1. Scope & Controller Identity

This Privacy Policy applies to all personal data collected by FTFX Tech Solutions (OPC) Private Limited ("we", "Company") through the Velqora platform (velqora.com). We are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Data Controller under the GDPR for EU/UK users.

2. Data We Collect

Category	Specific Data	Basis
Account Data	Name, email address, password (hashed)	Contractual necessity
Billing Data	Payment tokens via Razorpay (we do not store card numbers)	Contractual necessity
Platform Usage	Templates accessed, documents generated, login timestamps	Legitimate interest
Form Input Data	Party names, addresses, emails entered into document forms	Contractual necessity / Consent
Technical Data	IP address, browser type, device ID, cookies	Legitimate interest
Communications	Support emails and enquiry messages	Legitimate interest

3. How We Use Your Data

To provide and improve the Velqora Service;
To process subscription payments and manage billing;
To send transactional emails (receipts, password resets, expiry notices);
To analyse platform usage and improve AI model quality (aggregated, anonymised);
To comply with applicable legal obligations;
To investigate fraud, abuse, or security incidents.

We do not sell, rent, or broker your personal data to any third party.

4. Third-Party Processors

Processor	Purpose	Location
Razorpay Software Pvt. Ltd.	Payment processing	India
OpenRouter / AI Model Provider	AI document generation (data sent without PII where possible)	USA
PostgreSQL Cloud Host	Database hosting	India / EU

All processors are bound by data processing agreements. International transfers are protected by Standard Contractual Clauses (SCCs) under GDPR.

5. Data Retention

Account data is retained for the duration of your subscription plus 3 years thereafter for audit purposes. Billing records are retained for 7 years as required by the Companies Act, 2013. You may request deletion at any time (subject to legal retention obligations).

6. Your Rights (DPDP Act 2023 & GDPR)

Right to Access — Request a copy of your personal data.
Right to Correction — Require inaccurate data to be corrected.
Right to Erasure — Request deletion where no overriding legal basis exists.
Right to Data Portability — Receive your data in a machine-readable format.
Right to Withdraw Consent — Where processing is based on consent.
Right to Grievance Redressal — Under §13 DPDP Act, lodge complaints to our Consent Manager or the Data Protection Board of India.

To exercise any right, email: privacy@velqora.com. We will respond within 30 days.

7. Security Measures

We implement industry-standard safeguards: AES-256 data encryption at rest; TLS 1.3 encryption in transit; bcrypt password hashing; role-based access controls; regular penetration testing; SOC 2-aligned logging and monitoring.

8. Security Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights, we will notify you and the Data Protection Board of India within 72 hours of becoming aware, as required under the DPDP Act, 2023.

9. Cookies

We use essential cookies for session management and optional analytics cookies. See our Cookie Policy for full details.

10. Children's Data

The Service is not directed at individuals under 18 years of age. We do not knowingly collect data from minors. If we become aware of such collection, we will delete it immediately.

11. Changes to This Policy

Material changes will be communicated via email or platform notice 15 days before taking effect.

12. Grievance Officer

As required under the IT Act, 2000 and DPDP Act, 2023, our designated Grievance / Consent Manager is:

Name: [Grievance Officer Name] | Email: privacy@velqora.com | Address: FTFX Tech Solutions (OPC) Private Limited, [Address] | Response within 30 days.