Privacy Policy

Website Visitors

If you browse caratoserp.com, this policy covers the limited data we collect through the site itself — such as pages viewed and cookies described below.

Demo & Sales Enquiries

If you request a demo, quotation, or callback, we collect the contact and business details you submit so our sales team can respond.

Licensed Customers & Staff

If your business purchases and activates CaratOS ERP, this policy also covers the business, licensing, and account data described below for the business owner and its authorised staff accounts.

Business & Licensing Information

Company name, GST number, PAN, registered address, contact person details, and license/activation identifiers required to set up, bill, and activate your CaratOS ERP license.

Website & Contact Form Data

Name, email, phone number, and message content you submit through our contact form, book-a-demo form, or WhatsApp/email links.

Device & Usage Data

IP address, browser type, and page-visit data collected automatically on caratoserp.com to keep the site secure and to understand aggregate traffic patterns.

What We Do Not Collect

The day-to-day operational data you create inside CaratOS ERP — inventory, customer ledgers, girvi records, invoices, and accounting entries — is stored locally on your own hardware. We do not access, transmit, or store this data on our servers, except where you voluntarily share specific records with our support team to diagnose an issue.

Local Storage by Design

CaratOS ERP is built offline-first: your business records live on your own computer or authorised hardware, not in our cloud. This is a core architectural choice, not just a policy — we simply do not have a copy of your operational database.

Minimal License Telemetry

When the Software connects online, it exchanges only the minimal information needed for license verification, activation, and security validation (such as a license key and hardware identifier) — never your business records.

Support-Initiated Sharing

If you contact support with an issue, we may ask you to share specific files, logs, or screenshots to help diagnose it. We use anything you share only for that support case and do not retain it longer than necessary.

Service Delivery

To provision, license, activate, and bill your CaratOS ERP account, including AMC renewal and reactivation.

Support & Communication

To respond to support requests, and to send product updates, security notices, and service-related communications relevant to your license.

Platform Improvement

Aggregated and anonymised website and support-ticket data helps us prioritise fixes and new features.

Legal Compliance

To fulfil obligations under applicable Indian laws, including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and rules framed thereunder.

Encryption in Transit

Traffic to our website and license-activation servers is protected with TLS/SSL encryption. Where we store passwords for portal or support-ticket accounts, they are hashed using industry-standard one-way algorithms.

Access Controls

Only authorised personnel who need it for billing, licensing, or support purposes can access your business and contact information; role-based access applies internally.

Your Local Data Is Your Responsibility

Because operational business data resides on your own systems, its security, access control, and backup are ultimately your responsibility — see the Backup Responsibility clause in our Terms & Conditions.

Vulnerability Management

Our engineering team conducts periodic security reviews of our website and licensing infrastructure and promptly patches known vulnerabilities.

No Sale of Data

We do not sell, rent, or trade your personal or business data to third parties under any circumstances.

Trusted Service Providers

We may share limited data with carefully vetted service providers — such as cloud hosting for our website and license servers, payment gateways for AMC billing, and email/communication tools — strictly to deliver the services you have subscribed to. These providers are bound by confidentiality obligations.

Legal Obligations

We may disclose information when required by law, court order, or government authority, or to protect the rights and safety of the Company and its users.

Essential Cookies

We use strictly necessary cookies on caratoserp.com to keep the site functioning and to remember basic preferences. These cannot be disabled without affecting core functionality.

Analytics Cookies

With your consent, we use analytics cookies to understand how visitors use the site so we can make targeted improvements.

Managing Cookies

You can control cookie preferences through your browser settings. Disabling certain cookies may limit some website functionality; it does not affect CaratOS ERP itself, which does not depend on website cookies.

Access, Correction & Deletion

You may request a copy, correction, or deletion of the business, contact, or licensing data we hold about you, subject to legal retention requirements (such as tax and billing records).

Withdraw Consent

Where we rely on your consent — for example, for analytics cookies or marketing communications — you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Rights Under Indian Law

As applicable, you have rights under the Digital Personal Data Protection Act, 2023 and the IT (Reasonable Security Practices and Sensitive Personal Data) Rules, 2011, including the right to grievance redressal set out below.

Grievance Officer

For any complaint about how we handle your data, contact our Grievance Officer at support@caratoserp.com. We will acknowledge your complaint and aim to resolve it within 30 days, as required under Indian law.

Not Directed at Minors

CaratOS ERP and caratoserp.com are business tools intended for use by adults acting on behalf of a jewellery business. We do not knowingly collect personal data from individuals under 18 years of age, and we will delete any such data if we become aware of it.

Where Data Is Processed

The limited business, licensing, and contact data we hold is stored on servers located in India. Because your operational business data stays on your own hardware by design, it is not transferred to us or abroad in the first place.

Retention Period

We retain business, licensing, and billing data for as long as your license or AMC relationship is active, and thereafter for as long as required by Indian tax and accounting law (typically 7 years for financial records). Non-statutory data is deleted or anonymised within a reasonable period after it is no longer needed.