Privacy Policy

Last updated 23 August 2026. This explains what personal data Settlio handles, why, where it lives, and what you can ask us to do with it.

1. Two different roles — and why it matters to you

Settlio is a tool that distribution businesses use to track money owed to them. That means we handle personal data in two distinct ways, and your rights differ depending on which applies.

• We are the Data Fiduciary (controller) for the data of people who sign up for and administer a Settlio account — name, email, billing details, login and usage records. This policy governs that data.
• We are a Data Processorfor everything a customer puts into their workspace — their retailers, their field agents, their bank statements. We process that on the customer’s instructions only. If you are a retailer or a field agent and want your data corrected or removed, please contact the distributor you deal with; they control it, not us. We will help them act on your request.

2. What we collect

Account and billing data (we are the controller)

• Name, email address, and password (stored only as a salted hash).
• If you sign in with Google: your Google account email, name and profile picture. We do not receive your Google password.
• Multi-factor authentication enrolment (we store the secret, never your codes).
• Business details: organisation name, operating entity names, GSTIN, distributor identifiers, UPI VPAs and bank account details you enter.
• Billing records — plan, invoices, payment status. We never see or store your full card number; Razorpay handles that.
• Technical logs: IP address, browser and device information, timestamps, and pages or actions accessed.

Workspace data (we are the processor)

• Retailer records — business names, identifiers, contact details, and amounts owed.
• Collection records — amounts, method, timestamps, and which field agent recorded them.
• Bank statements you upload, including transaction narration, reference numbers and counterparty details.
• Field agent records — name, email, and the device their access is bound to.
• Where WhatsApp reminders are enabled — retailer phone numbers or group identifiers, and a log of messages sent.
• Where the device sales module is used — the names and contact details of device purchasers.

We ask customers not to upload data they do not need. We do not ask for, and you should not upload, Aadhaar numbers, PAN images, biometric data, health data, or scanned identity documents.

3. Why we use it

We process this data because it is necessary to perform our contract with you, because you have consented (for example by connecting a WhatsApp account), or because we have a legal obligation. We do not run behavioural advertising and we do not sell personal data to anyone.

4. Automated decisions and AI

Settlio performs automated calculations — receivable amounts, reconciliation matches, anomaly flags. These are arithmetic and rule-based, presented to a human for approval. No decision producing a legal or similarly significant effect is taken automatically without a person reviewing it.

We do not use your data to train machine-learning models, and we do not send your workspace data to third-party AI services.

5. Cookies

We use strictly necessary cookies only — they keep you signed in, maintain which organisation you are working in, and protect against cross-site request forgery. We do not use advertising or cross-site tracking cookies, so there is no consent banner to click. If that changes, we will ask first.

6. Who we share it with

We share personal data only with the service providers below, each of which processes it on our behalf under contractual confidentiality and security obligations. We add to this list only after notifying customers, as committed in Terms §10.

We may also disclose data where the law requires it, to enforce our terms, or to protect our rights or someone’s safety. If we are ever involved in a merger or sale, data may transfer to the successor — we would tell you first.

7. Where your data is stored

Our database is currently hosted in Seoul, South Korea (AWS ap-northeast-2) via Supabase. We intend to move it to Mumbai, India (AWS ap-south-1), and will update this page when we do.

We are telling you this plainly because it matters: if storing your data inside India is a requirement for you, please raise it with us before subscribing. Backups and error reports may also be processed outside India by the providers listed above.

8. How we protect it

• Encryption in transit (TLS) and at rest.
• Database-enforced tenant isolation — one customer’s workspace cannot read another’s, enforced below the application so a coding error alone cannot expose it.
• Multi-factor authentication required for owner-level actions.
• Field agent access bound to a single device, revocable instantly.
• An append-only audit trail of financially significant actions.
• Automated backups with periodically tested restores.
• Least-privilege access for our own staff, used only to operate the service or to support you when you ask.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as the law requires, and in any event within 72 hours of becoming aware of it.

9. How long we keep it

Where a legal hold applies, affected records are preserved until it is lifted, regardless of the above.

10. Your rights

Under the Digital Personal Data Protection Act, 2023 and its Rules, and subject to their conditions, you may:

• ask what personal data of yours we hold and how we use it;
• ask us to correct or complete inaccurate data;
• ask us to erase data we no longer need;
• withdraw consent where processing relies on it — this does not affect what was lawful beforehand;
• nominate someone to exercise these rights if you die or become incapacitated;
• complain to us, and then to the Data Protection Board of India.

Write to our grievance contact. We will respond within 30 days. We may need to verify your identity first. If your data sits inside a distributor’s workspace — because you are their retailer or their field agent — we will pass your request to them, since they decide what happens to it.

11. Grievance officer

For any complaint about how we handle personal data, contact our grievance officer at our grievance contact, or by post at the address on our contact page.

12. Children

Settliois a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child’s data has reached us, tell us and we will delete it.

13. Changes

We will update this page as the product changes, and update the date at the top. For material changes affecting your rights we will notify you by email or in the console before they take effect.

14. Contact

Settlio — privacy enquiries: see our contact page. General support: see our contact page. Postal address on our contact page.