Privacy Policy

This policy explains what information Comriq collects when you use our website, why we collect it, and the choices you have. The data controller is Green Rajasthan Private Limited (trading as Comriq).

What Comriq does now, so you can judge the rest of this page

Comriq builds software products — Stay for hotels, Campus for schools and colleges, and People for HR and payroll. They are in development and we are taking founding customers. Design and engineering work is done by Comriq Studio at studio.comriq.com, which has its own privacy notice.

We no longer sell company setup, compliance, tax, accounting, registrations or notice support. That matters here because it is the reason this version is shorter than the last one: we no longer collect identity documents in order to file them with a government authority, so the paragraphs describing that collection have gone rather than being left on the page.

Information we collect

• An early-access sign-up — your name, the hotel, school or company you are with, roughly how big it is, and a work email address or WhatsApp number. We also record which product you chose, the moment you ticked the consent box, and which version of this notice you ticked it against.
• An enquiry or a support message — your name, your email address and whatever you write to us.
• Account data, where you have an account — Comriq creates no account without an engagement. Where one exists, we hold the email address it signs in with and the records of what was done through it.
• Documents already in the vault — where we delivered work for you before October 2026, the identity, company and financial documents you gave us for it are still held under the retention rules below. We are not asking for any more of them.
• Site data — limited technical and preference data set by cookies, described in our Cookie Policy.

How we use it

• To reply to you about early access to a product, and to tell you when it is ready for you to try.
• To answer an enquiry or a support message.
• To operate the accounts that exist, and to keep the records of work already delivered.
• To meet our own record-keeping and legal obligations.
• To operate, secure and improve our website.

We do not use an early-access sign-up to market unrelated things to you, we do not sell your information, and we do not share it for anyone else's marketing.

Consent, and taking it back

An early-access sign-up is sent only when you tick an unticked box. That is deliberate: under s.6 of the Digital Personal Data Protection Act 2023 consent must be free, specific, informed and unambiguous, and a box that arrives ticked is none of those things. We record when you ticked it and which version of this notice you ticked it against, because that is the only way either of us can show later what you actually agreed to.

You can withdraw it at any time by emailing privacy@comriq.com from the address you signed up with. Withdrawing is as easy as giving it: one email, no form and no reason required. We stop contacting you about the product and delete the sign-up, unless it has become part of an engagement record inside the retention window below — in which case we say so and tell you the date it can go.

Who we share it with

Only where it is needed to do the work: with service providers who process data on our behalf under contract, named below. We do not sell your information. We may disclose it where the law requires us to.

Where it is stored, and who processes it

Named, because "reputable providers" tells you nothing you can check.

• Supabase — the database and the document vault.
• Vercel — hosting and delivery of this website, including server logs and cookieless usage analytics.
• Postmark — transactional email: your acknowledgement, and replies to anything you send us.
• Microsoft 365 — the mailboxes behind hello@comriq.com, support@comriq.com, privacy@comriq.com and grievance@comriq.com.

We will name a payment processor here before we take a payment, and not after. Comriq is not taking payments for its products today.

How long we keep it

Three clocks, because three different things are being kept.

• An early-access sign-up or an enquiry that never became an engagement — deleted within 24 months of the last contact, or on request, whichever is sooner.
• Engagement records already created: what we filed for a client, when, and the documents supporting it — kept for eight years from the end of the financial year the work relates to. That is not a number we chose, and it does not change because we have stopped selling that work: s.128 of the Companies Act 2013 requires books and the papers behind them to be preserved for eight financial years, and destroying the evidence behind a filing sooner would leave a former client unable to answer a question from the authority.
• A document you ask us to delete — removed from the vault on request, unless it is inside that eight-year window, in which case we say so and tell you when it can go.

Security

We take reasonable technical and organisational measures to protect your information: data encrypted at rest, access logged, and access to the vault scoped to your organisation by row-level security. No method of storage or transmission is completely secure, so we cannot guarantee absolute security, but we work to reduce the risk.

Your choices

You can ask us what information we hold about you, ask us to correct or delete it, or withdraw a sign-up, by emailing privacy@comriq.com from the address the request relates to. We acknowledge within one business day and answer in full within 30 days.

That address is separate from support on purpose: a data request starts a clock, and a clock does not run reliably from a queue that is also answering other questions.

Where we cannot do what you ask — because the record is inside the eight-year retention window above — we will say so, say why, and tell you the date it can be deleted. We will not simply not reply.

Where the law applies, and where the data goes

We are a company incorporated in India, so the Digital Personal Data Protection Act 2023 governs how we handle your personal data. Where we work with a customer established elsewhere, the law of that market may apply as well.

The processors named above operate globally, and your information may therefore be processed on infrastructure outside India. We use them under contract and for the purposes set out on this page only.

Where your data physically sits

Named, because a transfer you cannot see is a transfer you cannot weigh.

Processor	What it holds	Where
Supabase	The database and the document vault	Mumbai (ap-south-1)
Vercel	Hosting, edge logs	Global edge; India is served from Mumbai
Postmark	Outbound email and its log	United States
Microsoft 365	Our mailboxes and the document mirror	Per our tenant

Postmark is the one that leaves India by design. It holds the recipient's address and the message body — nothing that was not already on its way to that person's inbox.

Grievance Officer

Under rule 4(2)(d) of the Consumer Protection (E-Commerce) Rules 2020 and s.13 of the DPDP Act, complaints about how we handle your data go to our Grievance Officer at grievance@comriq.com. We acknowledge within 48 hours and resolve within one month.

If we do not resolve it

You may complain to the Data Protection Board of India, established under Chapter V of the DPDP Act 2023. You do not need our permission and you do not need to tell us first, though we would rather you gave us the chance.

What we do not claim

We do not claim a compliance certification we do not hold. Our grievance officer is appointed and reachable, our incident procedure is written, and our data-processing template exists — none of them has yet been reviewed by counsel, and we would rather tell you that than display a badge.

Changes and contact

We may update this policy as our practices and legal review develop. Questions can be sent to privacy@comriq.com.