Privacy Policy

Last updated 15 October 2026

This policy explains what personal data [Legal entity name] (“deployshed”, “we”) collects, why, and the choices you have. It is written to meet India's Digital Personal Data Protection Act, 2023 and the Information Technology Rules.

What we collect

Account details: your name, email address, password (stored only as a one-way hash), and the organizations you belong to. If you sign in with Google or your company's identity provider, the name, email and group memberships it sends us.
Billing details: the amounts you pay, invoices, and, if you give them, a business name, address and GSTIN. Card, UPI and bank details are entered on Razorpay's page and never reach us.
Usage and logs: what you deploy and when, the resources your apps use, their logs, and an audit log of changes made in your organization. Our servers record IP addresses and browser details to keep the service secure.
Your apps' visitors: when someone opens an app you deploy, we check who they are and record the request, so that only the people you allow can open it.

The content of your apps, and any personal data inside them, is yours. We process it only to run your apps, on your instructions.

Why we use it

To provide the service: sign you in, build and run your apps, and control who can open them.
To bill you and keep the records tax law requires.
To keep deployshed secure and to investigate abuse.
To email you about your account: verification, password resets, failed deploys, low credit and invoices. We do not send marketing email without your consent.

Who we share it with

We do not sell personal data. We share it only with providers that help us run deployshed, under contract and only for that purpose: Razorpay (payments), Brevo (sending email), Cloudflare (DNS and encrypted backups), Google Cloud (the network edge our traffic passes through), and Google or your identity provider when you sign in with them. We disclose data when the law requires it.

Where it is kept, and for how long

Your data is stored on our servers in Bengaluru, India. Nightly backups are encrypted before they leave those servers and are kept off-site with Cloudflare R2. Account data is kept while your account is open and deleted within 30 days of closing it; deleted data leaves our backups within [backup retention, e.g. 30 days]. Invoices and payment records are kept for eight years, as GST law requires.

Your rights

You can ask to see the personal data we hold about you, correct it, or erase it, and you can withdraw a consent you have given. Email privacy@deployshed.com; we answer within 30 days.

Grievance Officer

[Name], Grievance Officer
[Legal entity name], [Registered address]
grievance@deployshed.com

We acknowledge a complaint within 24 hours and resolve it within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Cookies

We use only the cookies deployshed needs to work: your session, and a short-lived one while a sign-in completes. There are no advertising or tracking cookies.

Security

Connections are encrypted, passwords and access tokens are stored as hashes, connection credentials are encrypted at rest, and each app runs isolated from the others. If a breach affects your data, we will tell you and the Data Protection Board as the law requires.

Changes

We will email account owners before a material change to this policy takes effect.