What Kesarpro does with data - stated plainly.

As a business system, Kesarpro processes the data your business chooses to put into it - customer contact records, sales transactions, inventory movements, staff attendance, payroll registers, ledger entries and everything that follows from them.

This data is yours. You are the controller of it in every legal sense. Kesarpro is a processor operating on your instructions, expressed by the way you configure and use the product.

We collect a small, specific set of information about the humans who use Kesarpro:

• Account identity - name, email, role, and workspace association.
• Authentication events - login attempts, session identifiers, MFA state.
• Audit metadata - which user performed which action, at what time, on which device.
• Product telemetry - counts of features used, errors observed, response times.

We use this to keep the product secure, to fix bugs quickly, and to prioritise the modules and workflows that are actually being used.

Transactional data is stored in dedicated per-tenant schemas so no query can traverse across customers. Data is encrypted at rest using AES-256 and in transit using TLS 1.2 or newer.

Backups are taken on a set cadence, retained for a defined period, and their restoration is drilled regularly. Access from our operations team follows least-privilege, and every access is logged.

We use a small number of infrastructure and service providers to run Kesarpro - primarily cloud hosting, email delivery, and analytics. A current list of sub-processors, including their purpose and processing region, is available on request as part of contracting.

Business data is retained for the life of your subscription and for a limited grace period after termination, so a re-instatement is possible. On written request, we will delete or return data outside that grace period. Statutory retention obligations under Indian tax and finance laws may extend some data beyond a customer's request, for compliance purposes.

As the person or business whose data is being processed, you can ask us to correct, export or delete your data. Requests should come from an account administrator, be authenticated, and can be sent through the contact page. We acknowledge within two business days and act within a reasonable window - typically thirty days - unless a legal hold applies.

Product-critical communication - service alerts, security notices, statutory updates - is sent to account administrators and cannot be unsubscribed while the account is active. Marketing communication is opt-in and can be turned off in your account settings.

We use a minimal set of cookies to keep you signed in and to remember your workspace. Analytics on the marketing website are aggregated and non-identifying. We do not sell data of any kind to third parties.

This notice is versioned. Material changes are communicated to account administrators before they take effect, so no significant change surprises you on a random Tuesday morning.