Privacy Policy

Last updated: 7 November 2026

This policy explains what personal data Tritiq collects, why we collect it, how we use and share it, how long we keep it, and the choices you have. It applies to the Tritiq BOS web application at tritiq.in, our APIs and the integrations you connect to your workspace.

Summary

• Data collection and usage: we collect account, business, mailbox, billing, usage and support data, and use it to provide, secure and improve the Service.
• Google user data: used only for the features you request; never sold, used for ads, or used to train generalized AI models; handled under the Google API Services User Data Policy including Limited Use.
• Sharing: only with processors that run the Service, such as Google for Gmail and Drive, or where the law requires it. We do not sell personal information.
• Retention: while your account is active, then 30 days; tax records for the period Indian law requires.
• Your rights: access, correction, deletion, portability, restriction and objection; email privacy@tritiq.in and we respond within 30 days.

1. Who we are

Tritiq BOS is operated by Tritiq Solutions, a business registered in India, with its registered address at 101, JG Planet, Sector 20, Ulwe, Navi Mumbai 410206, Maharashtra, India. Tritiq Solutions is the data controller for the account and usage data described here. When we process business records on behalf of a customer organisation, we act as a data processor for that organisation and process the data on its instructions.

Privacy contact: privacy@tritiq.in. Legal contact: legal@tritiq.in. Grievance officer: Husain M, at the registered address above, privacy@tritiq.in, +91 93265 02561.

2. Scope

This policy covers the Tritiq BOS application, the marketing website at tritiq.in, our application programming interfaces, and the third-party services you choose to connect, including Google, Microsoft, email relays, payment providers, telephony and messaging providers. It does not cover third-party websites or apps that we do not control; their own privacy policies apply to them.

3. Data we collect

• Account data: your name, email address, phone number, organisation name, business address, GSTIN and other tax identifiers, your role, password hash, multi-factor authentication status, login timestamps and IP address.
• Business records you enter: customers, leads, vendors, products, stock, invoices, quotations, purchase orders, payments, expenses, employees, projects, documents, tasks and notes. These may contain personal data about your customers, suppliers and staff.
• Email and mailbox data: if you connect a mailbox, we process the messages, threads, headers, labels, folders, attachments and contacts needed to show the mailbox in the workspace, send email you compose and apply actions you request. This includes campaign recipient lists and delivery logs.
• Google user data: profile name, email address, profile picture, Gmail messages and metadata, Drive files you create or open through Tritiq, and calendar data you choose to connect. Section 4 explains this in detail.
• Billing data: subscription plan, billing contact, GST details, invoices and payment status. Card and bank details are collected and processed by our payment provider; we do not store full card numbers.
• Usage and device data: pages and features used, feature counts, timestamps, IP address, browser and operating system, device type, referring page and error logs.
• Support and communications: messages you send to support, files you share while we help, and records of the help we provide.
• Recruitment and HR data: if you use those modules, candidate and employee records such as contact details, employment history, attendance and payroll inputs.

4. Google API Services

If you sign in with Google, we receive your name, email address and profile picture. If you connect a Gmail mailbox, we access the messages, threads, labels and attachments in that mailbox so the workspace can display them, send mail you compose, and carry out the actions you request, such as read, send, modify, label, archive, move and delete. If you connect Google Drive, we request the narrow drive.file scope and can access only the files you create or open through Tritiq. If you connect Google Calendar, we access only the calendars you choose for that feature.

We use Google user data only to provide and improve the features you request. We do not sell it, do not use it for advertising, and do not use it to train generalized AI or machine-learning models. We share it only with service providers that process it on our instructions to run the Service, or where required by law. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we do not use Google user data for serving ads, including retargeting, personalized or interest-based advertising. We do not sell Google user data. We do not use it to determine creditworthiness or for lending purposes. We do not allow humans to read Google user data unless you have given us affirmative agreement for specific messages, doing so is necessary for security purposes or to comply with applicable law, or it is part of a feature you requested.

Scopes we request: openid, email and profile for sign-in; https://mail.google.com/ to read, send and manage the Gmail mailbox you connect; https://www.googleapis.com/auth/drive.file for files you create or open through Tritiq.

You can revoke access at any time from your Google Account (Security, then Third-party apps), or by disconnecting the mailbox in Settings, then Email. Revoking access stops future access. To delete data already stored, use our data deletion page or emailprivacy@tritiq.in; we delete it within 30 days, except records we must retain by law. OAuth tokens are encrypted at rest.

Google user data at a glance

• Google Sign-In: name, email address and profile picture. Used to create and secure your account. Kept until account deletion.
• Gmail: messages, threads, headers, labels and attachments. Used to display the mailbox, send email you compose and apply the actions you request. Kept while the mailbox is connected; deleted within 30 days after disconnect.
• Google Drive: files you create or open through Tritiq (drive.file). Used to store and retrieve those files. Kept while connected; deleted within 30 days.
• Google Calendar: calendars you choose to connect. Used to show events you request. Kept while connected.

Gmail and Drive data are stored in our application database in the EU, encrypted at rest; OAuth tokens are encrypted separately. We do not share Google user data with third parties for advertising, do not sell it, and do not use it to train generalized AI models. You can revoke access from your Google Account or by disconnecting the mailbox, and you can request deletion on our data deletion page.

5. How we collect data

• directly from you when you create an account, enter records, upload files or contact support;
• automatically from your browser or device when you use the Service;
• from integrations you connect, including Google and Microsoft mail and storage services;
• from your organisation when an administrator invites you or imports records;
• from service providers such as payment gateways and email relays;
• from cookies and similar technologies described in section 12.

6. Why we use data and our legal bases

• To provide the Service: create your account, authenticate you, display your records, send email you compose and run the features you request. Legal basis: performance of our contract with you or your organisation.
• To secure the Service: detect abuse, prevent fraud, enforce access controls, maintain audit logs and investigate incidents. Legal basis: our legitimate interests in keeping the Service safe, and legal obligations where applicable.
• To bill and comply with law: issue invoices, calculate GST, maintain tax and accounting records and respond to lawful requests. Legal basis: legal obligation and performance of the contract.
• To support and improve the product: answer support requests, diagnose errors and understand feature usage. Legal basis: our legitimate interests, balanced against your rights.
• To send product and marketing messages: only where permitted by law and, where required, with your consent. You can opt out at any time.

We do not sell personal information. We do not use your business records or Google user data to train generalized AI models. Where we use an AI feature, the content you submit to that feature is processed by the model provider only to return the result you asked for, under contract.

7. Who we share data with

We share personal data only as needed to run the Service, with providers that process it on our instructions under contract:

• hosting, database and object storage providers, with application data hosted in the European Union;
• Google, when you connect a Google account, to provide Gmail, Drive and sign-in features;
• Microsoft, when you connect an Outlook or Microsoft 365 mailbox;
• email relay and campaign delivery providers, to send the email you request;
• AI model providers, when you use an AI feature;
• telephony and messaging providers, for voice and WhatsApp features;
• payment processing providers, for subscription billing;
• professional advisers, auditors and insurers, where necessary and under confidentiality;
• a successor entity in a merger, acquisition or sale of assets, with notice where required.

Our current processors include Google LLC (Google Sign-In, Gmail and Drive), Microsoft Corporation (Outlook and Microsoft 365, when connected), our EU hosting and database providers, our payment gateway in India, and our email relay and AI model providers. A current list of processors is available on request from privacy@tritiq.in.

We may also disclose data where required by law, court order or a regulator, or to protect the rights, safety and security of Tritiq, our customers or others. We do not share Google user data with third parties for advertising or for any purpose prohibited by the Google API Services User Data Policy.

8. International transfers

Application data is hosted in the European Union. Billing, support and some service providers operate in India and other countries. Where we transfer personal data across borders, we use appropriate safeguards, including standard contractual clauses or an equivalent lawful mechanism, and require our processors to protect it to the same standard described here.

9. Data retention

This section sets out how long we retain each category of data.

• Account and organisation data: while your subscription is active, then 30 days after termination so you can export it.
• Business records: while your subscription is active, then 30 days after termination; invoices and tax records are kept for the period required by Indian law, typically eight years.
• Email and mailbox data: while the mailbox is connected; after you disconnect it or ask us to delete it, we delete it within 30 days, except where a legal hold applies.
• Google API data: the same periods as the mailbox and Drive or Calendar feature it belongs to; OAuth tokens are deleted when you disconnect or revoke access.
• Campaign and delivery logs: for the campaign and up to 12 months afterwards for troubleshooting and abuse prevention.
• Usage and security logs: typically 90 days, unless needed to investigate an incident.
• Support records: up to 24 months after the request is closed.
• Backups: deleted or overwritten within 30 days of the corresponding live data being deleted.

We may retain data longer where the law requires it, where a legal claim is pending, or where you have asked us not to delete it.

10. Security

We protect data with encryption in transit using TLS, encryption at rest for credentials and OAuth tokens, role-based access control, tenant isolation between organisations, audit logging, multi-factor authentication for administrative access, and monitored infrastructure. Our staff access personal data only when needed to operate or support the Service. No system is perfectly secure; if a breach affects your data, we will notify you and the relevant regulator without undue delay where the law requires it.

11. Your rights

Subject to applicable law, you can ask us to access, correct, delete or port your personal data, restrict or object to certain processing, or withdraw consent you previously gave. You can also ask for a copy of the data you provided in a machine-readable format. To exercise a right, email privacy@tritiq.in from the address on your account; we may ask for information to verify your identity. We respond within 30 days, or sooner where required. If you are in India, you may complain to the Data Protection Board of India; if you are in the EEA or UK, you may complain to your local supervisory authority.

Data deletion: email privacy@tritiq.in with the subject “Data deletion request”. Tell us the organisation, the account email and what you want deleted. We verify the request, delete the data within 30 days, and confirm when it is done. Records we must keep for tax, accounting or legal reasons are deleted when that obligation ends. You can also delete records from inside the product at any time while your subscription is active.

12. US state privacy rights

If you are a resident of California or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, to access it, to delete it, to correct it, to obtain a portable copy, and to opt out of the sale or sharing of personal information for cross-context behavioral advertising. We do not sell personal information and do not share it for cross-context behavioral advertising. Email privacy@tritiq.in to exercise these rights; we verify the request and respond within the time required by law (45 days for California, extendable once). You may use an authorized agent. We will not discriminate against you for exercising your rights.

13. GDPR and UK GDPR

If you are in the European Economic Area, the United Kingdom or Switzerland, our legal bases are performance of our contract, our legitimate interests in operating and securing the Service, compliance with legal obligations, and consent where required. You have the right to access, correct, delete, restrict or object to processing, port your data, and withdraw consent. You may complain to your local supervisory authority. International transfers use standard contractual clauses or an equivalent mechanism. Contact privacy@tritiq.in for requests or to reach our data protection contact.

14. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in, protect forms against cross-site request forgery and remember your theme preference. These include session cookies such as access_token and refresh_token, and the mailer console session cookie. They are HttpOnly and SameSite where appropriate. We do not use advertising cookies. If we introduce analytics or marketing cookies, we will ask for consent first and update this policy.

15. Children

Tritiq BOS is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided data to us, contact privacy@tritiq.in and we will delete it.

16. Third-party links and integrations

The Service may link to third-party websites or let you connect third-party accounts. We do not control those services, and their privacy policies and terms apply to the data they process. Connecting an integration is your choice; you can disconnect it at any time.

17. Changes to this policy

We may update this policy as the Service or the law changes. We will post the new version on this page and update the date at the top. If a change materially affects your rights, we will notify you by email or in the product before it takes effect. Continued use after the effective date means you accept the updated policy.

18. Contact

Privacy queries and data requests: privacy@tritiq.in. Legal queries: legal@tritiq.in. Grievance officer: Husain M, Grievance Officer, 101, JG Planet, Sector 20, Ulwe, Navi Mumbai 410206, India — privacy@tritiq.in, +91 93265 02561 as required under Indian law.