Privacy policy
ExpertComply ("ExpertComply", "we", "us", "our") is a software service provided by Threat Expert Cyber Solutions, C/O Loonkarab Dayama, Sandwa Parewara Road, near Community Health Centre Sandwa, Sandwa, District Churu, Rajasthan 331517, India. You can reach us at [email protected].
This policy explains what personal data we collect when you use expertcomply.com and app.expertcomply.com, why, and the choices you have. We follow India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules. For personal data about you, we act as the Data Fiduciary. For personal data your organisation stores inside its workspace, your organisation decides what is stored and why, and we process it on its behalf.
1. What we collect
- Account details: name, work email, company name, password (stored only as a one-way hash), and your mobile number if you give it.
- Verification and security: one-time codes (stored only as a hash and deleted after use or expiry), two-step sign-in settings, and sign-in records: date and time, IP address, browser, operating system and device type.
- Billing: plan, invoices and payment references. Card, UPI and bank details are collected by Razorpay, not by us.
- Forms: what you send us through the trial request, contact and startup programme forms, and support tickets.
- Workspace content: what your organisation enters, such as checklist progress, policies, assessments, risks, evidence files and, for VAPT, scan targets and findings.
- Advisor messages: questions you type into the GRC or VAPT Advisor.
2. Why we use it
- To create and secure your account, verify your email or phone, and let you sign in.
- To provide the Service, including sending service emails and, if you turn it on, WhatsApp messages (for example sign-in alerts, receipts and support replies).
- To bill you, keep tax records and prevent fraud.
- To answer questions, support requests and startup programme applications.
- To keep audit logs and detect misuse, as expected of a security product.
- To meet legal obligations.
We use your personal data on the basis of your consent, or for legitimate uses allowed by law, such as providing a service you asked for and meeting legal duties. We do not sell personal data and we do not use workspace content to advertise to you.
3. Who we share it with
- Razorpay, to take payments.
- Our email provider, to deliver emails from [email protected].
- Meta (WhatsApp Business Platform), only if you turn on WhatsApp updates or choose WhatsApp to receive a code.
- Our hosting and network providers (servers in a data centre and Cloudflare), which store and carry data for us.
- Anthropic, which provides the AI model behind the Advisor, receives the advisor messages you send when AI answers are switched on.
- Authorities, when the law requires it.
Some providers may process data outside India. Where they do, we rely on transfers permitted under Indian law.
4. How long we keep it
We keep account data while your account is active. After a subscription ends, workspace data is kept for the retention period shown in your account and then deleted. Invoices are kept as long as tax law requires. Sign-in and device records are kept for up to 90 days, and audit logs for as long as needed for security and legal purposes.
5. Security
We protect data with encryption in transit (HTTPS), hashed passwords, two-step sign-in, role-based access, separate data stores for GRC and VAPT, and append-only audit logs. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires.
6. Your rights
You can ask to access, correct, update or erase your personal data, withdraw consent, nominate someone to act for you, and raise a grievance. Turn WhatsApp updates on or off under Your account at any time. To use any other right, write to [email protected]. If your data is in a customer's workspace, we will pass your request to that customer. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
7. Grievance Officer
C/O Loonkarab Dayama, Sandwa Parewara Road, near Community Health Centre Sandwa, Sandwa, District Churu, Rajasthan 331517, India
Email: [email protected] (subject: "Grievance")
We acknowledge grievances within 48 hours and aim to resolve them within 30 days.
8. Cookies
We use one essential cookie to keep you signed in, and your browser's local storage to remember choices such as the light or dark theme. We do not use advertising cookies.
9. Children
The Service is for businesses and is not meant for anyone under 18.
10. Changes
We may update this policy. The date at the top shows the latest version, and we will tell account owners about significant changes.