Compliance & Governance
Privacy Policy
1. Introduction & Scope
Ascelstack Technologies (“Ascelstack”, “we”, “our”, or “us”) operates as a multi-disciplinary technology and business operations partner. We deliver software engineering, digital growth, e-commerce infrastructure, autonomous AI automation workflows, and corporate compliance services through our website at ascelstack.com, our client portal, and our custom client deployments (collectively, the “Services”).
This Privacy Policy governs how we collect, store, process, transfer, and protect personal data and confidential business information provided by visitors, clients, prospective clients, and authorized representatives. We operate in strict compliance with applicable data protection frameworks, including the Digital Personal Data Protection Act, 2023 (DPDPA) of India, the Information Technology Act, 2000, and where applicable, the European Union General Data Protection Regulation (GDPR) and UK Data Protection Act.
2. Information We Collect
Depending on how you interact with Ascelstack, we collect and process several categories of information:
Account & Contact Data
Your name, business email address, direct phone/WhatsApp number, company name, billing address, and job title collected via consultation forms, client onboarding, or contract execution.
Client Operational Data
API keys, webhook endpoints, database connection strings, inventory records, and CRM customer records furnished by you strictly to configure custom software and automation pipelines.
Statutory & Filing Documents
For regulatory, licensing, and compliance services (e.g. GST registration, FSSAI, MCA company formation, trademark filing): PAN, Aadhaar, Certificate of Incorporation, director identification, and financial statements.
Technical & Usage Logs
IP addresses, browser type, device identifiers, referring URLs, operating systems, and anonymous telemetry metrics captured to monitor infrastructure stability and prevent cyber attacks.
3. AI & Automation Data Ethics
Ascelstack guarantees that no client confidential data, proprietary source code, operational spreadsheets, financial records, or customer personal data is ever used, rented, or contributed to train, fine-tune, or improve public foundation artificial intelligence models.
When building automated AI workflows (such as order reconciliation bots, invoice parsing engines, or WhatsApp customer service agents):
- Enterprise Zero-Retention APIs: We integrate exclusively with enterprise-tier API endpoints (Anthropic Claude, OpenAI Enterprise, Google Gemini Vertex) that offer contractual zero-day data retention commitments.
- Payload Encryption: Transient workflow payloads passing through background workers are encrypted in flight and purged from cache immediately upon step completion.
- Human-in-the-Loop Governance: Automated workflows involving financial payouts, legal filings, or sensitive data deletions require authenticated human sign-off before committing irreversible actions.
4. Legal Grounds for Processing
We process your data under the following recognized legal grounds:
- Performance of Contract: Processing necessary to fulfill our service agreements, build custom applications, manage cloud servers, and deliver agreed-upon scopes of work.
- Compliance with Legal Obligations: Processing required under Indian tax statutes (Goods and Services Tax Act, Income Tax Act), Companies Act, and licensing requirements.
- Legitimate Interests: Securing our networks, preventing fraud, managing client relationship history, and monitoring service performance.
- Consent: Explicit opt-in consent for email notifications, marketing communications, and non-essential cookies, which may be revoked at any time.
5. How We Use Your Information
We use collected data solely for legitimate business purposes:
- Delivering, configuring, and supporting our 232 catalogue services across Build, Grow, and Run.
- Provisioning staging, preview, and production cloud infrastructure on your behalf.
- Executing statutory filings with regulatory bodies including the Ministry of Corporate Affairs (MCA), Goods and Services Tax Network (GSTN), Intellectual Property India, and FSSAI.
- Generating transparent invoices, milestone receipts, and processing transactions through regulated payment processors.
- Communicating project sprint updates, security advisories, and architecture diagnostics.
6. Sub-Processors & Data Sharing
Ascelstack does not sell, rent, or trade your personal or business data. We share data only with vetted third-party sub-processors necessary to run the Services:
| Provider | Role | Security Framework |
|---|---|---|
| Cloudflare, Inc. | Edge DNS, CDN, WAF, Serverless Workers runtime | SOC 2 Type II, ISO 27001, PCI-DSS |
| Neon Database Inc. | Serverless PostgreSQL database storage | SOC 2 Type II, encrypted at rest (AES-256) |
| Clerk, Inc. | Client portal identity authentication & session security | SOC 2 Type II, CCPA, GDPR compliant |
| Stripe / Razorpay | Payment gateway processing & PCI-DSS compliance | PCI-DSS Level 1 certified gateway |
| Chartered Accountants & Legal Associates | Statutory GST, MCA, and compliance filing execution | Bound by statutory professional confidentiality and Ascelstack NDAs |
7. Data Security & Storage
We employ state-of-the-art technical, physical, and administrative safeguards designed to protect your data against unauthorized access, disclosure, alteration, or destruction:
- Encryption: All network communication is enforced with TLS 1.3 encryption. All static data and database volumes are encrypted using AES-256 algorithms.
- Principle of Least Privilege: Only engineers, architects, or legal associates directly assigned to your specific pod hold access to your project environment.
- Credential Isolation: Client API keys and third-party secrets are held in isolated secrets stores (Cloudflare Secrets Store / encrypted environment variables), never logged in plain text or committed to git repositories.
- Audit Logging: System and portal activities are recorded in immutable logs for security incident tracking and continuous monitoring.
8. Data Retention & Destruction
We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, and compliance reporting requirements:
- Active Client Accounts: Retained for the duration of the engagement plus 90 days following offboarding, after which database instances and repository access are securely purged.
- Statutory Invoices & Tax Records: Retained for a mandatory period of 7 years in compliance with Section 44AA of the Indian Income Tax Act and GST regulations.
- Consultation Enquiries: Inactive prospective consultation briefs that do not lead to an engagement are permanently deleted after 12 months.
10. Your Privacy Rights
Under applicable Indian and global data protection laws, you possess the following rights:
- Right of Access & Summary: You may request a structured copy of the personal data we hold about you.
- Right to Correction & Updating: You may request immediate correction of inaccurate or incomplete information.
- Right to Erasure (“Right to Be Forgotten”): You may request the deletion of your personal data, subject to statutory tax and legal retention requirements.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting lawful processing performed prior to withdrawal.
- Right to Nominate: Under DPDPA 2023, you have the right to nominate an individual to exercise your rights in the event of incapacity or death.
To exercise any of these rights, email your request to privacy@ascelstack.com with the subject line “Data Subject Rights Request”.
11. International Transfers
Ascelstack operates out of India and utilizes globally distributed edge networks. When client data is transferred across international borders, we ensure adequate protection mechanisms are in place, including standard contractual clauses, international adequacy safeguards, and SOC 2 Type II certified sub-processors.
12. Grievance Officer & Contact
In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, the details of our designated Grievance Redressal Officer are published below: