Privacy policy

Last updated 8 October 2026

In short. We collect the details you give us on this website and the data you put into Tuskit, only to run the service for you. We do not sell personal data, show ads or use advertising trackers. You can ask us to correct or erase your data, and you can reach our Grievance Officer at any time (see section 14).

1. Who we are, and our role

“We” means the business that provides Tuskit, at https://tuskit.app and in the apps for web and Android. This policy explains how we handle personal data under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules under it.

We are the Data Fiduciary (the party that decides why and how personal data is used) for the details you send through this website, for the sign-in and account details of the people who use Tuskit, and for billing records.
Your shop is the Data Fiduciary, and we are its Data Processor, for the business data a shop enters about its own customers, suppliers and staff. We process that data only on the shop’s instructions, to run the service. If you are a shop’s customer and want to use your rights over that data, ask the shop first; we will help it respond.

2. What we collect

This website. When you ask for a trial or a walkthrough, we receive and store: your name; your WhatsApp number; your shop name; the kind of business; your message (walkthrough requests only, optional); whether you asked for a trial or a walkthrough; the page you sent it from; the date and time; your country, as worked out by our hosting provider; your browser and device description (user agent); and a scrambled (salted, hashed) form of your internet address, which we use only to limit repeated submissions. We do not store your internet address itself in our enquiry records. Our hosting provider sees it as it serves the site.

Your account. Your name, phone number and email, your role and shop membership, and sign-in details. Passwords are kept only as hashes. If you choose to sign in with a third-party identity provider, we receive the name, email and photo it shares to confirm who you are. Your shop’s profile: name, address, GSTIN and UPI ID.

Business data you enter. Customers, suppliers and their contact details, items, quotations, orders, invoices, payments, staff memberships and any file you attach. This is your data (see section 1).

Customer-link data. When a shop sends a customer a Tuskit Link, the customer sees only that order and confirms with a one-time code sent to their phone. Opening the link records the time and a device identifier for security. No account is created.

Support and diagnostics. What you tell us when you write to us. App version, device model and sync status, if you share them with support, or automatically if you turn on crash reporting. This never includes your business data.

Analytics and cookies. Only as section 10 describes.

3. Why we use it

To answer your trial or walkthrough request and set up your shop. You gave us these details voluntarily for this purpose, and we use them for nothing else.
To provide the service you signed up for, including sign-in, one-time codes, product emails and support. We rely on your consent and on the service you asked for.
To invoice and collect subscription fees and to keep the records the law requires, such as GST records. We rely on the legal obligations the DPDP Act allows.
To keep the service secure and prevent abuse, as the DPDP Act requires us to protect personal data.
Analytics, only if you accept the banner on this website.

We do not sell personal data, show ads or use advertising trackers. We do not send you marketing without your consent, and you can withdraw it at any time.

4. Notice and consent when you send us your details

When you submit one of our forms, you are asking us to contact you on WhatsApp or by phone about Tuskit, and you agree to us using the details above for that purpose, as this policy describes. Providing them is voluntary, but without them we cannot respond. You can withdraw your consent at any time by writing to nelson@tuskit.app. That does not affect what we did before you withdrew, and we will then stop contacting you and delete your enquiry unless the law requires us to keep it. Your rights and how to use them are in section 9.

5. How long we keep it

Website enquiries. Until you ask us to stop or delete, and in any case no more than 24 months after you sent them. If you start using Tuskit, the details become part of your account record.
Account and business data. While your trial or subscription is active, and for 30 days after it ends so you can export it. After that we delete or anonymise it, except records the law requires us to keep.
If you delete your account (in the app, under Settings, Delete account), there is a 30-day period in which you can still cancel. After that we erase your name, email address, phone number, password and any linked sign-in. Invoices, receipts and payments are statutory records of the business, so if the shop continues without you they are kept in anonymised form: amounts, dates and invoice numbers remain, but they no longer identify you. If you are the only member of a shop and you confirm it, the shop and its data are deleted with your account.
Tax and accounting records. Indian GST law requires a business to keep invoices and related records for a number of years. We keep such records for as long as the law requires.
Backups. Deleted data may remain in encrypted backups until they age out on their normal schedule. We do not use backups to identify anyone, and we do not restore them to bring back a deleted account.

Only people and providers who need it, and never for sale. Providers act on our instructions, under contract, and only as needed to run the service.

Your shop’s people, according to the roles the shop sets.
Hosting and delivery. Cloudflare serves this website, runs its enquiry form and stores the enquiries it receives.
Email delivery. Resend sends our team an email when you submit a form, and delivers the product’s email, such as password resets, staff invitations, security notices and the reminders, statements and invoices a shop chooses to send.
Cloud database and sign-in provider, which hosts product data and handles sign-in.
SMS provider, which delivers one-time codes for sign-in and for Tuskit Links.
Identity providers you choose, if you sign in with one.
Crash-reporting service, only if it is turned on for your build.
Payments. We collect subscription fees by UPI or bank transfer, so your bank or UPI app handles the payment. We do not ask for card details.
Advisers and authorities. Our accountants, lawyers and auditors, under confidentiality, and government or law-enforcement bodies where the law requires. If our business is sold or merged, to the new owner, who must honour this policy.

7. Where data is kept, and transfers outside India

The Android app keeps your data on your device, so it works offline, and syncs it to our cloud database. Our cloud, hosting, email and other providers run infrastructure in several countries, so personal data they handle, such as product data, a website enquiry or an email, may be stored or processed outside India. The DPDP Act allows transfers to any country except those the Government of India restricts, and we will follow any such restriction. We choose providers that protect data under contract.

8. How we protect it

Database-level access rules keep each shop’s data separate from every other shop’s.
Access is role-based. Sensitive actions, such as issuing invoices and changing payment details, are limited to the owner, and privileged actions are recorded in an audit trail.
Passwords are stored only as hashes. Traffic travels over HTTPS. Backups are encrypted.
Generated documents are stored privately and shared through links that expire within minutes.
Customer links are unguessable, limited to one order, revocable by the shop and expire automatically.
On this website, we store only a scrambled form of your internet address, and we limit how often a form can be submitted.

No system is perfectly secure. Protect your devices and sign-in details, and remove people from your shop when they leave.

9. Your rights

Under the DPDP Act, you have the right to:

get a summary of the personal data we hold about you and how we use it;
have it corrected, completed or updated;
have it erased, unless the law requires us to keep it;
withdraw your consent at any time;
have your grievance addressed (section 14); and
nominate another person to exercise these rights if you die or cannot act for yourself.

To use a right, write to nelson@tuskit.app from the email address or phone number you gave us, so that we can check it is you. We will reply within 30 days. You can also delete your account yourself, as section 5 says. If you are not satisfied with our reply, you can complain to the Data Protection Board of India. Please give accurate information and do not make false or frivolous complaints.

10. Cookies, analytics and local storage

We do not use advertising or tracking cookies. Our forms do not need cookies. Your browser keeps two small settings for this website: your analytics choice, and your light or dark theme if you set one.

If a banner appears, Cloudflare Web Analytics loads only after you choose “Okay”. Choose “Essential only” and it never loads. Cloudflare describes this analytics as cookie-free and not tracking you across sites. To change your choice, clear this site’s data in your browser and the banner will appear again.

11. Children

Tuskit is a business tool for adults. It is not meant for anyone under 18 and we do not knowingly collect their personal data. If you think a child has given us personal data, write to us and we will delete it.

12. If something goes wrong

If a personal data breach affects data we hold, we will tell the Data Protection Board of India and the people affected, in the form and time the law requires. Where we process data for a shop, we will tell the shop without undue delay so that it can meet its own duties.

13. Changes to this policy

We will post any change here with a new date. For a material change, we will email account holders before it applies to them.

14. Grievance Officer and contact

For questions, requests to use your rights, or complaints about how we handle personal data, contact our Grievance Officer:

Grievance Officer, Tuskit
Email: nelson@tuskit.app

We will acknowledge your message and reply within 30 days. Our terms of service also apply.