Privacy policy

This policy follows the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. By using the Service and clicking “I agree”, you consent to the processing described here. You may withdraw consent at any time (see section 8).

1. Who is responsible

Prastavone is a product of Bildara, owned and operated by Kinjal Jay Joshi, Ahmedabad, Gujarat, India. Bildara is the Data Fiduciary for account, billing, website and security data. For content your organisation adds to its workspace (including your clients’ details), your organisation is the Data Fiduciary and Bildara acts as its Data Processor.

2. What we collect

• Account data: name, Google email address, profile picture link, role, designation and invitation details.
• Consent records: which version of these terms you accepted and when.
• Workspace content: proposals, client and contact details, products, prices, pictures, attachments and notes added by your team. This is encrypted in your browser before it is stored.
• Billing data: plan, invoices, GSTIN and payment status. Card, UPI and bank details are collected by Razorpay, not by us.
• Website enquiries: name, email, company, phone and message you send through the contact form (sealed so only our Admins can read them).
• Security logs: sign-ins, sign-outs, invitations, role changes, deletions, backups and the browser type, to protect the Service and investigate misuse.

We do not intentionally collect sensitive personal data such as passwords, financial account numbers, health or biometric data. Do not put such data in proposals unless your organisation is entitled to and has a lawful basis.

3. Why we use it

To create and secure your account; provide, maintain and improve the Service; process subscriptions and invoices; respond to enquiries and support requests; send service and security messages; prevent fraud and abuse; and meet legal obligations. We do not sell personal data, do not use workspace content for advertising, and do not use it to train artificial-intelligence models.

4. Your clients’ data

If you add personal data about your clients or their staff, you must have a lawful basis and give them any notice required by the DPDP Act. We process that data only on your instructions to provide the Service. Requests from those people should be sent to your organisation; if they reach us, we will forward them.

5. Sharing

• Service providers who process data for us under contract: Google LLC / Google Cloud India (hosting, sign-in, database) and Razorpay Software Pvt. Ltd. (payments).
• Your workspace: other members of your workspace can see what Admins share with them.
• Legal reasons: where required by law, court order or a lawful request by a government agency, or to protect the rights, safety and property of users, the public, Bildara or Kinjal Jay Joshi.
• Business transfer: if the Service is transferred to a successor, under terms at least as protective as this policy.

6. Where it is stored and how it is protected

The database is hosted by Google Cloud in Mumbai, India. Some Google sign-in and network services may process data in other countries permitted under the DPDP Act. Security measures include HTTPS with HSTS; AES-256-GCM encryption of workspace content in the browser before storage; enquiries sealed with RSA-3072; server-side access rules; invitation-only Gmail access; automatic sign-out after inactivity; password-protected backups; and an append-only security log. If a personal data breach occurs, we will inform affected users and the Data Protection Board of India as the law requires.

7. How long we keep it

Workspace content: while the workspace is active and up to 30 days after it is closed (plus up to 90 days in expiring hosting backups). Security logs: up to 1 year. Enquiries: up to 24 months. Billing and tax records: as long as Indian law requires (usually 8 years). Consent records: as long as needed to prove consent.

8. Your rights

Under the DPDP Act you may: get a summary of your personal data and how it is processed; ask us to correct, complete, update or erase it; withdraw consent (this does not affect earlier processing, and some features may stop working); nominate another person to exercise your rights in case of death or incapacity; and complain to our Grievance Officer. If you are not satisfied with our response, you may complain to the Data Protection Board of India. Send requests to our contact form.

9. Cookies and browser storage

We use only strictly necessary browser storage. See our Cookie policy.

10. Children

The Service is for businesses and is not meant for anyone under 18. We do not knowingly process children’s personal data.

11. Changes

We will post updates here and, for material changes, ask you to accept the new version in the app.

12. Grievance Officer

Kinjal Jay Joshi, Bildara, Ahmedabad, Gujarat, India. Contact: our contact form. See Grievance redressal.