DPDP Notice

Inovitrix is the Data Fiduciary for personal data we determine the purpose and means of processing in order to provide StoreOPUS (registration, licensing, billing, support, and cloud features including optional WhatsApp Marketing).

When you (a merchant) store customer or staff personal data in the desktop application, you are typically the Data Fiduciary for that data. We act as a Data Processor only to the extent you instruct us through enabled cloud features.

Depending on your use of the Service, this may include:

• Identity and contact data (name, email, phone, business name)
• Transactional and billing metadata
• Device / license identifiers
• WhatsApp Business connection identifiers and message logs (if you enable Marketing)
• Support correspondence

Details are in our Privacy Policy.

• Provide and secure the Service (contractual necessity)
• Billing, accounting, and tax compliance
• Customer support and service communications
• Optional messaging features you enable (WhatsApp Business / Meta)
• Fraud prevention and misuse detection

We do not process personal data for a purpose that is incompatible with these uses without a fresh lawful basis where required.

Where processing is based on consent (for example certain marketing emails or WhatsApp marketing sends to end customers), you may withdraw consent prospectively without affecting processing already completed. Merchants must obtain valid consent from their customers before sending marketing WhatsApp templates.

Subject to the DPDP Act and applicable rules, you may request:

• Access — summary of personal data we hold about you
• Correction & updating — fix inaccurate or incomplete data
• Erasure — deletion when retention is no longer necessary (see Data Deletion Instructions)
• Withdrawal of consent — where processing is consent-based
• Grievance redressal — complaint to our contact below

We may need to verify identity before fulfilling requests and may refuse or limit requests as permitted by law (for example where data must be retained for legal claims or accounting).

StoreOPUS is intended for business users aged 18+. We do not knowingly process children’s personal data for the Service.

We retain personal data only for as long as needed for the purposes above or as required by law. We implement reasonable security safeguards appropriate to the nature of the data and risks involved.

Personal data may be processed on infrastructure or by subprocessors located outside India (for example cloud hosting or Meta/Razorpay). We take steps consistent with applicable law and our contracts with those providers.

For DPDP-related requests or grievances related to StoreOPUS:

Email: privacy@storeopus.com
Support: support@storeopus.com
Entity: Inovitrix (India)

We aim to acknowledge grievances within 7 business days and resolve them within the timelines prescribed under applicable DPDP rules.