Privacy is a product principle at Octyn, not just a legal requirement. This policy tells you what we collect and why we collect it. It also says how we protect it. And it sets out the choices you have when you use our website and cloud platform. By accessing or using Octyn, you agree to the practices described here.
01 Our commitment
Octyn is a cloud ERP platform built for Indian fuel stations and petroleum retailers. We handle sensitive financial and operational data every day. That includes shift sales, reconciliation, payroll and more. So we design our systems around three commitments. We collect only what we need. We use it only for the purpose you expect. And we secure it at every stage.
This policy covers all Octyn products and services accessed through octynerp.com. These include shift-wise operations and reconciliation, fuel purchase with OMC accounts, pricing and credit management, and lubricants and non-fuel retail. They also include GST-ready accounting and compliance, staff attendance and payroll, analytics and dashboards, and multi-station reporting.
02 Who we are
Octyn is run by Zenithyn Technologies Private Limited, an Indian technology company.
- Legal entity — Zenithyn Technologies Private Limited.
- Website — www.octynerp.com.
- Services — Cloud ERP for fuel stations, with the modules listed in section 1 above.
- Jurisdiction — India.
- Governing framework — IT Act 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, and the Digital Personal Data Protection Act 2023.
For privacy questions, write to hello@octynerp.com.
03 Information we collect
What we collect depends on how you interact with Octyn.
3.1 What you give us directly
Account details — the account holder or business owner's name, and the business name and type. It also covers email, mobile number, business address, GSTIN, PAN (where applicable) and an encrypted password.
Business & financial data — invoices and billing records, customer and vendor details, employee and payroll data, and bank details used for reconciliation. It also covers inventory and stock records, GST returns and tax data, and purchase/sales transactions processed through the platform.
Support & communication data — your name and email, and the content of any request or complaint. It also covers chat and email messages, and your answers to surveys or feedback forms.
Demo & enquiry data — the name, business name, size, location and requirement you share when you book a demo or fill a form.
3.2 What we collect automatically
Device & technical data — IP address and approximate location, browser and version, and operating system and device type. It also covers screen resolution, language and ISP.
Usage data — the pages and features you visit, and the actions you take. It also covers the time you spend in each module, the forms you submit, and error or crash logs.
Cookies and browser storage — one preference cookie in the platform, and the browser storage that keeps you signed in and remembers your settings. It also covers cookieless analytics on the website. Our Cookie Policy gives the details.
3.3 What we get from third parties
We may also get data about you from these sources.
- GSTN portal — to verify your GSTIN, and for e-invoicing.
- Banking partners — for read-only bank feeds and reconciliation.
- Payment gateways — to process your subscription payments.
- Google / social sign-in — if you choose to sign in that way.
- Referral partners — if a partner refers your account to us.
04 How we use your information
4.1 To run the service
We use it to set up and manage your account. We use it to process invoices and GST returns, and to run payroll. We also use it to sync and reconcile bank transactions, manage inventory and operations, and build reports and dashboards.
4.2 To improve the platform
We use it to learn how features are used, and to find and fix bugs. We also use it to build new features, and to check uptime and performance.
4.3 To communicate with you
We send verification and account emails, and product updates and release notes. We send GST filing reminders and compliance alerts. We also send support responses and billing receipts.
4.4 To meet legal obligations
We comply with GST and income-tax law. We respond to lawful requests from the government. We keep required audit trails. We also prevent fraud or unauthorised access.
4.5 For marketing (with consent)
We send newsletters and product tips, and tell you about new modules and offers. We run satisfaction surveys. And only where you have consented, we show you relevant ads.
05 Legal basis for processing
We process your data on one or more of the following bases.
- Contractual necessity — to deliver the services described in our Terms.
- Legal obligation — to comply with the IT Act, GST Act, Income Tax Act, Companies Act and applicable labour laws.
- Legitimate interests — to secure, improve and analyse the platform, where these interests do not override your rights.
- Consent — for marketing, non-essential cookies and certain data sharing. You may withdraw it at any time.
06 Data sharing & disclosure
Octyn does not sell your personal data. We never trade, rent or monetise your data. We share data only in the limited situations below.
6.1 With service providers
We work with vetted providers who help us run the platform. Each is bound by contract to use your data only for the agreed purpose. Each is also bound to keep appropriate security in place.
| Partner type | Purpose | Data shared |
|---|---|---|
| Cloud infrastructure | Hosting & storage. | Encrypted business data. |
| Payment gateways | Subscription billing. | Name, email, transaction amount. |
| Email providers | Transactional email. | Name, email address. |
| AI document processing | Reading the purchase invoices you upload. | Invoice documents. |
| Analytics | Usage analytics. | Anonymised usage data. |
| GSTN portal | E-invoice & GST filing. | GST transaction data. |
| Banking partners | Bank feed integration. | Read-only bank data. |
6.2 With government & regulators
We may disclose data where a court order or a statutory duty requires it. We may also disclose it when tax or law-enforcement authorities ask for it. And we may disclose it where necessary to protect the rights and safety of Octyn and its users.
6.3 In a business transfer
Octyn could be involved in a merger, acquisition or sale of assets. If so, your data may transfer to the acquiring entity under the same protections described here. We will notify you before any such transfer.
6.4 With your consent
We share data with other parties only when you have authorised it. For example, you might give your CA firm access to your account.
07 Storage & retention
7.1 Where your data lives
Your records are stored in India. Octyn's database is hosted in Mumbai. Some data is processed outside India. The purchase-invoice files you upload are read by AI on Cloudflare's global network. An invoice it cannot read reliably may be sent to a second AI provider in the United States. The emails Octyn sends go through our email provider in the United States. Our cloud and database services come from established platforms. Their data centres hold recognised security certifications such as ISO 27001 and SOC 2. These certifications are held by those providers. The full list of providers that process your business data is in our Data Processing Agreement.
7.2 How long we keep it
| Data type | Retention period | Reason |
|---|---|---|
| Account & profile | Account life + 5 years. | Legal & audit. |
| GST & tax records | 8 years from filing. | GST Act. |
| Payroll & employee records | 8 years. | Labour law. |
| Financial transactions | 8 years. | Income Tax Act. |
| Support communication | 3 years. | Service improvement. |
| Marketing data | Until opt-out or 2 years. | Consent-based. |
| Website usage logs | 12 months. | Security monitoring. |
After the applicable period, data is securely deleted or anonymised.
08 Data security
8.1 Technical measures
Encryption — traffic between your browser and Octyn is protected in transit with TLS (HTTPS). Data stored at rest is encrypted using AES-256 by our cloud infrastructure providers.
Access controls — role-based access, optional multi-factor authentication and automatic session timeout. There are also IP restrictions for enterprise accounts. Our security guide shows how to turn on two-factor sign-in.
Infrastructure — regular penetration testing, automated threat detection, continuous monitoring, and DDoS/firewall protection.
Backups — automated daily backups stored in geographically separate locations. We run restoration tests periodically.
8.2 Organisational measures
- Least-privilege data access for staff.
- Regular security training for the team.
- Confidentiality agreements with employees and contractors.
- A formal incident-response plan.
8.3 Breach notification
If a breach affects your data, we will notify you within 72 hours of becoming aware of it. We will tell the relevant authorities as required. We will tell you what happened, and advise you on steps to protect yourself.
09 Cookies
The platform sets one preference cookie. It keeps your sign-in session and settings in browser storage. The website uses cookieless analytics. We use no advertising or tracking cookies. Our dedicated Cookie Policy lists every item by name.
10 Your rights
Subject to applicable law, you can do the following.
- Access a copy of the personal data we hold about you (within 30 days).
- Correct personal data that is wrong or incomplete. You can fix much of it yourself in account settings.
- Delete your personal data, except where retention is legally required (for example, GST and tax records).
- Port your data in a structured, machine-readable format such as CSV or Excel.
- Withdraw consent for consent-based processing, without affecting prior lawful processing.
- Object to direct marketing at any time via the unsubscribe link or your settings.
To exercise any right, email hello@octynerp.com with the subject "Data Rights Request". We may check who you are before we act. We will respond within 30 days.
11 Children's privacy
Octyn is built for business use by adults. It is not directed at anyone under 18. We do not knowingly collect data from minors. If you think a minor has signed up, contact hello@octynerp.com and we will remove it.
12 Third-party links & integrations
Our platform links to third-party services such as the GSTN portal, banking partners and payment gateways. This policy applies only to Octyn. We are not responsible for the privacy practices of external services. Please read their policies before you use them.
13 Changes to this policy
We may update this policy when our services or the law change. For material changes we will update the "Last updated" date. We will also email you where the change affects your rights, and show a notice in the product. Continued use after an update means you accept the revised policy.
14 Grievance officer
Octyn has appointed a Grievance Officer for data-related concerns. We do this in line with the IT Act 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021. You can reach the Grievance Officer at hello@octynerp.com.
15 Governing law
This policy is governed by the laws of the Republic of India. The courts of India have exclusive jurisdiction. The laws that apply include the IT Act 2000, IT Rules 2011, the Digital Personal Data Protection Act 2023, the GST Act 2017 and the Income Tax Act 1961.
16 Contact us
For any question about this policy or how Octyn handles your data, reach our privacy team.
- Email — hello@octynerp.com.
- Web — octynerp.com/contact-us.
- Response time — within 30 days.