Privacy Policy
Operated by VLINTIOS OPC Private Limited · Vijayawada, Andhra Pradesh, India
Legal Framework
This Privacy Policy is drafted in compliance with:
- Digital Personal Data Protection Act, 2023 (DPDP Act)
- Digital Personal Data Protection Rules, 2025 (notified November 13, 2025; full enforcement by May 13, 2027)
- Information Technology Act, 2000 (IT Act)
- IT (Reasonable Security Practices and SPDI) Rules, 2011
- IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
- Consumer Protection Act, 2019
- Goods and Services Tax Act, 2017 (for mandatory data retention)
1. Who We Are
VLINTIOS OPC Private Limited is a One Person Company incorporated under the Companies Act, 2013, registered in Andhra Pradesh, India. We operate the TRYMORZO platform at trymorzo.com and its subdomains (“Platform”).
Under the DPDP Act 2023, we are the Data Fiduciary — the entity that determines the purpose and means of processing your personal data.
2. Who This Policy Applies To
3. Data We Collect
- Full name, email address, mobile phone number
- Password (stored as a one-way cryptographic hash — never in plain text)
- Profile photograph (optional)
- Shop name, type, description, address, pincode, state
- GSTIN and business PAN (where provided)
- Shop logo and branding assets, business hours
- Subdomain preference for your free website (e.g., yourshop.trymorzo.com)
- Name, phone number, email address, delivery address
- Purchase history, outstanding balances, payment status
- Optical shop specific: Prescription data — SPH, CYL, Axis, PD, Addition power, clinical notes. This is sensitive personal data under SPDI Rules 2011.
- Delivery addresses and delivery status
This customer data belongs to you. You are the Data Fiduciary for your customers' data under the DPDP Act. We process it only on your instructions. See Section 11 for your obligations.
- Product names, descriptions, categories, and images
- SKU codes, barcode numbers, purchase/selling prices, GST rates
- Stock quantities, reorder levels, supplier information
- Invoice numbers, dates, line items
- GST breakdown (CGST, SGST, IGST), HSN/SAC codes
- Discounts, advance payments, balance due
- Payment method, payment status, timestamps
- Team member names, email addresses, phone numbers
- Role and permission level, login activity timestamps
- Performance metrics (sales generated, invoices created)
- Pages and features accessed, time spent, actions taken
- Error events and crash logs, feature usage frequency
- IP address, browser type, operating system, device type
- Screen resolution, language settings, referring URL
TRYMORZO is currently free — we do not process any payments, and we do not collect or store card numbers, CVVs, UPI IDs, net banking credentials or bank account details.
4. How We Use Your Data
| Processing Activity | Lawful Basis |
|---|---|
| Account creation and management | Contract + Consent |
| Operating shop management features | Contract |
| Generating GST-compliant invoices | Contract |
| Delivering invoices via WhatsApp / Email | Contract (your instruction) |
| Generating your free shop website | Contract |
| Powering tryVLINK AI responses (session-only) | Contract |
| Sending account notifications | Contract |
| Sending product update emails | Consent (opt-out available) |
| Platform security and fraud detection | Legitimate interest |
| Debugging and error resolution | Legitimate interest |
| Aggregated, anonymised platform analytics | Legitimate interest |
| GST record-keeping and tax compliance | Legal obligation (CGST Act 2017) |
| Responding to legal orders or government requests | Legal obligation |
- Advertise to you or your customers
- Sell to data brokers or marketing companies
- Train external AI models on identifiable data
- Share with competing software companies
5. Consent
5.1 How We Obtain Consent
Under DPDP Rules 2025 (Rule 3), consent must be informed, specific, and freely given. We obtain it:
- At account registration, via an explicit checkbox linking to this policy and our Terms & Conditions
- For optional features (e.g., marketing emails), via a separate opt-in
- For any new processing purpose introduced after account creation, via a fresh consent request
5.2 Withdrawing Consent
You may withdraw consent at any time by:
- Emailing trymorzo@gmail.com
- Using Account Settings > Data & Privacy within the Platform
Withdrawal for essential processing (account operation) will require account closure. Withdrawal for non-essential processing (marketing emails) will not affect your account.
5.3 Consent Records
We maintain records of when consent was given, the policy version consented to, and any changes. Available to you on request.
6. Third-Party Services and Data Sharing
We share your data only with service providers necessary to operate the Platform. These are our sub-processors under the DPDP Act.
- Sell your data or your customers' data to any third party
- Share your data with advertising networks
- Share your shop data with competing businesses
- Use your customers' data to market to them on our own behalf
7. Data Retention
| Data Category | Retention Period | Reason |
|---|---|---|
| Account and profile data | Duration of account + 90 days | Service continuity and deletion processing |
| Shop and business configuration | Duration of account + 90 days | Service continuity |
| Invoice records | 7 years from invoice date | CGST Act 2017, Section 35 — mandatory |
| Payment records and transaction logs | 7 years | Income Tax Act 1961; GST law — mandatory |
| Customer data entered by shop owners | Until deleted by shop owner, or account deletion + 90 days | Data minimisation |
| Employee / team member data | Until removed + 90 days | Service continuity |
| Server and access logs | 90 days | Security, debugging |
| Support correspondence | 3 years from ticket closure | Dispute resolution |
| Consent records | 7 years | DPDP Act compliance audit |
| Deleted account data (non-invoice) | Purged within 90 days of deletion request | DPDP Act erasure obligation |
Invoice and payment records are retained for 7 years regardless of account deletion, as mandated by Section 35 of the CGST Act, 2017 and the Income Tax Act, 1961. We will inform you of this retention upon account deletion request.
8. tryVLINK AI Assistant — Privacy Practices
- Session-only: Conversation history is not stored after you close the session or log out.
- Live data queries: tryVLINK reads your real-time Firestore data to respond. It does not learn from or train on your shop data.
- No external AI training: Your data and queries are not used to train any external AI model.
- Accuracy disclaimer: AI responses may contain errors. Do not make critical financial, tax, or legal decisions based solely on tryVLINK without independent verification.
- AI labelling: Where Indian law requires labelling of AI-generated content, we will comply.
9. Your Free Shop Website
- Your shop name, description, address, phone, and product catalog are published publicly on yourshop.trymorzo.com.
- This data is indexed by search engines.
- Contact form submissions from website visitors (name, phone) are stored in your account.
- If you close your account, your website will be taken offline within 90 days.
- The subdomain (yourshop.trymorzo.com) is owned by VLINTIOS — see Terms & Conditions for subdomain ownership terms.
10. Cookies and Local Storage
| Type | Purpose | Can You Opt Out? |
|---|---|---|
| Essential cookies | Authentication session tokens, CSRF protection, security state | No — Platform cannot function without these |
| Functional / localStorage | Last-used shop preference, UI settings | Yes — clear browser storage |
| Performance (server-side, aggregated) | Understanding feature usage patterns — anonymised, no personal data | Yes — contact trymorzo@gmail.com |
We do not use advertising cookies, cross-site tracking technologies, or Google Analytics with personal identifiers.
11. Your Rights as a Data Principal (DPDP Act 2023)
To exercise any right, email trymorzo@gmail.com with subject line “Data Rights Request — [type of request]”.
12. If You Are a Shop Customer
- To exercise rights (access, correction, erasure) over your data, contact the shop owner directly.
- If you cannot reach the shop, email trymorzo@gmail.com and we will assist where possible.
- We implement technical safeguards (Firestore rules, encryption, access controls) to protect your data from unauthorized access.
13. Children's Privacy
TRYMORZO is intended for adults operating businesses. We do not knowingly collect data from individuals under 18. Under DPDP Rules 2025, processing children's data requires verifiable parental consent. If we discover a user is under 18, we will suspend the account and delete associated data within 72 hours.
Report concerns to trymorzo@gmail.com.
14. Data Security
Technical Measures
- HTTPS / TLS 1.2+ encryption for all data in transit
- Firebase Firestore security rules restricting access to authenticated, authorised users only
- One-way cryptographic hashing of all passwords (Firebase Auth)
- Role-based access control within the Platform
- Cloudinary signed URLs for secure invoice PDF access
- Secrets and environment variables managed outside version control
Organisational Measures
- Production data access limited to authorised personnel only
- Vendor agreements include data confidentiality obligations
- No third-party analytics tools with access to identifiable user data
Breach Response
- Notify affected users within 72 hours of becoming aware of a breach
- Notify the Data Protection Board of India within the DPDP Rules 2025 specified timeline
- Disclose: nature of breach, data categories affected, likely consequences, steps taken
Responsible vulnerability disclosure: trymorzo@gmail.com
15. Cross-Border Data Transfers
Firebase and Cloudinary may store data in servers outside India. As of June 2026, the Government of India has not issued notifications under the DPDP Act restricting transfers to specific countries. We will update this section if restrictions are notified. We rely on our sub-processors' standard contractual protections and international certifications (ISO 27001, SOC 2).
16. Grievance Officer
Grievance Process:
- Submit complaint to trymorzo@gmail.com
- Acknowledgement within 24 hours (IT Rules 2021)
- Resolution within 30 days of receipt
- If unresolved, escalate to the Grievance Appellate Committee within 30 days of GO's decision
- You may also approach the Data Protection Board of India under DPDP Act Section 28
17. Changes to This Policy
- “Last updated” date will be revised at the top
- You will be notified via email at least 14 days before material changes take effect
- A notice will appear within the Platform for 30 days
- Previous versions archived at trymorzo.com/privacy/archive
Continued use after changes take effect constitutes acceptance.
18. Governing Law and Jurisdiction
This policy is governed by the laws of India. Disputes are subject to the jurisdiction of courts in Vijayawada, Andhra Pradesh, subject to your rights under the Consumer Protection Act, 2019.
19. Contact Directory
| Matter | Contact |
|---|---|
| General privacy enquiries | trymorzo@gmail.com |
| Grievance Officer | trymorzo@gmail.com |
| Data access / correction / erasure requests | trymorzo@gmail.com |
| Security vulnerability disclosure | trymorzo@gmail.com |
| All other support | trymorzo@gmail.com |
| Postal address | VLINTIOS OPC Private Limited, Vijayawada, Andhra Pradesh, India |