Privacy Policy

01Who this policy applies to

This policy applies to:

• Account holders — owners and staff who sign up and log in
• Business administrators — owners who configure business settings and invite staff

If you are a customer or supplier of a MaterialOS user (for example, a contractor whose details appear on an invoice), that shop owner entered your information into their account. The shop owner controls that data. Contact them directly for questions about how they use your information.

02What MaterialOS is

MaterialOS is a cloud business management tool for Indian retailers. It helps shops record sales, purchases, stock, customer credit (udhaar), and reports. It is not accounting software, not an ERP, and does not file GST returns. It produces GST registers your accountant can use.

03Data we collect

We do not use advertising trackers. We do not sell your data.

04How we use your data

We use your data to:

• Provide and operate the MaterialOS service
• Authenticate you and enforce role-based access within your business
• Isolate your business data from other MaterialOS customers
• Send transactional emails through Cloudflare (staff invitations, account-related notices), delivered via our authentication provider's mailer
• Process subscription payments through Razorpay
• Respond to support requests
• Maintain security and prevent abuse
• Comply with applicable law

We do not use your business transaction data for advertising or sell it to third parties.

05Legal basis (India)

We process personal data to provide the service you signed up for, based on your agreement to our Terms of Service and, where required, your consent. For data you enter about your customers and suppliers, you are responsible for having a lawful basis to collect and use that information.

06How we store and protect data

Your data is stored in a PostgreSQL database hosted by Supabase in Mumbai, India (AWS region ap-south-1). Application hosting and content delivery run on Cloudflare, which may process request metadata on its global network. Access is restricted by authentication, row-level security policies, and business-level data isolation.

We use industry-standard measures including encrypted connections (HTTPS), hashed passwords, and access controls. No online service can guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you as required by law.

07Who we share data with

We share data only with service providers who help us run MaterialOS:

These providers process data on our instructions and under contractual obligations. We do not share your business data with other MaterialOS customers or with advertisers.

We may disclose data if required by law, court order, or government request, or to protect the rights and safety of Scopelyt, our users, or others.

08Data retention and deletion

We keep your data for as long as your account is active.

Account deletion: You can delete your account from Settings → Account → Delete account in the app or web app. See Account deletion below.

After you delete your account: login and profile records for that business are removed immediately, as described under Account deletion. We delete or anonymize remaining business data within 6 months, except where we must retain specific records for legal, tax, or security reasons. During this period, remaining business data is not accessible through the app.

You can export your business data using built-in CSV and PDF export features before deleting your account.

We retain a minimal record of your agreement to our Terms and Privacy Policy (timestamp, policy versions, and purposes consented to, linked to a pseudonymous identifier) for up to seven years after acceptance to demonstrate compliance with applicable law. This record does not include your email or account details after account deletion.

Authorized Scopelyt personnel may access account metadata (such as your name, email, business name, and subscription status) to provide support. Access is limited to appointed personnel, requires multi-factor authentication, and is logged with the identity of the accessor, the time of access, and the reason where required. Logs of this access are retained for up to seven years.

09Your rights

Under applicable Indian law, including the Digital Personal Data Protection Act, 2023, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (subject to legal retention requirements)
• Withdraw consent where processing is consent-based
• Nominate another person to exercise your rights in the event of death or incapacity

To exercise these rights, email legal@scopelyt.com. We will respond within the timeframe required by law.

Privacy and data protection contact: Email: legal@scopelyt.com Address: 470, New Colony, Nandan Nagar, Belgharia, Kolkata - 700083, India

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India as provided under applicable law.

10Mobile apps

The MaterialOS mobile apps (Android and iOS) are secure wrappers around our web application. They require internet access to operate. For Bluetooth thermal printing they may request Bluetooth permissions. On some Android versions, location permission may also be requested solely because the platform ties Bluetooth device discovery to location access. The apps do not use location to track you, and they do not access your phone contacts or camera. On iOS, system Bluetooth usage strings explain that Bluetooth is used to connect to thermal receipt printers. USB OTG may be used on Android only to talk to a connected thermal printer. All other data processing described in this policy applies equally to use via browser or the mobile apps.

11Children's privacy

MaterialOS is a business tool for shop owners and staff. It is not directed at children under 18. We do not knowingly collect data from children. If you believe a child has provided us personal data, contact legal@scopelyt.com and we will delete it.

12International transfers

Your account and business data are primarily stored in India (Supabase, Mumbai, ap-south-1). Cloudflare may process request metadata on its global edge network and delivers transactional email globally via our authentication provider's mailer. We take steps required under applicable Indian law for cross-border transfers, including contractual safeguards with our service providers.

13Changes to this policy

We may update this policy from time to time. We will post the revised version on this page and update the "Last updated" date. For material changes, we will notify account holders by email or in-app notice where appropriate. Material changes require explicit re-acceptance at your next login before you can continue using the app.

15Contact us

Scopelyt Technologies Private Limited CIN: U62011WR2026PTC293167 Registered office: 470, New Colony, Nandan Nagar, Belgharia, Kolkata - 700083, India Privacy and data protection: legal@scopelyt.com Support: help@scopelyt.com