Privacy Policy

Malak Star Software Solutions Pvt. Ltd. ("Zerupt") operates the Zerupt retail ERP platform available at zerupt.com and app.zerupt.com. This Policy applies to all users of the Service and visitors to our website. It does not cover third-party services linked from our platform; those are governed by their own privacy policies.

We collect the following categories of information:

• Account information: your name, email address, password (stored only as a secure hash), business name, country, and preferred language.
• Authentication data: if you sign in with Google, we receive your name, email address, and profile identifier from Google. We never receive your Google password.
• Business data you provide: the records you enter into the Service, which may include personal data about your own customers, employees, and suppliers. You control this data and we process it only on your instructions.
• Usage and technical data: log files, device and browser type, IP address, pages viewed, features used, actions taken, and approximate location derived from IP address.
• Cookies and similar technologies: session tokens and preference cookies used to keep you signed in and remember your settings; optional analytics cookies to understand how the Service is used.
• Communications: messages you send to our support, sales, or feedback channels.
• Payment information: billing address and payment method details collected by our payment processor. We do not store full payment card numbers.

• To provide, operate, secure, and maintain the Service.
• To create and manage your account and authenticate you.
• To process subscription fees and payments through our payment processor.
• To respond to your requests, questions, and provide customer support.
• To monitor performance, diagnose problems, and improve features.
• To send service-related communications (for example, subscription confirmations and security alerts) and, where permitted, product updates you can opt out of.
• To detect, prevent, and address fraud, abuse, and security incidents.
• To comply with legal obligations, resolve disputes, and enforce our agreements.

We process personal data on the following legal bases:

• Contract performance: processing necessary to provide the Service you have signed up for.
• Legitimate interests: to operate and improve the Service, prevent abuse, and ensure security, where these interests are not overridden by your rights.
• Consent: for optional analytics cookies and marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation: where we are required to process data to comply with applicable law.

Your data is stored on reputable cloud infrastructure providers. Each customer account is held in a logically isolated database (per-tenant isolation), so your business data is never commingled with another customer's data at the storage layer.

We apply technical and organisational security measures including: encryption of data in transit (TLS), hashed passwords, least-privilege access controls, audit logging of all data mutations, and regular security reviews. No method of transmission or storage is completely secure. You are responsible for keeping your login credentials confidential and for reporting suspected breaches promptly.

We share your data only with trusted third parties who process it on our behalf, subject to written contracts that require appropriate confidentiality and security safeguards. Current categories of sub-processor include:

• Cloud infrastructure and hosting: providers that run our application servers and store data.
• Database services: serverless Postgres providers that host account and business records.
• Authentication: a third-party authentication provider that manages sign-in sessions.
• Google Sign-In: where you choose to authenticate with Google.
• Payment processing: Razorpay, which handles subscription billing on our behalf.
• AI and model providers: used to deliver the Service's intelligent features, processing only the minimum data required for the requested task.
• Email and communications: providers used to send transactional messages.
• Analytics: tools used to measure Service performance and usage (where optional analytics cookies are enabled).

We do not sell your personal data to any third party. We may also disclose data if required by applicable law or court order, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of substantially all assets (with appropriate notice where required by law).

Zerupt serves customers across the GCC, India, and Southeast Asia, and our infrastructure providers may process data in multiple countries. Where we transfer personal data outside the country of collection, we implement appropriate safeguards, which may include standard contractual clauses or equivalent measures required by applicable data-protection law.

We retain account data and business records for as long as your account is active and for a reasonable period after termination to allow account recovery and to meet any applicable legal, tax, or accounting obligations. After that period, data is securely deleted or irreversibly anonymised. You may request earlier deletion as set out in the 'Your rights' section below, subject to data we are legally required to retain.

Subject to applicable law, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request that inaccurate or incomplete data be corrected.
• Deletion: request that we delete your personal data.
• Portability: receive your data in a structured, machine-readable format.
• Objection and restriction: object to or ask us to restrict certain types of processing.
• Withdrawal of consent: where processing is based on your consent, withdraw it at any time without affecting prior processing.
• Complaint: lodge a complaint with a competent data-protection authority in your jurisdiction.

To exercise any of these rights, email us at hussain@zerupt.com. We will respond within the timeframe required by applicable law. Where your data is processed by us on behalf of a business customer (for example, you are an employee or customer of a Zerupt subscriber), please direct your request to that business; we will support them in their role as data controller.

We use strictly necessary cookies to operate the Service (for example, to maintain your authenticated session and remember preferences). These cannot be disabled without preventing the Service from working. We may also use optional analytics cookies to understand how users interact with our platform; these are enabled only with your consent and can be withdrawn via your browser settings or our consent banner.

The Service is a business tool intended for organisations and individuals aged 18 or over. We do not knowingly collect or solicit personal data from children under 18. If you believe a child has provided us with personal data, please contact us immediately at hussain@zerupt.com and we will delete it.

We may update this Policy from time to time to reflect changes in our practices or applicable law. We will post the revised version with an updated "Last updated" date. Where changes are material, we will provide additional notice (for example, by email or an in-app notification). Your continued use of the Service after changes take effect constitutes your acceptance of the revised Policy.

If you have any questions about this Policy, how we handle your personal data, or wish to exercise your rights, please contact us at hussain@zerupt.com, or by writing to Malak Star Software Solutions Pvt. Ltd., Banswara, Rajasthan, India.