⚠ DRAFT — NOT LEGAL ADVICE. This template is written to reflect how Rydax actually stores and processes data today (Supabase for the database and authentication, Cloudinary for uploaded files, Razorpay for payments). It has not been reviewed by a lawyer and should be checked against the Digital Personal Data Protection Act, 2023 (DPDP Act) and its rules before publishing. Every [bracketed] field needs your actual details filled in.
Last updated: 15 August 2026
This Privacy Policy explains how Rydax ("Rydax", "we", "us", "our") collects, uses, stores, and protects information in connection with the Rydax platform (the "Service").
This policy applies to two categories of people: (1) Company Admins and users who sign up for and use Rydax on behalf of a construction company, and (2) individuals whose personal data is entered into Rydax by a Company Account (for example, employees, subcontractors, or labourers of a Rydax customer).
For data entered into a Company Account (employee records, attendance, salary, etc.), the Company Account holder (your employer or the business that added your data) is the Data Fiduciary under the DPDP Act, and Rydax acts as a data processor providing the underlying technology. If you are an individual whose data appears in someone else's Rydax account and you have a question about that data, you should contact that company directly; we will assist them in responding to you as required by law.
For data you provide to us directly as a Company Admin (e.g. signup details, billing contact), we act as the Data Fiduciary.
We use the information described above to: - Provide, operate, and maintain the Service, including tenant data isolation so no Company Account can see another's data; - Authenticate users and secure accounts; - Process subscription payments and maintain billing records; - Communicate with you about your account, service updates, or support requests; - Comply with legal obligations (e.g. tax, accounting, or regulatory record-keeping); - Improve and troubleshoot the Service.
We do not sell personal data to third parties, and we do not use Customer Data (employee records, financial data, etc.) for advertising purposes.
Rydax is built on Supabase (database and authentication) and Cloudinary (file storage). Depending on the specific infrastructure region configured for this project, data may be stored on servers located server region to be confirmed. If data is stored or processed outside India, this is done through our infrastructure providers' standard data processing agreements, and we take reasonable steps to ensure an equivalent standard of protection.
We use industry-standard measures to protect data, including: - Row-Level Security (RLS) enforced at the database level, so that even in the event of an application bug, one company's data cannot be read or modified by another company's users — this is enforced by the database itself, not just the application. - Encrypted connections (HTTPS/TLS) for all data in transit. - Password hashing (passwords are never stored in plain text). - Role-based access control within each Company Account, configurable by that company's own admins.
No system can be guaranteed 100% secure. If we become aware of a data breach affecting your information, we will notify affected Company Accounts and, where required by law, the relevant data protection authority, without undue delay.
We retain Customer Data for as long as a Company Account remains active. If a Company Account is cancelled or terminated, we retain data for a limited period (currently 30 days) to allow for export or reactivation, after which it is deleted from active systems, except where we are legally required to retain specific records for longer (e.g. financial records under applicable tax law).
Subject to applicable law (including the DPDP Act, 2023), individuals whose personal data is processed through Rydax have the right to: - Access the personal data held about them; - Request correction of inaccurate data; - Request erasure of their data, subject to our legal retention obligations; - Withdraw consent, where processing is based on consent; - Nominate another individual to exercise these rights on their behalf in the event of death or incapacity; - Raise a grievance with our Grievance Officer (see Section 9), and thereafter with the Data Protection Board of India, if unresolved.
Where the personal data in question was entered by a Company Account (e.g. an employee's records entered by their employer), please raise the request with that company first — we will support them in responding as their processor.
We share data with the following categories of third-party service providers, solely to the extent necessary to operate the Service:
| Provider | Purpose | Data Involved |
|---|---|---|
| Supabase | Database hosting, authentication | All Customer Data, login credentials (hashed) |
| Cloudinary | File/document/photo storage | Uploaded documents and images |
| Razorpay | Payment processing | Payment amount, order reference (not card/bank details) |
We do not permit these providers to use your data for their own purposes beyond providing their service to us.
In accordance with applicable law, you may contact our Grievance Officer with any privacy-related complaint or request:
Name: Grievance Officer name — to be confirmed Email: admin@rydax.in Address: Registered address — to be confirmed
We will acknowledge and address grievances within the timeframes required by applicable law.
Rydax is a business tool intended for use by companies and their adult employees. We do not knowingly collect personal data from individuals below the age of 18 for the purpose of creating a Rydax user account. Where an employer enters basic identity data of a minor employee strictly for statutory workforce compliance purposes where legally required, that data is handled under the same protections as any other employee record.
We may update this Privacy Policy from time to time. We will post the updated policy with a new "Last updated" date and, for material changes, provide additional notice where required by law.
Rydax Registered address — to be confirmed admin@rydax.in