Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

When you use CRUDji, we may collect the following information:

• Account Information: Email address, name, company name, and authentication credentials when you create an account
• Contact Information: Information you provide when contacting us for support (name, email, message content)
• Payment Information: When you purchase CRUDji through Microsoft Azure Marketplace, Azure Marketplace processes and manages all payment and billing information; we do not receive or store your payment card details
• Data Models: Entity definitions, business rules, workflows, and configurations you create within the platform
• API Data: Data you store and process through CRUDji-generated APIs

1.2 Information Collected Automatically

When you access our Service, we automatically collect:

• Usage Data: API calls, feature usage, performance metrics, and error logs
• Device Information: IP address, browser type, operating system, device identifiers
• Log Data: Access times, pages viewed, actions performed within the platform
• Cookies and Tracking: Session cookies, authentication tokens, and analytics cookies (see Section 6)

1.3 Information from Third Parties

• Cloud Providers: Infrastructure metrics from Azure, AWS, or GCP where your deployment is hosted
• Authentication Providers: Profile information if you use OAuth/SSO (e.g., Microsoft, Google)
• Microsoft Azure Marketplace: Transaction confirmation and subscription billing status

2. How We Use Your Information

We use the collected information for the following purposes:

2.1 Service Delivery

• Provide, operate, and maintain the CRUDji platform
• Generate APIs, business logic, and user interfaces based on your data models
• Process transactions and manage your subscription
• Authenticate users and maintain account security
• Store and manage your data in your chosen cloud provider

2.2 Service Improvement

• Analyze usage patterns to improve features and performance
• Troubleshoot technical issues and bugs
• Develop new features and enhancements
• Conduct research and analytics (aggregated and anonymized)

2.3 Communication

• Send service-related notifications (system updates, security alerts)
• Respond to support requests and inquiries
• Send marketing communications (with your consent, opt-out available)
• Conduct surveys and gather feedback

2.4 Legal and Security

• Comply with legal obligations and regulations
• Enforce our Terms of Service
• Detect and prevent fraud, abuse, and security threats
• Protect our rights, property, and safety

3. Data Storage and Security

3.1 Where Your Data is Stored

Data storage locations:

• Your Application Data: Stored in your chosen location (Azure, AWS, GCP, On-premise etc.) in your selected region
• Usage Analytics: Stored on our secure servers or third-party analytics platforms
• Backup Data: Encrypted backups maintained according to your subscription plan

3.2 Security Measures

We implement industry-standard security measures:

• Encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access control (RBAC) and multi-factor authentication (MFA)
• Monitoring: 24/7 security monitoring and intrusion detection
• Auditing: Comprehensive audit logs of all system access and changes
• Testing: Regular security reviews and assessments
• Compliance: Security controls and data handling practices designed to align with GDPR and other applicable data protection regulations

3.3 Data Retention

Data Type	Retention Period
Account Information	Duration of account + 30 days after deletion
Application Data	Until you delete it or terminate your account
Usage Logs	90 days (or as required by law)
Audit Logs	7 years (compliance requirement)
Support Communications	3 years after case closure
Backups	According to your subscription plan (7-90 days)

4. How We Share Your Information

We do NOT sell your personal information. We may share your information in the following circumstances:

4.1 Service Providers

We share data with trusted third-party vendors who help us operate our Service:

• Cloud Infrastructure: Microsoft Azure, Amazon Web Services, Google Cloud Platform (your choice)
• Payment Processing: Microsoft Azure Marketplace (for subscription billing and payment processing; Vecapo (OPC) Private Limited does not receive your payment card information)
• Email Services: SendGrid, AWS SES (for transactional emails)
• Analytics: Google Analytics, Mixpanel (anonymized data) etc.
• Customer Support: EMail or WhatsApp

All service providers are bound by data protection agreements and process data only as instructed.

4.2 Business Transfers

If CRUDji is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

4.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal processes (subpoenas, court orders)
• Government or regulatory requests
• Protection of our rights and property
• Prevention of fraud or security threats
• Compliance with applicable laws and regulations

4.4 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing.

5. Your Rights and Choices

5.1 Data Access and Portability

You have the right to:

• Access: Request a copy of all personal data we hold about you
• Portability: Export your data in machine-readable format (JSON, CSV)
• Correction: Update or correct inaccurate information

5.2 Data Deletion

You can request deletion of your data:

• Account Deletion: Delete your entire account and all associated data
• Selective Deletion: Delete specific entities, rules, or workflows
• Right to be Forgotten: Request complete erasure (GDPR right)

Note: Some data may be retained for legal compliance (e.g., audit logs, financial records) as required by law.

5.3 Marketing Communications

• Opt-Out: Unsubscribe from marketing emails via the link in each message
• Preferences: Manage communication preferences in your account settings
• Transactional Emails: Cannot be opted out (service notifications, receipts)

5.4 Cookies and Tracking

• Browser Settings: Block or delete cookies through your browser
• Analytics Opt-Out: Use Google Analytics opt-out browser add-on
• Do Not Track: We honor DNT signals when technically feasible

5.5 EU Data Subject Rights (GDPR)

If you are in the European Economic Area (EEA), you have additional rights:

• Right to access, rectification, and erasure
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

5.6 California Privacy Rights (CCPA)

California residents have the right to:

• Know what personal information we collect, use, and disclose
• Request deletion of personal information
• Opt-out of the sale of personal information (we don't sell data)
• Non-discrimination for exercising CCPA rights

6. Cookies and Tracking Technologies

6.1 Types of Cookies We Use

Cookie Type	Purpose	Duration
Essential Cookies	Authentication, security, basic functionality	Session/1 year
Performance Cookies	Analyze usage, improve performance	1 year
Functional Cookies	Remember preferences, personalization	1 year
Analytics Cookies	Understand user behavior, statistics	2 years

6.2 Third-Party Tracking

We use the following third-party services that may set cookies:

• Google Analytics: Website traffic analysis (anonymized)
• Microsoft Clarity: User behavior insights (heatmaps, recordings)

7. International Data Transfers

CRUDji is headquartered in the India. If you access our Service from outside India, your information may be transferred to, stored, and processed in the India or other countries.

7.1 EU-US Data Transfers

We comply with applicable data transfer mechanisms:

• Standard Contractual Clauses (SCCs): EU-approved model contracts
• Data Processing Agreements (DPA): Available upon request
• Adequacy Decisions: Transfer only to countries with adequate protection

7.2 Data Residency Options

Enterprise customers can choose data residency:

• United States: US East, US West regions
• European Union: EU West (Ireland), EU Central (Germany)
• Asia Pacific: Asia East (Tokyo), Asia Southeast (Singapore)

8. Children's Privacy

CRUDji is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at support@crudji.com. We will promptly delete such information from our systems.

9. Azure Marketplace Specific Information

9.1 Azure Marketplace Deployment

When you deploy CRUDji through Azure Marketplace:

• Microsoft as Processor: Microsoft Azure processes your data as a sub-processor under Microsoft's Data Protection Addendum
• Billing Information: Microsoft handles all payment processing; we receive only subscription status
• Azure Resources: All data stored in your Azure subscription (you control the data)
• Telemetry: Minimal usage telemetry shared with Microsoft for marketplace analytics

9.2 Azure Compliance

Our Azure deployment applies security controls and data handling practices designed to align with applicable data protection regulations, including GDPR (General Data Protection Regulation) and India's Digital Personal Data Protection Act, 2023 (DPDPA). We do not claim specific third-party certifications; where a customer's use case requires a particular certification or attestation, please contact us to discuss current status.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes:

• Notification: We will notify you via email or in-app notification
• Effective Date: Changes become effective 30 days after posting
• Material Changes: Significant changes will require your re-consent
• Version History: Previous versions available upon request

Continued use of the Service after changes indicates acceptance of the updated Privacy Policy.

11. Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee our privacy practices:

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

13. Specific Jurisdictions

13.1 European Union (EU/EEA/UK)

• Legal basis for processing: Contract, legitimate interest, consent
• Data controller: Vecapo (OPC) Private Limited (operating as CRUDji)
• EU Representative: Vecapo (OPC) Private Limited does not currently maintain an establishment or appointed representative in the EU/EEA; EU/EEA users may direct inquiries to the contact details in Section 12
• Supervisory authority: Your local data protection authority

13.2 Brazil (LGPD)

Brazilian users have rights under Lei Geral de Proteção de Dados (LGPD) similar to GDPR rights listed above.

13.3 Australia (Privacy Act)

We comply with Australian Privacy Principles (APPs) for Australian users.

13.4 India (DPDPA 2023)

Primary Jurisdiction: Vecapo (OPC) Private Limited operates under Indian law and complies with the Digital Personal Data Protection Act, 2023 (DPDPA).

• Data Fiduciary: Vecapo (OPC) Private Limited
• Data Protection Officer: Available at support@crudji.com
• Lawful Basis: Processing based on consent, contract, and legitimate purposes under DPDPA
• Data Localization: Data may be stored in India or other jurisdictions as per user's cloud provider choice
• Rights Under DPDPA:
  • Right to access your data
  • Right to correction and erasure
  • Right to data portability
  • Right to withdraw consent
  • Right to nominate (for data access in case of death or incapacity)
  • Right to grievance redressal
• Data Retention: We retain data only as long as necessary for business purposes or as required by Indian law
• Cross-Border Transfer: Your data may be transferred to other countries based on your chosen cloud provider, subject to appropriate safeguards
• Grievance Officer: Contact support@crudji.com for complaints; we will respond within 72 hours

14. Additional Disclosures

14.1 Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

14.2 Data Breach Notification

In the event of a data breach affecting your personal information:

• We will notify you within 72 hours (or as required by applicable law)
• Notification will include nature of breach, data affected, and remedial steps
• We will notify relevant supervisory authorities as required

14.3 Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these sites. Please review their privacy policies before providing any information.