Privacy Notice
Last Updated: August 13, 2026 | Effective Date: August 13, 2026
1. Overview & Data Fiduciary Details
Helium Suite ("we", "us", or "our") is operated by Afin Nafsan, registered address Rayanmarakkar Veettil, Panamaram, Wayanad, Kerala - 670721. We act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") for personal data collected directly from our agency users, and as a Data Processor on behalf of agencies managing their clients' information through our platform.
2. Personal Data Collected & Purpose of Collection
We collect and process personal data strictly for specified, lawful, and necessary business purposes:
| Category of Personal Data | Data Elements Collected | Specified Purpose (DPDP Sec. 4) |
|---|---|---|
| User Account Data | Full Name, Email Address, Password, Phone Number, Business Name | Account setup, authentication, billing, service communications |
| Client & Contact Data | Client Name, Email, Company, Phone, Contract Signatures | Proposal delivery, client portal access, contract execution |
| Financial & Billing Data | Payment Subscription IDs, Billing Address, Invoice History | Subscription billing via Cashfree PG, tax invoice generation |
| Technical & Usage Data | IP Address, User Agent, Cookie Preferences, Audit Logs | Security monitoring, fraud prevention, platform performance |
3. Data Retention Policy
In accordance with Section 8(7) of the DPDP Act, 2023, personal data is retained only for as long as necessary to satisfy the purpose for which it was collected or to satisfy statutory obligations:
- Active Account Data: Retained while your account remains active. Upon account deletion, personal data is erased within 30 days unless required by law.
- Financial & Tax Records: Retained for 7 years to comply with statutory accounting requirements under Indian tax regulations.
- Consent Records: Audit trails of consent choices are stored for 3 years following consent withdrawal or account termination for legal compliance.
4. Third-Party Data Processors
We engage trusted third-party service providers ("Data Processors") who operate under strict contractual data protection agreements:
- Supabase: Cloud database infrastructure and authentication provider.
- Cashfree PG: RBI-licensed payment gateway processing payments and recurring subscriptions.
- Cloudflare R2: Encrypted cloud storage for client proposal documents and deliverables.
- Resend: Transactional email service for portal invites, password resets, and notifications.
- Google Gemini AI: Processing text inputs for optional AI proposal generation (no training on user data).
5. Data Principal Rights (DPDP Act, 2023)
As a Data Principal under Indian law, you possess the following statutory rights:
Right to Access (Sec. 11)
Request a summary of personal data being processed and identities of Data Processors shared with.
Right to Correction & Erasure (Sec. 12)
Request correction of inaccurate data, completion of incomplete data, or erasure of personal data.
Right of Grievance Redressal (Sec. 13)
Seek resolution of grievances regarding data processing from our designated Grievance Officer.
Right to Withdraw Consent (Sec. 6(4))
Withdraw consent at any time with ease equal to the manner in which consent was originally granted.
6. Grievance Redressal Contact Details
For any grievances, concerns, or requests regarding personal data processing, please contact our Data Protection & Grievance Redressal Officer:
Designation: Data Protection & Grievance Redressal Officer
Email Address: grievance@heliumsuite.online
Response SLA: Within 30 days from receipt of grievance as mandated by DPDP Act Section 13.