Privacy Policy

1. Who We Are & Scope of Policy

Spectra is a comprehensive Business Management Suite and Inventory Management Software operated by Dertz Infotech, an Indian technology enterprise based in Lucknow, Uttar Pradesh, India.

This Privacy Policy explains how we collect, process, store, disclose, and protect personal and operational data when you access or use Spectra through our marketing website (https://spectrabms.com), web dashboard, APIs, or mobile applications distributed via the Google Play Store and Apple App Store.

2. Information We Collect

We collect information to provide, maintain, optimize, and secure the Spectra platform. The types of data collected depend on your interaction with the Services:

2.1 Information You Provide Directly

• Account Registration: Name, business email address, phone number, company name, business address, and authentication credentials (passwords stored using industry-standard irreversible salted hashes).
• Billing & Tax Information: Business registration numbers (e.g., GSTIN/VAT ID), billing contact person, billing address, and transaction logs. Payment card details are processed directly by certified third-party payment gateways; we never store raw credit or debit card numbers on our servers.
• Business & Inventory Data: Stock inventories, product catalogs, SKU details, warehouse records, orders, supplier details, invoices, and sales receipts inputted into Spectra.
• Customer Support & Communications: Records of inquiries, feedback, and support tickets submitted to our technical team.

2.2 Information Collected Automatically & Log Data

• Technical Device Data: IP address, device model, operating system version, browser type, app version, screen resolution, and preferred language.
• System Diagnostics: Crash logs, performance metrics, API response latencies, and security audit logs to maintain system stability and prevent service disruptions.

2.3 Mobile App Permissions (Google Play & Android Disclosures)

To enable core business features, the Spectra mobile app may request the following device permissions:

• Camera Access: Used strictly in real time to scan barcodes and QR codes on stock labels, products, and incoming consignments. We do not capture or store personal photographs.
• Storage / Media Access: Used to temporarily cache offline inventory data, export PDF invoices, and generate Excel reports on your local device.
• Push Notifications: Used to deliver critical operational alerts, such as low-stock thresholds, pending purchase orders, and system security notices.

3. How We Use Your Information

Dertz Infotech uses collected data for specific, lawful purposes:

• To provision, authenticate, operate, and maintain user accounts and permissions.
• To process inventory tracking, invoice generation, point-of-sale transactions, and purchase orders.
• To calculate statutory tax estimates (e.g., GST) on commercial invoices generated by your business.
• To provide responsive technical support and diagnose software bugs.
• To send transactional notifications, billing invoices, and critical security warnings.
• To detect, prevent, and mitigate fraud, unauthorized access, security vulnerabilities, and abusive activities.
• To fulfill statutory tax, accounting, and compliance obligations under applicable law.

4. Legal Bases for Processing

Under the Indian Digital Personal Data Protection Act, 2023 (DPDP Act) and international data protection laws (such as GDPR), we process personal data under the following legal bases:

• Performance of a Contract: Processing necessary to fulfill our service commitments to you under our Terms & Conditions.
• Legitimate Interests: Processing necessary to secure our platform, troubleshoot technical failures, prevent fraud, and enhance product functionality.
• Consent: Where you have granted explicit permission (e.g., device camera access for barcode scanning, push notifications).
• Legal Obligations: Compliance with applicable statutory, tax, and regulatory record-keeping laws.

5. Sharing & Disclosure of Information

We do not sell, rent, monetize, or trade your personal or business data to third parties. We do not use your inventory or customer records for third-party advertising.

We share data only in the following strictly limited circumstances:

• Trusted Service Providers: Cloud infrastructure hosts, encrypted database backup vendors, SMS/email transactional delivery services, and payment gateway providers who process data strictly on our behalf under confidentiality and data protection agreements.
• Legal & Regulatory Compliance: When required by court order, law enforcement, or statutory bodies to comply with legal processes or protect vital rights and safety.
• Business Transfers: In connection with any merger, corporate reorganization, or sale of company assets, where the successor entity remains bound by this Privacy Policy.

6. Data Security & Encryption Standards

We implement defense-in-depth security measures designed to safeguard your data against unauthorized access, loss, alteration, or misuse:

• Encryption in Transit: All communications between your client devices (web and mobile) and our servers are encrypted using modern Transport Layer Security (TLS 1.2/1.3) with cryptographic forward secrecy.
• Encryption at Rest: Enterprise databases, backups, and confidential fields are encrypted using standard AES-256 encryption.
• Access Controls: Multi-tenant database isolation, strict role-based access controls (RBAC), and multi-factor authentication for administrative infrastructure.
• Continuous Monitoring: Real-time intrusion detection, vulnerability assessments, and automated backups.

7. Data Retention & Account Deletion (Google Play Compliance)

We retain personal and business information only for as long as necessary to provide the Services, fulfill legitimate business needs, or comply with statutory requirements.

7.1 Account & Data Deletion Request Process

In compliance with Google Play Store Developer Policies and global privacy standards, users can permanently delete their account and associated personal data at any time:

• In-App Deletion: Navigate to Settings > Account Security > Delete Account within the Spectra mobile or web application and confirm deletion.
• Direct Email Request: Submit an account deletion request directly to our Data Protection Team at contact@dertzinfotech.com with the subject line "Account Deletion Request" from your registered email address.

7.2 What Happens Upon Deletion

• Personal identifiers, profile details, login credentials, and user tokens are permanently purged from active databases within thirty (30) days of confirmation.
• Customer business and inventory records are queued for irreversible anonymization and deletion across active systems and subsequent backup cycles.
• Certain financial transaction metadata (such as tax invoices already issued) may be retained for the minimum period mandated by statutory taxation and auditing laws (e.g., GST statutory retention requirements).

8. Your Rights & Choices

Depending on your jurisdiction, you have the following rights regarding your personal information:

• Right of Access: Request a complete summary of the personal information we process concerning you.
• Right to Rectification: Correct or update inaccurate, incomplete, or outdated personal information.
• Right to Erasure: Request the deletion of your account and personal data, as detailed in Section 7.
• Right to Data Portability: Request an export of your business inventory records in standard machine-readable format (CSV/Excel).
• Right to Withdraw Consent: Revoke permissions previously granted (such as camera access) via your device settings or opt out of non-essential communications.

To exercise any of these rights, contact us at contact@dertzinfotech.com. We verify all requests before execution to protect against unauthorized data tampering.

9. Children's Privacy (COPPA & DPDP Act Compliance)

Spectra is a business-to-business (B2B) enterprise management application designed exclusively for commercial business owners, administrators, and staff. The Services are not directed toward children, and we do not knowingly solicit or collect personal information from individuals under the age of 18 (or the age of legal majority in your territory).

If we learn that we have inadvertently collected personal data from a minor without verified parental or guardian consent, we will take immediate steps to permanently remove such information from our records. If you believe a minor has registered an account, please alert us at contact@dertzinfotech.com.

10. Cookies & Local Storage

On our web portal, we use strictly necessary session cookies and local storage tokens exclusively to:

• Maintain authenticated user login sessions securely.
• Remember your display preferences (such as light or dark theme selection).
• Prevent Cross-Site Request Forgery (CSRF) and secure online forms.

We do not employ cross-site tracking cookies, third-party advertising pixels, or invasive behavioral profiling trackers.

11. International Data Transfers & Cloud Hosting

Spectra infrastructure and cloud databases are hosted on secure, certified cloud facilities. If you access the Services from outside India, your data may be transferred to and processed in countries where our servers operate. We ensure that all cross-border data transfers comply with statutory cross-border transfer requirements and maintain rigorous data privacy safeguards.

12. Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect software upgrades, security improvements, or regulatory developments.

When modifications are published, we will revise the "Last updated" and "Effective Date" at the top of this document. In the case of material changes, we will provide prominent notice via your dashboard, mobile app notifications, or direct email. Continued use of the Services following an update confirms your acceptance of the revised Privacy Policy.

13. Contact Us & Grievance Redressal

If you have any questions, feedback, grievance requests, or data privacy inquiries regarding this Privacy Policy, please contact our Data Protection Officer: