Privacy Policy – Decuga

Decuga Technologies ("Decuga", "we", "us", or "our") operates the website decuga.com and the Decuga platform (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use the Service, and describes your rights under the Digital Personal Data Protection Act, 2023 (DPDPA) and other applicable Indian law.

By accessing or using the Service you consent to the practices described in this Policy. If you do not agree, please discontinue use of the Service.

1. Data We Collect

We collect the following categories of personal data:

1.1 Account Data

When you register, we collect your name, email address, and a hashed password. This is required to create and authenticate your account.

1.2 Content Data

Documents, projects, tasks, comments, and other content you create or upload within the Service are stored on our infrastructure. This content may contain personal data if you choose to include it.

1.3 Payment Data

When you subscribe to a paid plan, payment is processed by Stripe, Inc. We do not store full card numbers or CVVs on our servers. We retain a Stripe customer ID and subscription status to manage your billing relationship.

1.4 Usage & Technical Data

We automatically collect information such as IP address, browser type, pages visited, feature usage, and timestamps. This data is used to operate, maintain, and improve the Service.

1.5 Communications Data

If you contact us via the contact form or email, we retain your name, email, and the content of your message to respond to your enquiry.

2. How We Use Your Data

We use the data we collect to:

Provide, operate, and maintain the Service;
Process transactions and send billing-related communications;
Send transactional emails (account confirmations, password resets, plan updates);
Send product updates and promotional communications — you may opt out at any time;
Monitor and analyse usage to improve performance and features;
Detect, investigate, and prevent fraudulent or unauthorised activity;
Comply with legal obligations.

We process your personal data on the following legal bases: contract performance (to deliver the Service you subscribed to), legitimate interests (security, fraud prevention, product improvement), consent (marketing communications), and legal obligation where required.

3. Data Sharing & Third-Party Processors

We do not sell your personal data. We share it only with trusted third-party processors who assist in delivering the Service, each bound by data processing agreements:

Processor	Purpose
Google Cloud Platform (GCP)	Cloud infrastructure, database, file storage
Stripe, Inc.	Payment processing and subscription management
Resend	Transactional email delivery

We may disclose personal data if required by law, court order, or government authority, or to protect the rights, property, or safety of Decuga Technologies, our users, or the public.

4. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Policy:

Account data: retained while your account is active and for 30 days after deletion to allow recovery, then permanently deleted.
Free-trial expired data: documents and project data are retained for 60 days after your trial expires. After that period, data is permanently deleted unless you upgrade to a paid plan.
Activity logs: project activity events are retained for 1 year.
Billing records: invoices and transaction records are retained for 7 years as required by Indian tax and accounting law.
Communications: support and contact messages are retained for 2 years.

5. Data Security

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Your Rights under the DPDPA

Under the Digital Personal Data Protection Act, 2023, you have the following rights as a Data Principal:

Right of Access: obtain information about the personal data we hold about you and how it is processed.
Right of Correction and Erasure: request correction of inaccurate data or erasure of data that is no longer necessary.
Right of Grievance Redressal: lodge a grievance with our Data Protection Officer and receive a timely response.
Right to Nominate: nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once it is operational.

7. Cookies

We use essential cookies to maintain your authenticated session and remember your preferences. We do not use third-party advertising cookies. You can disable cookies in your browser settings, but this may affect the functionality of the Service.

8. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at [email protected] and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a prominent notice in the Service at least 15 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.

10. Contact Us

For any privacy-related questions, concerns, or to exercise your rights, please contact our Data Protection Officer:

Decuga Technologies

Data Protection Officer

Email: [email protected]