and DeepSeek for AI on the Free plan and trial (China). Section 16 of the DPDP Act allows transfers outside India unless the Government of India has restricted the country concerned. If it restricts a country we use, we will stop sending data there.

We may keep data longer if the law requires it or to resolve a dispute or a lawful investigation, and only for as long as that lasts.

We use reasonable security practices as required by section 8(5) of the DPDP Act and the IT Act. These include encryption in transit (HTTPS only), hashed passwords and tokens, encrypted secrets, role-based access checked on every request, rate limits, an audit log, and restricted staff access. The Security page describes them in more detail.

If a personal data breach happens, we will tell the Data Protection Board of India and the people affected as the DPDP Act and its rules require, report it to CERT-In within the time its directions set, and tell affected customers so they can meet their own duties.

Under the DPDP Act you have the right to:

• get a summary of the personal data we process about you and what we do with it, and the names of those we have shared it with;
• correct, complete or update your data. You can change your name, email and password yourself in Settings › My account;
• erase your data. You can delete your account yourself in Settings › My account, or ask us;
• withdraw any consent you have given;
• nominate someone to exercise these rights for you if you die or cannot act; and
• have a grievance resolved, and then complain to the Data Protection Board of India.

Write to [email protected] from the email address on your account. We may ask you to confirm it is you. We answer within 15 days, and always within the time the DPDP rules allow. For data inside a company's workspace, we will pass your request to that company, because it decides what happens to that data.

NaatOps is a business tool for people aged 18 and over. We do not knowingly collect data about children. If you believe a child has an account, tell us and we will delete it.

Our Grievance Officer, who also answers questions about this policy, is Manoranjith, Naatchaal (OPC) Private Limited, 51/5, S.U.K Business Centre, Attrankarai Street, Darasuram, Kumbakonam, Thanjavur, Tamil Nadu 612702, India. Email [email protected].

We acknowledge every grievance within 24 hours and resolve it within 15 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

If we change this policy in a way that matters, we will email account holders and show a notice in the app before the change takes effect. The date at the top shows when it last changed.