Privacy Policy

Effective date: October 16, 2026

Busiserve ("Busiserve", "we", "us", or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect information when you visit our website, contact us, request a quote, create an account, use the portal, or purchase a plan.

Information we collect

Depending on how you use the website, we may collect:

• Contact and quote information: your name, work email address, subject, message, service interest, and information you choose to include about your project.
• Account information: your name, email address, password credentials, email-verification status, and account or portal activity. Passwords are processed by our authentication provider and are not available to us in readable form.
• Purchase information: selected plan, order number, payment status, amount, currency, and payment or verification identifiers. Payment card and banking details are handled by Razorpay and are not stored by Busiserve.
• Technical information: browser and device type, pages visited, approximate usage times, referral information, and error or security logs when these are made available by the hosting and security services we use.
• Visit counting: to count unique visits we combine your IP address, your browser's user-agent string and the date into a one-way hash. Only that hash is stored; we do not keep the IP address or the user-agent string themselves, and the hash cannot be reversed to identify you.
• Security events: where a request is refused by our access controls — for example a payment confirmation whose signature does not match, repeated failed sign-ins, or automated scanning of our website — we record the event so we can investigate abuse. These records hold the requesting address only in masked form (such as 203.0.113.x) together with a short one-way digest of it, not the full address. The full address may still appear in our hosting provider's own request logs, which that provider retains under its own terms.
• Communications: correspondence, support requests, and responses to messages from us.

How we use information

We use information to:

• respond to enquiries and quote requests;
• understand project requirements and prepare proposals;
• create, authenticate, maintain, and secure portal accounts;
• process plan orders, verify payments, and provide purchased services;
• send service, account, security, and transaction communications;
• operate, troubleshoot, improve, and secure the website and portal;
• prevent fraud, abuse, unauthorized access, and other harmful activity;
• comply with legal obligations and enforce our agreements; and
• send relevant business updates where permitted by law. You may opt out of non-essential marketing communications at any time.

Legal bases for processing

Where data-protection law requires a legal basis, we process information to perform a contract or take steps at your request, to comply with law, for our legitimate interests in operating and protecting the business, or with your consent. You may withdraw consent where processing is based on consent, although this will not affect earlier lawful processing.

Cookies and similar technologies

The website may use essential cookies, local storage, or similar technologies to keep accounts secure, maintain sessions, remember necessary preferences, and support payment or portal functionality. We may also receive limited technical data from hosting, security, and performance services. Where consent is required for non-essential cookies, we will request it and provide available controls. Blocking essential technologies may prevent parts of the website from working.

When we share information

We may share information with service providers that help us host the website, authenticate users, deliver email, process payments, store data, provide security, or operate our business. These providers may process information only for the services they provide to us. We may also disclose information when required by law, to protect rights and safety, to investigate fraud or abuse, or as part of a merger, acquisition, financing, or sale of business assets. We do not sell your personal information.

The providers we actually use

We keep this list specific rather than general, so that you can read each provider's own policy. Each one processes information only for the function described:

• Google Firebase (Google LLC / Google Cloud) — account authentication, email verification and password reset, and the database that stores accounts, enquiries, orders and subscription records.
• Razorpay (Razorpay Software Private Limited) — payment processing. Card, UPI, netbanking and wallet details are entered in Razorpay's checkout and are handled by Razorpay under its own privacy policy and terms. Busiserve never receives or stores your card number, CVV, UPI PIN or banking credentials.
• Resend (Resend, Inc.) — sending transactional email such as order confirmations and invoices.
• Vercel (Vercel Inc.) — website and application hosting, including request and error logs generated in the normal course of serving the site.

These providers may process information outside your country, including outside India. We rely on their contractual terms and safeguards for such transfers. If we add or replace a provider that handles personal information, we update this list.

Payment information in detail

Payments are initiated through Razorpay. From a completed or attempted payment we receive and retain the order reference, plan name, amount, currency, payment and signature identifiers, payment status, invoice number and the email address on the account. We use these to confirm an order, activate the plan you bought, issue your invoice, handle refund or chargeback requests, detect fraudulent payment attempts, and meet accounting and tax obligations. How a cancellation or refund is handled is set out in our Refund & Cancellation Policy.

Internal Company CRM

Busiserve operates a separate internal application, the Company CRM, which is used by our own administrators and team members to assign work and track its progress. It is an internal tool: it is not a customer-facing product, it is not sold or licensed separately, and it has no public sign-up. Accounts exist only for authorized Busiserve personnel.

Access and credentials. Each account is created by an authorized administrator, who assigns the user's login email address and role. Sign-in uses our authentication provider (Google Firebase Authentication); passwords are held by that provider and are not stored in the CRM's own records or visible to administrators. An initial password set by an administrator is shared with the user directly and should be changed by them. Password reset is handled by the authentication provider. Sessions use a server-verified, HTTP-only session cookie that expires after a limited period and is re-checked on each protected request.

What the CRM processes. The CRM holds only what it needs to authenticate users and run internal work coordination:

• Account records: the user's identifier, name, work email address, role, designation, account status, and which administrator created the account.
• Work assignment records: tasks and milestones with the assigned person, the related project, status, and due dates; and work reports filed by team members, which include the work date, the time recorded against a project, status and reviewer comments.
• Business records: client, project and project-request records entered by our team in the course of delivery work, together with company settings such as the working timezone.
• Team and intern records: where an administrator maintains them, the person's name, role, work email address, phone number, college, joining and end dates, status, and administrative notes.
• Notifications addressed to a particular user within the application.
• Audit records: for business changes, the CRM records who made the change, their role, the action, the record affected, and the time. These exist so a change can be traced and reviewed.
• Sign-in protection counters: to limit repeated failed sign-in attempts, the CRM stores a one-way hash derived from the requesting address and the email used, together with a counter and a reset time. The address itself is not stored in readable form.

Information in the CRM is processed only as needed for authentication, task and project management, operational functionality, and system security. We do not use CRM information for marketing, we do not sell it, and the CRM is not operated as a separate data-collection exercise about our personnel beyond the work records described above.

Access controls. Every protected request is checked on the server against the signed-in session and the user's role. Administrators have full access; other roles see only the projects assigned to them, the tasks assigned to them, their own work reports and their own submissions, and certain fields — including commercial figures on a project and internal notes on a client — are removed before the data reaches them. Direct database access from a browser is blocked by our database security rules, so all reads and writes pass through our server with these checks applied. Suspending an account disables the sign-in account and ends access.

Retention. CRM records are kept for as long as they remain needed for the work they document and for our operational, accounting and legal obligations; the application does not delete them automatically. When an administrator removes a team member, that account is removed from the authentication provider and its identifier is retired so it cannot be reissued and give a new account sight of the earlier user's records. Audit and work records relating to completed work may be retained after the person's access ends.

Requests and questions. Authorized users and former users may ask about the information the CRM holds about them, or ask for it to be corrected, using the privacy contact details at the end of this policy. Requests are handled as described under "Your choices and rights" above, subject to applicable law and to our need to retain records of completed work.

Data retention and security

We retain information only for as long as reasonably necessary for the purposes described here, including responding to enquiries, maintaining active accounts, completing transactions, resolving disputes, enforcing agreements, and meeting legal, tax, accounting, or security obligations. Retention periods depend on the type of information and our legal duties. We use reasonable administrative, technical, and organizational measures to protect information, but no online service can be guaranteed to be completely secure.

Your choices and rights

Subject to applicable law, you may ask us to access, correct, delete, or restrict use of your personal information, object to certain processing, receive a portable copy, or withdraw consent. You may also unsubscribe from non-essential emails. To make a request, contact us using the details on our Contact page. We may need to verify your identity before completing a request. You may have the right to complain to your local data-protection authority.

Children's privacy

Our services are intended for businesses and adults. We do not knowingly collect personal information from children under the age required by applicable law. If you believe a child has provided information to us, please contact us so we can review and delete it where appropriate.

Changes to this policy

We may update this policy when our services, providers, or legal obligations change. The updated version will be posted on this page with a new effective date. Your continued use of the website after an update means the updated policy applies to future use.

Contact us about privacy

For privacy questions, data requests or a privacy complaint, write to busiserveinfotechsolution@gmail.com with the subject line "Privacy request", call +91 97944 24169, or use our contact page. Postal address: Busiserve Infotech Solution, A1, Sector 59, Noida, Uttar Pradesh, India.

Requests sent to this address are handled by the person responsible for privacy and grievances at Busiserve. We confirm receipt and respond in writing. If you are not satisfied with the outcome, you may escalate to the data-protection or consumer authority with jurisdiction over you.

See also our Terms of Service and Refund & Cancellation Policy.