Privacy policy

In short: we use your personal data to run MSMEPulse for you and to bill and support your account. We never sell it. The business data you put into MSMEPulse (your clients, projects, invoices and employees) belongs to your company, and we process it only on your company's instructions.

1. Who we are

MSMEPulse is provided by WOODAPPLE SOFTWARE SOLUTIONS PRIVATE LIMITED, a company incorporated in India (CIN U74140MH2008PTC187261), with its registered office at A-1/10/705, Deshmukh Homes, Kalyan (East), Maharashtra 421306, India ("Woodapple", "we", "us").

This policy explains how we handle personal data when you visit msmepulse.com, sign up for or use MSMEPulse (including the client portal and partner portal), or contact us. It is written to meet India's Digital Personal Data Protection Act, 2023 and the rules made under it ("DPDP Act"), and Singapore's Personal Data Protection Act 2012 ("PDPA").

[Legal review: confirm whether Singapore customers contract with Woodapple India or with a Singapore entity, and name that entity here if one is set up (PRD open item 6).]

2. Our two roles

If you are an employee or a client of a company that uses MSMEPulse, that company is responsible for your data in its workspace. Please contact it first about your rights; we will help it respond. If you contact us directly, we will pass your request to that company where the law allows.

3. What we collect

3.1 Data you give us

• Account details: name, work email, company name, country, workspace address, password (stored only as a one-way hash), and two-step sign-in settings.
• Company details for billing: legal name, address, GSTIN or UEN, PAN, and the person responsible for payment.
• Support and communications: what you tell us in support tickets, emails and demo requests.
• Partner details: for partners in our referral programme, contact and payout details.

3.2 Data collected as you use MSMEPulse

• Usage and security logs: sign-ins, IP address, browser type, actions taken in the workspace (the activity log), and errors.
• Location at clock-in: only if your employer switches on location capture for attendance, MSMEPulse records the IP address and the device location at the moment you clock in or out. Employees are told when this is on.

3.3 Customer business data (processed for your company)

Depending on what your company uses, this can include client contacts; proposals and e-signatures (name, designation, time and IP address of signing); invoices and payments; expense receipts; and, for HR and payroll, employee records such as date of birth, designation, salary, bank account, PAN, UAN, ESIC number, Aadhaar number (India) or NRIC/FIN (Singapore), attendance, leave and tax declarations. MSMEPulse masks identity and bank numbers on screen and shows them only to people your company allows.

[Legal review: confirm the treatment of Aadhaar numbers under the Aadhaar Act and of NRIC numbers under the PDPC's NRIC advisory guidelines; consider whether collection should be limited or the fields removed.]

3.4 Website visits

Our website does not use analytics or advertising cookies. Our web servers keep standard logs (IP address, pages requested, time) for security and to keep the site working.

4. How we use it

We do not sell personal data, and we do not use customer business data to train AI models. [Legal review: when the AI assistant is released, add how it processes data and the provider's no-training and retention terms.]

5. Consent and legal grounds

India (DPDP Act)

• We process account data with your consent, given when you sign up and accept this policy, and for legitimate uses permitted by the Act, such as data you voluntarily provide for a specified purpose and compliance with law.
• You may withdraw consent at any time by writing to the Grievance Officer. Withdrawal does not affect processing already done, and we may need to close your account if the service cannot run without the data.
• For customer business data, your company is responsible for having a lawful basis, including giving notice to and obtaining consent from its employees and clients where required.

Singapore (PDPA)

• We collect, use and disclose personal data with your consent, or as permitted under the PDPA, including deemed consent and the legitimate interests and business improvement exceptions.
• You may withdraw consent by giving us reasonable notice. We will tell you the likely consequences before acting on it.

6. Who we share it with

We share personal data only as needed to provide MSMEPulse:

• Service providers who host and operate MSMEPulse for us under written contracts and confidentiality obligations: cloud hosting and database [provider, region], email delivery [provider], and backups [provider]. [Publish the list of sub-processors and keep it current.]
• Services your company connects: if your company connects a payment gateway (Razorpay, Stripe or HitPay) or accounting software (Tally, Zoho Books or Xero), the data needed for that connection goes to that provider, under its own terms. Payments from your clients go straight to your company's own merchant account; we never hold your money.
• Partners: if you signed up through a partner's referral link, the partner sees your company name, plan and commission, but not your workspace data.
• Authorities, when required by law or a valid legal request.
• A buyer or successor, if Woodapple's business is merged or sold, under the same protections.

7. Transfers outside your country

MSMEPulse is hosted in [region, e.g. Mumbai, India]. If you are in Singapore, your data may therefore be transferred to and stored in India. We protect transferred data to a standard comparable to the PDPA, including through contracts with our service providers, as the PDPA's Transfer Limitation Obligation requires. Transfers from India follow any restrictions notified by the Government of India under section 16 of the DPDP Act.

[Legal review: confirm the hosting region and whether a Singapore region is needed for Singapore customers (PRD open item 7).]

8. How long we keep it

• While your account is active, we keep your data to provide the service.
• After a trial ends without a subscription, the workspace stays available to sign in and upgrade for [30] days, then its data is deleted.
• After cancellation, your company can export its data for [90] days, after which workspace data is permanently deleted from our live systems. Backups are overwritten within [35] days.
• Billing records (our invoices to you and payments) are kept for as long as tax and company law require, currently up to [8] years in India.
• Security logs are kept for [1 year] unless needed longer to investigate an incident.

Your company can export all of its workspace data at any time from Settings → Plan and billing.

9. How we protect it

• Encryption in transit (HTTPS) and encryption of stored secrets such as gateway keys and email passwords.
• Passwords stored only as strong one-way hashes; optional two-step sign-in, which your company can require; account lock-out after repeated failed sign-ins.
• Each company's data separated from every other company's, with access checked on every request; role-based permissions.
• An activity log of changes, and support access to a workspace only with the customer's consent, time-limited and visible to the customer.
• Restricted, logged access for our staff; regular backups with tested restores.

No system is completely secure. If you believe your account has been compromised, contact us immediately.

10. Your rights

India (DPDP Act)

• Obtain a summary of your personal data we process and the processing activities, and the identities of others we have shared it with.
• Correct, complete or update your data, and have it erased when it is no longer needed, unless the law requires us to keep it.
• Have your grievances redressed by our Grievance Officer, and, if not satisfied, complain to the Data Protection Board of India.
• Nominate someone to exercise your rights if you die or become incapable.

Singapore (PDPA)

• Ask for access to your personal data and how it has been used or disclosed in the past year.
• Ask us to correct an error or omission.
• Withdraw consent, and complain to the Personal Data Protection Commission.

To use these rights, email privacy@msmepulse.com. We will verify your identity and respond within [30] days. Many details can also be changed directly in MSMEPulse under your account settings.

11. Children

MSMEPulse is a business service for people aged 18 and over. We do not knowingly collect personal data of children. If your company records data about a person under 18 (for example, a dependant or an apprentice), it is responsible for obtaining verifiable consent from a parent or lawful guardian where the DPDP Act requires it.

12. Cookies

MSMEPulse uses one strictly necessary cookie to keep you signed in securely. Our website stores your country choice (India or Singapore) in your browser so the right prices are shown. We do not use advertising or analytics cookies. [Update this section if analytics are added, with a consent banner.]

13. Data breaches

If a personal data breach affects you, we will act promptly to contain it. In India, we will inform the Data Protection Board and affected persons as the DPDP Act and its rules require. In Singapore, where a breach is notifiable, we will notify the PDPC within 3 calendar days of assessing it as notifiable, and affected individuals where required. Where we act as a processor or data intermediary for your company, we will notify your company without undue delay so it can meet its own obligations.

14. Changes to this policy

We may update this policy as MSMEPulse or the law changes. We will post the new version here with its effective date, and tell account owners by email or in the app before material changes take effect.

15. Contact and complaints