Privacy Policy

1. Introduction & Scope

Welcome to Retales India ("retales.in", "we", "us", or "our"), operated by Retales India, having its registered operational address at 808B, DLF Prime Tower, Pocket F, Okhla Phase I, Okhla Industrial Estate, New Delhi, Delhi 110020, India. Retales provides creator growth infrastructure, video editing workflows, digital campaign orchestration, and collaborative delivery portals.

We are committed to maintaining uncompromising standards of data protection, privacy, and confidentiality. This Privacy Policy outlines our practices regarding the collection, use, processing, and protection of personal data across our web application (https://retales.in), our APIs, and integrated third-party identity providers such as Google OAuth 2.0.

3. Categories of Information We Collect

We collect only the minimum information necessary to execute creator operations and ensure service reliability:

• Identity & Profile Data: Name, work email address, profile avatar, generated platform ID, and referral codes.
• Operational & Project Data: Video project briefs, editing tasks, revision notes, asset links (e.g. Google Drive, Frame.io, Dropbox), and delivery sign-offs.
• Billing & Commercial Data: GSTIN, billing address, invoice history, payment ledger summaries, and passbook balances. All financial transactions are processed through RBI-authorized payment gateways; Retales does not store raw payment card or banking PIN numbers.
• Technical & Log Data: IP address, browser type, operating system, device identifiers, session timestamps, and security audit logs for rate limiting and fraud prevention.

4. Data Storage, Security & Encryption Standards

Retales implements enterprise-grade technical and organizational measures aligned with ISO/IEC 27001 standards and Cloud Application Security Assessment (CASA) Tier 2 guidelines:

• Encryption in Transit: All HTTP communications are enforced over TLS 1.3 / TLS 1.2 with strict HTTP Strict Transport Security (HSTS).
• Encryption at Rest: All databases, storage buckets, and server backups are encrypted using industry-standard AES-256 encryption.
• Credential Protection: Passwords for credentials-based logins are hashed using 12-round salted bcrypt. We never store passwords in plaintext.
• Session Security: User sessions are managed via cryptographically signed JSON Web Tokens (JWT) stored in secure, HttpOnly, SameSite=Lax cookies to prevent Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF).
• Role-Based Access Control (RBAC): Strict 64-bit permission bitmask controls enforce granular access boundaries across Super Admins, Chartered Accountants, Clients, Team Heads, and Freelancers.

5. Data Retention & Permanent Deletion Mechanism

We retain personal data only for as long as your account remains active or as required by applicable Indian tax and financial reporting laws (e.g., retaining statutory invoice records under the Central Goods and Services Tax Act).

Account Deletion Process: You have the absolute right to request the complete deletion of your account and associated personal data at any time:

1. Submit a deletion request by emailing hello@retales.in or grievance@retales.in with the subject line "Account Data Deletion Request" from your registered email address.
2. Upon receipt and cryptographic ownership verification, our systems will initiate data anonymization and permanent removal of your user profile, session tokens, and task comments.
3. All personal data is permanently purged from active production databases within thirty (30) business days, followed by automated backup lifecycle expiration.

6. Compliance with Indian DPDP Act, 2023 & IT Act

This Privacy Policy is formulated in strict accordance with the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

Under these regulations, you are recognized as a Data Principal entitled to the right to access, right to correction, right to grievance redressal, and right to nominate.