Privacy Policy

This Privacy Policy describes how Sahayogi One Private Limited ("Company", "we", "us", or "our") processes personal information in connection with Sahayogi One (the "Platform") — the administrative control plane customers use to sign in once, manage organisations, workspaces, and users, and launch every other Sahayogi product their team has access to.

This page describes our current data-handling practices. It is not a certification, legal opinion, or promise of controls that are not yet implemented.

We may process the following categories of information:

a. Identity and account information

• Name, email address, and mobile number used to sign in and identify your account
• Organisation and workspace details, role assignments, and access configuration
• Information submitted during onboarding, provisioning, or support requests

b. Cross-product administration data

• Which Sahayogi products and modules an organisation or user is entitled to
• Subscription and plan information for products provisioned through the Platform
• OIDC application (client) registrations for products that authenticate through the Platform

c. Technical and security data

• Session and authentication data used to sign in and secure access (the Platform is the single sign-on identity provider for the Sahayogi product suite)
• IP address, request timestamps, device or browser details, and security/audit logs
• Cookie-based session and preference data

d. Communications data

• Email or support conversations with our team
• OTP delivery events and verification records used for login

We use information to operate and secure the Platform, including to:

• Create and administer accounts, organisations, and workspaces
• Authenticate users centrally and issue access to connected products via single sign-on
• Enforce role-based access and product entitlements across the Sahayogi suite
• Provide support, onboarding, and service communications
• Investigate misuse, security incidents, fraud, or operational failures
• Meet statutory, audit, or contractual obligations
• Improve the Platform based on operational feedback and usage patterns

We do not sell personal information. We may share information only where reasonably necessary, including with:

• Other Sahayogi products your organisation has been provisioned into, strictly to enable single sign-on and enforce the access/entitlements your organisation has configured
• Service providers that support hosting, messaging, email delivery, storage, or similar infrastructure
• Professional advisers, auditors, or authorities when required by law or to protect legal rights
• A successor entity in connection with a restructuring, financing, merger, or sale of business assets

Our current implementation includes a number of practical security controls, such as:

• Encrypted transport over HTTPS/TLS in production environments
• Centralized OIDC-based authentication, hashed passwords, and server-side hashed OTP verification
• Role-based access controls and workspace-scoped access checks
• Rate limiting on authentication and other sensitive routes
• Structured application logging with redaction for secrets and sensitive fields
• Audit logging for account, access, and administrative actions

Security controls evolve over time, and this page should be read as a current-state summary rather than an absolute guarantee that every control applies uniformly to every deployment, module, or integration. See also our Security page.

We retain information for as long as needed for the relevant service purpose, support need, security review, or legal retention requirement. Some data may need to be preserved for statutory, fraud-prevention, or audit reasons even after an account is closed or access is disabled.

Retention periods can therefore vary by data type. Requests for deletion or cleanup are reviewed in light of those obligations and the Platform's current retention mechanics.

Depending on the law that applies to your request, you may be able to ask us for access, correction, deletion, objection, restriction, export, or withdrawal of consent for certain data-processing activities — including under India's Digital Personal Data Protection Act, 2023.

Some requests may be limited where we must retain records for legal, security, or dispute-resolution purposes, or where the data is held by us on behalf of an organisation that controls the underlying use.

To make a request, contact us at support@sahayogi.in.

We use cookies and similar storage mechanisms primarily for authentication, session continuity across the single-sign-on flow, short-lived verification steps, and product preferences.

The Platform may rely on third-party infrastructure or communication providers to operate — for example, cloud hosting and transactional email delivery. Those providers may process limited information as part of delivering their service to us. Their own policies and contractual terms apply to the parts of processing they control.

Sahayogi One is intended for business use. It is not designed for children, and we do not intentionally build the service for use by minors. Account creation on the Platform happens only through organisation administration or provisioning, not open self-registration.

We may update this Privacy Policy as our product, legal obligations, or data flows change. The latest version will be posted on this page with an updated revision date.

For privacy questions or rights requests, contact: