Legal

Privacy Policy

Effective 15 September 2026 · Applies to the OrdersTrail Android app and orderstrail.in

OrdersTrail is an order book for home bakers and other small businesses. It is made and run by Ektasi Technology (OPC) Private Limited (“Ektasi”, “we”, “us”). This policy explains what information OrdersTrail handles, why, and the choices you have. We wrote it to be read, not skimmed past.

1. Who is responsible for your information

For your account and business details, Ektasi is the data fiduciary (the “controller”) under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

For the information you record about your customers and suppliers, you decide what is recorded and why, so you are responsible for it and we handle it only on your instructions to provide the service (as a data processor). Please record only what you need, and only information your customers are happy for you to keep.

2. What we collect

We don't ask for your location, contacts, photos, files, camera or microphone. The Android app only uses the internet permission.

Sample data: “Explore with sample data” runs on made-up records stored only in your phone's memory. Nothing from it is sent to us, and it disappears when you leave it.

3. How the app uses information

• To provide OrdersTrail: store and sync your records, show reminders, calculate prices and sales totals.
• To sign you in: we email a one-time code to your address (or check your password if your account has one).
• To support you and to keep the service secure, including preventing abuse.
• To tell you about important changes to the service or to this policy.

We don't use your records for advertising, we don't sell them, and we don't build profiles about you or your customers.

4. Actions you take in other apps

When you tap Message, Call, Email or Export, OrdersTrail opens WhatsApp, your phone dialer, your email app or Android's share sheet with the text or file ready. What happens next is between you and that app, under its own privacy policy. Exports are CSV files created on your phone and shared only where you choose.

5. Service providers we use

• Supabase: cloud database and sign-in (stores your account and records, and sends sign-in emails).
• Google Fonts: the app and website load their typefaces from Google's servers, which see your device's IP address.
• GitHub Pages: hosts orderstrail.in and the app download, and may log visitors' IP addresses for security.
• Google Play: if you install from Google Play, Google handles the download under its own policies.

These providers process information only to provide their service to us. Some of them process data outside India. Where that happens, we rely on their contractual and security commitments, and we transfer data only as permitted under Indian law.

6. How we protect it

• All traffic between the app and our servers is encrypted (HTTPS/TLS).
• The database keeps each business's records apart using row-level security, so one account can't read another's data.
• Access to production systems is limited to the people who need it.
• The app turns off Android cloud backup of its local data, so a sign-in isn't copied to other devices.

No system is perfectly secure. If a breach affects your personal data, we'll tell you and the Data Protection Board of India as the law requires.

7. How long we keep it

We keep your account and records while your account is open. If you delete a record in the app, it's removed from the live database straight away. If you ask us to delete your account, we delete your account and all its records within 30 days of confirming the request, and backup copies expire in the normal backup cycle. We keep only what the law requires us to keep, such as tax invoices if you ever buy a paid plan.

8. Your choices and rights

Under the DPDP Act and other laws that apply to you, you can:

• See and correct your information: most of it can be edited in the app.
• Get a copy: Sales → Export, or Settings → Export my data.
• Delete: delete records in the app, or your whole account (see Delete your account).
• Withdraw consent: stop using the app and ask us to delete your account.
• Nominate someone to exercise these rights if you die or can't act.
• Complain: contact our Grievance Officer (below). If you're not satisfied, you can approach the Data Protection Board of India.

Email support@ektasi.io from your account email to use any of these. We reply within 30 days, and usually much sooner.

9. Children

OrdersTrail is a business tool for adults. It isn't meant for anyone under 18, and we don't knowingly collect children's data. If you think a child has created an account, contact us and we'll delete it.

10. Changes to this policy

If we change this policy, we'll update the date above. For significant changes, we'll also tell you in the app or by email before they take effect.

11. Contact and grievances

This policy is governed by the laws of India.