Privacy Policy

TraceCal 360 is a calibration-lifecycle register for manufacturers and laboratories. Most of what it holds is not personal data — instruments, tolerances, readings, verdicts. The personal data is the trail of who did what, which a quality system requires by design. This notice explains what personal data we process, why, on what lawful basis, where it lives, who else can see it, how long we keep it, and the rights you have over it under India’s Digital Personal Data Protection Act, 2023 (DPDP).

• Name and work e-mail — identity, sign-in, notifications, and attributing a signature to a named person as ISO 9001 requires. Basis: performance of our contract with you.
• Password, stored only as a scrypt hash — the password itself is never stored and cannot be recovered from the hash. Basis: contract.
• Two-factor secret, encrypted at rest, where you enable it. Basis: contract.
• Phone number — for WhatsApp reminders only, and only where that person has opted in and confirmed by a one-time code. Basis: explicit, revocable consent.
• IP address and request identifier — for the audit trail and abuse prevention on sign-up and sign-in. Basis: legitimate interest.
• Signature blocks — who approved a calibration, what they meant, and when, recorded in a hash-chained log. Basis: a legal obligation of yourquality system.

We never hold: payment-card details (these go directly to the payment processor and never reach us), biometrics, location data, device fingerprints, or marketing profiles. We set no advertising or analytics cookies — the only cookies are the session cookie and a cookie remembering which workspace you signed into, both HttpOnly and SameSite.

The regions where your data is handled, and the location each sub-processor operates from, are set out in the Data Processing Agreement rather than in this notice — they are commercial terms that belong in the agreement your organisation signs, where they can be committed to and kept current as the platform grows. If your procurement or regulatory position depends on where personal data is kept, ask us for the current DPA before you buy; it is a question we answer in writing.

A sub-processor is a third party that processes your data on our behalf. As deployed today the complete list is one: Railway, our cloud platform, which runs the database, application and object storage. Identity is not delegated — your staff’s credentials never leave our systems.

Several integrations are built but switched off, and each becomes a sub-processor only if you ask us to enable it — an e-mail provider, WhatsApp (Meta) for opted-in reminders, a payment processor (which never receives card data through us), and per-user calendar sync. This notice is re-issued naming any of them when it is turned on.

Passwords are hashed with scrypt at OWASP’s 2024 parameters; two-factor secrets are encrypted at rest with AES-256-GCM; sessions are server-side and genuinely revocable — signing someone out ends their session rather than asking their browser to forget a token. Every customer’s data is isolated at the database level by PostgreSQL row-level security, forced on every table that carries a tenant identifier, and the isolation is asserted by a test suite that attempts cross-tenant access directly. Traffic is HTTPS-only with HSTS, a strict Content-Security-Policy, and a locked-down set of browser permissions.

Calibration records are kept for as long as you keep them — we do not delete them on a schedule, because they are records your quality system is obliged to retain. The configurable retention period governs only derived exports, never instruments or calibration events. When you leave, a full export is available on demand for 90 days after termination; after that, tenant data is purged, and the purge is itself recorded in a platform log so the fact that it happened outlives the data.

• Access — a full export of your data on request, at any time.
• Correction — your name and contact details can be corrected in place.
• Erasure (clause 12) — honoured by redaction in place rather than deletion: your name and contact details are replaced with a redaction marker while the fact that some person performed an action at a time remains. This is because the audit trail is hash-chained — deleting a row would break the chain and destroy the evidence that the rest of the history is unaltered, which protects every other person named in it. A signature block on an approved record is a legal obligation of your quality system; where an erasure request touches one, we state the refusal and its reason rather than ignoring the request.
• Withdraw consent — where processing rests on consent (WhatsApp reminders), you can withdraw it at any time.
• Grievance — reach our Data Protection contact below; you may also approach the Data Protection Board of India.

Data Protection contact: security@tracecal.com (placeholder — to be replaced before launch). We respond to data-principal requests within the timelines the DPDP Act requires.