Privacy Policy
This Privacy Policy explains how BakeryOS collects, uses, stores, and protects personal and business data when you use our platform, website, and related services. We are committed to handling your information responsibly and transparently, in accordance with India's Digital Personal Data Protection (DPDP) Act 2023.
By using BakeryOS, you consent to the data practices described in this policy. If you do not agree, please discontinue use and contact us to request deletion of your data.
Data we collect
We collect three categories of data when you use BakeryOS:
| Category | What it includes | Why we collect it |
|---|---|---|
| Account data | Name, email address, phone number, bakery business name, location (city/state) | To create and manage your account, communicate with you, and support billing |
| Operational data | Menu items, order records, customer names and contact details, inventory inputs, sales reports | To provide the core BakeryOS service — order management, inventory tracking, billing, and analytics |
| Payment metadata | Transaction ID, payment status, billing date, plan type. We do not store card numbers, CVV, or net banking credentials. These are processed exclusively by Razorpay. | To manage subscriptions, generate GST invoices, and handle refunds |
| Technical data | IP address, device type, browser version, operating system, session duration, pages visited | To maintain platform security, diagnose errors, and improve performance |
We do not collect sensitive personal data such as Aadhaar numbers, PAN numbers, biometric data, or financial account credentials. We do not use your data to build advertising profiles or sell it to third parties.
How we use your data
We use the data we collect exclusively for the following purposes:
- Service delivery — operating your order queue, inventory tracking, billing, customer records, and analytics dashboard.
- Account management — creating and maintaining your account, processing subscription payments, and generating GST invoices.
- Customer support — responding to your queries, resolving billing issues, and providing technical assistance.
- Platform improvement — analysing aggregated, anonymised usage patterns to improve features and reliability. Individual user data is never exposed in this analysis.
- Security and fraud prevention — detecting and responding to unauthorised access, abuse, or suspicious activity on your account.
- Legal compliance — meeting obligations under Indian law including the DPDP Act 2023, GST regulations, and any applicable court or regulatory order.
We may send product updates, feature announcements, and relevant tips to your registered email. You can unsubscribe from marketing emails at any time using the unsubscribe link at the bottom of any email. Transactional emails (invoices, security alerts, billing reminders) cannot be opted out of while your account is active.
Data sharing
We do not sell, rent, or trade your personal data. We share limited data with the following categories of trusted service providers, strictly for platform operation:
- Cloud infrastructure — servers and storage for hosting the BakeryOS platform and your data securely within or from India.
- Payment processing — Razorpay receives your payment details to process subscription charges. Razorpay's own privacy policy governs how they handle that data.
- Email delivery — a transactional email provider sends invoices, alerts, and support responses on our behalf.
- Analytics — aggregated, anonymised usage data may be processed by analytics tools to help us improve the platform. No personally identifiable information is included.
All third-party providers we work with are bound by data processing agreements that restrict them from using your data for any purpose beyond service delivery for BakeryOS.
We may disclose data to law enforcement, courts, or regulators when legally required to do so under Indian law. We will notify you of such disclosure where legally permitted.
Data retention
We retain your data for as long as necessary to provide the service and meet legal obligations:
- Active subscription — all account and operational data is retained for the duration of your subscription.
- After cancellation — data is retained for 30 days after your subscription ends, during which you can export it from Account → Export data.
- After the retention window — data is permanently deleted from our systems. This is not reversible.
- Billing records — transaction records and GST invoices are retained for 7 years as required by Indian GST law, even after account closure.
- Security logs — access and security logs are retained for 90 days for fraud investigation and incident response.
Security
We apply the following technical and organisational measures to protect your data:
- Encryption in transit — all data between your browser and BakeryOS is encrypted via HTTPS/TLS.
- Encryption at rest — sensitive data stored on our servers is encrypted at rest.
- Access controls — platform access is restricted by role. Only authorised BakeryOS personnel can access your data, and only when necessary for support or operations.
- JWT authentication — session tokens are short-lived and invalidated on logout, limiting exposure from compromised sessions.
- Payment security — card and payment credentials are handled exclusively by Razorpay, which is PCI-DSS compliant. BakeryOS never sees or stores your raw payment credentials.
No system is completely immune to breaches. You are responsible for keeping your BakeryOS login credentials confidential and for using a strong, unique password. If you suspect your account has been compromised, change your password immediately and contact support@inkurban.in.
Cookies & tracking
BakeryOS uses the following types of cookies and session technologies:
- Session cookies — maintain your login state while you use the platform. These are deleted when you close your browser or log out. They are essential and cannot be disabled without breaking the platform.
- Preference cookies — remember settings such as your selected language or dashboard layout. These are optional and expire after 30 days.
- Analytics cookies — track aggregated, anonymised usage patterns to help us understand which features are used and identify areas for improvement. No personal identity is attached to this data.
You can manage or disable non-essential cookies through your browser settings. Disabling session cookies will prevent you from logging in to BakeryOS.
Your rights
Under India's Digital Personal Data Protection (DPDP) Act 2023, you have the following rights regarding your personal data:
Request a copy of the personal data BakeryOS holds about you.
Request correction of inaccurate or incomplete personal data.
Request deletion of your personal data, subject to legal retention obligations.
Export your operational data (orders, customers, inventory) in a structured format from Account → Export data.
Withdraw consent for optional data processing such as marketing emails at any time.
Raise a complaint if you believe your data has been handled improperly. We respond within 30 days.
To exercise any of these rights, email support@inkurban.in from your registered account email address. We will respond within 30 days as required under the DPDP Act 2023.
Children's privacy
BakeryOS is a business management platform intended for adults operating bakery businesses. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided data through our platform, contact us at support@inkurban.in and we will delete it promptly.
Third-party links
Our website and platform may contain links to external websites such as payment provider portals, documentation resources, or partner tools. BakeryOS is not responsible for the privacy practices, content, or security of third-party websites. We recommend reviewing the privacy policy of any external site before sharing personal information with it.
Policy updates
We may update this Privacy Policy from time to time as our services evolve or as legal requirements change. When we make material changes — particularly those affecting how we collect or use your data — we will:
- Email all registered users at least 14 days before the updated policy takes effect.
- Display a notice within the BakeryOS dashboard during the notice period.
- Update the effective date at the top of this page.
Continued use of BakeryOS after the effective date constitutes acceptance of the updated Privacy Policy.
Contact us
For any privacy-related requests, questions, or complaints, contact our privacy team directly. We aim to acknowledge all requests within 3 business days and resolve them within 30 days as required under the DPDP Act 2023.
Privacy request or concern?
Email us from your registered account address with the nature of your request. We respond within 30 days.