Cloud GTX

Cloud GTX Privacy Notice

This notice explains how Gravitorix Technologies Pvt Ltd (“Gravitorix”, “we”), as data fiduciary, handles personal data when you use the Cloud GTX websites and services. For personal data contained in the workloads and content you run on the services (“Customer Content”), you are the data fiduciary and we process it only on your behalf to provide the services.

1. Personal data we collect

  • Account data — name, email address, password (stored only as a salted hash), MFA enrolment, and the organisations and roles you belong to.
  • Billing data — organisation name, billing address, GSTIN, invoice history, and payment references. Card and banking details are collected and processed by our payment gateway; we store only gateway references, never card numbers.
  • Usage and telemetry — metering records for the resources you run, console activity, API request logs including IP address and user-agent, and login history including IP address, used for security and billing.
  • Support communications — tickets, messages, and notification preferences.

2. How we use personal data

  • To provide, operate, and secure the services — authentication, tenant isolation, fraud and abuse prevention.
  • To meter usage, generate GST invoices, collect payment, and send billing communications including payment reminders and budget alerts you configure.
  • To provide support you request and to send service notifications (e.g. maintenance, incidents, invoices). We do not sell personal data or use it for third-party advertising.
  • To comply with law — tax, accounting, and lawful requests from authorities.

3. Basis of processing and consent

We process personal data with your consent given at signup and for the legitimate uses recognised by the Digital Personal Data Protection Act, 2023 — performing the agreement you accepted, complying with law, and securing the services. You may withdraw consent by closing your account; processing needed to meet statutory retention duties continues after withdrawal.

4. Sharing

  • Processors — payment gateway (payment processing), email delivery, and infrastructure providers, each bound by contract to process data only on our instructions.
  • Legal — where required by law, regulation, or enforceable request from a competent authority.
  • Business transfers — as part of a merger, acquisition, or asset sale, subject to this notice.

5. Where data is stored

Cloud GTX platform data, including Customer Content and personal data, is stored on infrastructure located in India.

6. Security

We protect personal data with encryption in transit, encrypted storage of credentials and secrets, role-based access control, multi-factor authentication, tenant isolation, and append-only audit logging of administrative access. Report suspected security issues to support@gravitorix.com.

7. Cookies

The Site uses only essential cookies: session cookies that authenticate you to the console. We do not use advertising or cross-site tracking cookies.

8. Retention

  • Account data — for the life of the account and up to 90 days after closure, except where longer retention is required by law.
  • Invoices and financial records — at least 8 years, as required by Indian tax and companies law.
  • Audit logs — at least 3 years.
  • Raw usage records — 13 months, after which they are deleted or aggregated.
  • Customer Content — retrievable for 30 days after termination (see the Customer Agreement), then deleted.

9. Your rights

Under the DPDP Act you may access and obtain a summary of your personal data, correct or complete it, request erasure where retention is no longer required, nominate a person to exercise your rights in case of death or incapacity, and raise a grievance. Most account data can be viewed and corrected directly in the console (Security and Members pages); for anything else, or to exercise any right, write to privacy@gravitorix.com. We respond within the timelines prescribed by law, and you may escalate to the Data Protection Board of India if unsatisfied.

10. Children

The services are for business use by persons aged 18 or over. We do not knowingly collect personal data of children.

11. Grievance Officer

Grievance Officer: [TO BE APPOINTED] · privacy@gravitorix.com · Gravitorix Technologies Pvt Ltd

12. Changes to this notice

We may update this notice from time to time. The version posted here, with its version number and effective date, is the one in force; material changes are notified by email or console notification.