Who is responsible
Vivek Sharma, at 191, Near Mira Store, Rilbong, Shillong, Meghalaya 793004, India, operates StromaOS.
There are two relationships here and the difference matters. For data about your own business and staff accounts, we are the data fiduciary. For data about your members — the people whose cards open your doors — you are the fiduciary and we are a processor acting on your instructions. You are responsible for having a lawful basis to collect it and for telling those people what you do with it.
What we collect
Account data: name, work email, phone, and role of the people who administer your account.
Member data you enter: name, contact details, membership and plan, payment records, and the credentials that open doors.
Access records: which credential was presented at which door and when, and whether it was granted or refused. This is the product; it cannot be turned off without turning off access control.
Device telemetry: door controller health — signal strength, free memory, firmware version, reader status.
Technical data: IP address, browser, and log data generated by using the Service.
We do not collect biometric data. We do not sell personal data to anyone, ever.
Why we collect it
To provide the Service and decide whether a door should open; to bill you; to support you; to keep the Service secure and to investigate abuse; and to meet legal obligations. Access records exist to answer "who came in, and when" — which is the purpose you bought the product for.
Who we share it with
Only with processors who help us run the Service, under contract, and only what they need: cloud hosting and database (Microsoft Azure, India and Southeast Asia regions), object storage for member documents (Cloudflare R2, encrypted with a key we hold), transactional email, push notification delivery, payment processing, and measurement of visits to our public website (Google and Microsoft). Payment card details are handled by the payment gateway and never reach our servers.
We also disclose where the law compels us to, and we will tell you unless we are forbidden to.
Where it lives, and for how long
Data is stored in India and Southeast Asia. Member documents are encrypted at rest with a key the storage provider does not hold.
We keep account and billing data for as long as you are a customer and then as long as tax and company law requires. Access records are kept for the retention period configured for your account. On termination, data is deleted within 90 days except where we must keep it longer by law.
Your rights
Under the Digital Personal Data Protection Act, 2023 you may ask for access to your personal data, correction of it, erasure of it, and to withdraw consent. Write to stroma.os.india@gmail.com and we will respond within 30 days.
If the request concerns data held on behalf of a business using StromaOS — a member asking about their own record, for instance — we will route it to that business, because it is theirs to answer.
Security
Traffic is encrypted in transit. Passwords and device secrets are hashed, never stored in a readable form. Access to production data is restricted to the people who need it. Each tenant's data is isolated at the database level by row-level security, not merely by application code.
No system is perfectly secure. If a breach affects your data we will notify you and the Data Protection Board as the law requires.
Cookies
We use cookies that are strictly necessary to keep you signed in and to keep the session secure.
On our public website we also use Google Analytics, loaded directly and through Google Tag Manager, and Microsoft Clarity. Google Analytics counts visits and shows which pages are read. Clarity records how visitors move through a page (clicks, scrolling and pointer movement) as heatmaps and session replays, with text you type masked. Both set cookies, and we use what they collect only to improve the site; we do not show advertising and we do not sell it. Clarity may also set Microsoft's own identifier cookie, which Microsoft uses across its services. You can block or delete any of these cookies in your browser, and the site still works.
Contact
Questions about this policy: stroma.os.india@gmail.com. Unresolved complaints: the Grievance Officer.