Privacy Policy

Your data is stored in a PostgreSQL database hosted on Supabase, with Row-Level Security (RLS) enabled on all tables. Authentication is handled by Supabase Auth with secure session management.

Payment instrument details (card numbers, CVV, UPI handles, net-banking credentials) are handled directly by our PCI-DSS-compliant payment service provider (Razorpay) and are never stored on DispatchHQ servers. We retain only the tokenised customer ID, transaction reference, and amount required for billing reconciliation. We use industry-standard encryption for data in transit (TLS 1.2+) and at rest (AES-256).

Access to production data is restricted to authorised DispatchHQ personnel on a need-to-know basis, audited via access logs, and protected by multi-factor authentication. Database backups are encrypted and rotated on a defined retention schedule.

Each organization's data is isolated using a multi-tenant architecture where all database queries are scoped by organizationId.

In the event of a personal-data breach that is likely to result in risk to a data principal, DispatchHQ will, without undue delay and in any case in line with the timelines prescribed under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules thereunder:

• Notify the affected organisation administrator(s) and, where required, the affected individuals via email or in-platform notice;
• Notify the Data Protection Board of India and any other regulator with jurisdiction, where required by law;
• Describe the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed to mitigate the breach;
• Cooperate fully with any investigation by the regulator or by an affected organisation administrator.

DispatchHQ uses cloud infrastructure (Supabase, Vercel) and sub-processors (Razorpay, Resend, SMS/WhatsApp gateways) that may store, process, or transit personal data through data centres located outside India, including in the United States, the European Economic Area, and the Asia-Pacific region.

We rely on the lawful-transfer mechanisms permitted under the DPDP Act and the rules notified by the Central Government from time to time. We require each sub-processor to implement appropriate technical and organisational safeguards, contractually bind them to confidentiality and security obligations, and limit access to personal data to what is strictly necessary for the service they perform.