Privacy Policy

Deksie is operated by Ctrl Zed LLP. This Privacy Policy explains what data we collect, why we collect it, how we protect it, and your rights over it. We do not sell your data. We do not share it with third parties for their marketing. Your data is yours.

1. Who We Are

Deksie is a digital-marketing agency management platform operated by Ctrl Zed LLP, a limited liability partnership incorporated under the laws of India. When this Policy refers to “Deksie”, “we”, “us”, or “our”, it refers to Ctrl Zed LLP acting as the data controller for the Deksie platform.

This Privacy Policy applies to all users of the Deksie platform, including agency owners, team members, and any individual whose data is processed through the platform. If you are using Deksie on behalf of an organisation, your organisation is responsible for ensuring that its team members are informed of this Policy.

2. What Data We Collect

We collect only the data that is necessary to operate the platform, provide our services, and improve the product. We do not collect data beyond what is described below.

2.1 Account and Registration Data

• Full name of the account holder or team member
• Business email address
• Agency or organisation name
• Designation or role within the agency
• Phone number (optional, provided at registration or in profile settings)
• Password (stored in secure, one-way hashed form — never in readable format)

2.2 Platform Usage Data

• Tasks, projects, campaigns, and workflows created within the platform
• Files, documents, creative assets, briefs, and other content uploaded by the Agency
• Comments, notes, approvals, and communications made within the platform
• Time tracking entries and workload data
• Notification preferences and platform settings

2.3 Technical and Device Data

• IP address at the time of login or significant action
• Browser type and version
• Device type and operating system
• Session timestamps and duration
• Pages and features accessed within the platform
• Error logs and crash reports

2.4 Communication Data

• Emails or messages sent to Deksie's support team
• Feedback, bug reports, or suggestions submitted through the platform
• Records of any formal notices or communications exchanged under a subscription agreement

2.5 Billing and Payment Data

• Invoice records and payment status
• GST number or business registration details provided for invoicing
• Payment method type (NEFT, UPI, etc.) as confirmed in writing

Note: Deksie does not store credit card numbers or full payment credentials. Payments are processed through secure third-party payment infrastructure.

2.6 Data You Upload on Behalf of Your Clients

Agencies using Deksie may upload data belonging to their own clients — such as client briefs, campaign materials, and project documents. This data is owned entirely by the Agency. Deksie processes it only to provide the platform service and does not access, use, or share it for any other purpose. The Agency remains responsible for ensuring it has the appropriate rights and consents to upload such data.

3. How We Use Your Data

We use the data we collect for the following purposes only:

• To provide and operate the platform: Creating and managing your account, running workflows, delivering features, and keeping the platform functional.
• To communicate with you: Sending invoices, platform updates, maintenance notices, and responding to support requests.
• To improve the product: Using aggregated, anonymised usage patterns to understand how features are used and where the platform can be improved. This data cannot identify you or your agency.
• To ensure security: Monitoring for unusual activity, preventing unauthorised access, and investigating any security incidents.
• To comply with the law: Meeting our obligations under applicable Indian law, including responding to lawful requests from regulatory or government authorities.
• To manage the business relationship: Processing payments, managing subscriptions, and maintaining records of agreements and transactions.

We do not use your data for automated decision-making or profiling that has legal or significant effects on you.

4. Legal Basis for Processing

Under the Digital Personal Data Protection Act, 2023 and related Indian law, we process your personal data on the following lawful bases:

5. How We Protect Your Data

Deksie is built with data security as a core priority. We implement the following technical and organisational measures:

• All data transmitted between your device and our platform is encrypted using industry-standard Transport Layer Security (TLS).
• All data stored on our platform is protected using industry-standard encryption at rest.
• Each agency's data is logically isolated from all other agencies on the platform.
• Access to data within the platform is controlled by role-based permissions. Users only see what they are authorised to see.
• File access is managed through signed, time-limited URLs.
• All passwords are stored using secure one-way hashing. Deksie staff cannot read your password.
• Critical actions taken within the platform are logged for security and audit purposes.
• The platform is hosted on Google Cloud Platform, which maintains internationally recognised physical and technical security certifications.
• Deleted records are soft-deleted first, giving a recovery window before permanent deletion is applied.

While we maintain strong security practices, no system can guarantee absolute security. In the event of a confirmed data breach that materially affects your personal data, we will notify you within seventy-two (72) hours of becoming aware, as required under applicable law.

6. Data Sharing and Disclosure

We do not sell your data. We do not share your data with third parties for advertising or marketing purposes. Your data may be shared only in the following limited circumstances:

• Service providers: Trusted third-party providers who help us operate the platform, such as cloud infrastructure (Google Cloud Platform), email delivery, and payment processing. These providers are bound by confidentiality and data protection obligations.
• Legal requirements: Where required by applicable Indian law, court order, or a valid request from a government or regulatory authority. We will notify you where legally permitted.
• Business transfers: If Ctrl Zed LLP undergoes a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. You will be notified in advance.
• With your consent: We may share information in other circumstances where you have given explicit, informed consent.

7. Data Retention

When data is deleted, it is removed from active systems first and then purged from backups within thirty (30) days.

8. Your Rights

Under the Digital Personal Data Protection Act, 2023 and applicable Indian law, you have the following rights:

• Right to access: Request a summary of the personal data Deksie holds about you.
• Right to correction: Request that inaccurate or incomplete personal data be corrected. Most profile data can be updated directly within the platform.
• Right to erasure: Request deletion of your personal data, subject to our legal obligation to retain certain records.
• Right to data portability: Request an export of your personal data and business documents in a standard format.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.
• Right to grievance redressal: Raise a complaint with us and, if unresolved, with the Data Protection Board of India once operational.

To exercise any of these rights, write to us at privacy@deksie.in. We will respond within thirty (30) days.

9. Cookies and Tracking

Deksie uses cookies and similar technologies to operate the platform, maintain your session, and understand how the platform is used. We do not use cookies for advertising or to track you across other websites.

You may manage cookie preferences through your browser settings. Disabling essential cookies will affect your ability to use the platform.

10. Children's Data

Deksie is a professional business platform intended for use by organisations and their adult team members. We do not knowingly collect or process personal data of individuals under the age of eighteen (18). If you become aware that a minor has provided data to Deksie without appropriate consent, please contact us at sp@ctrlzed.io and we will delete it promptly.

11. Data Localisation and Cross-Border Transfers

The Deksie platform is hosted on Google Cloud Platform. Your data is primarily processed and stored within data centres operating under Google Cloud's infrastructure. Where data is processed or transferred outside India, it is done so in accordance with applicable Indian law and subject to appropriate contractual safeguards.

We will notify you if the primary location of your data processing changes in a way that is material to your privacy rights.

12. Third-Party Links and Integrations

The Deksie platform may include links to third-party websites or support integrations with external tools. This Privacy Policy applies only to data processed by Deksie. We are not responsible for the privacy practices of third-party services and encourage you to review their privacy policies independently before connecting them to your Deksie account.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the law, our practices, or the platform. When we make material changes, we will notify you by email and update the effective date at the top of this document.

Continued use of the Deksie platform after a notified change takes effect constitutes acceptance of the updated Policy. If you do not agree with the changes, you may cancel your subscription in accordance with the terms of your subscription agreement.

14. Contact and Grievance Officer

Under the DPDPA 2023, you have the right to escalate unresolved complaints to the Data Protection Board of India once it is constituted and operational.