Privacy Policy

This Privacy Policy explains what information Storafleet — operated by Country Devs LLP — collects, how we use it, and the rights you have over it. It applies to the storafleet.com website and the Storafleet application.

1. What we collect

• Account data: name, email, organisation name, and hashed password.
• Billing data: billing address, GSTIN/PAN if you provide them, invoice history, Razorpay payment IDs. We do not see or store your card or bank details — Razorpay handles that.
• S3 credentials: access keys you supply to connect a bucket. These are encrypted at rest using AES-256 and decrypted only at the moment of use.
• Usage data: IP address, browser type, pages viewed, and actions taken in the app. Used for security and product improvement.

2. What we don't collect

We do not copy the contents of your buckets onto our servers. The object bytes live in your AWS account. When you browse or preview a file, Storafleet generates a presigned URL against your own AWS endpoint — we never handle the payload.

3. How we use it

• To provide, maintain and improve the Service.
• To issue invoices and collect payment for paid plans.
• To send operational email (security alerts, receipts, dunning).
• To respond to support requests.
• To detect and prevent abuse.

4. Who we share it with

• Razorpay — payment processing and subscription charging.
• Amazon Web Services — to talk to your S3 buckets on your behalf. We always use the credentials you provide; we never use a master key.
• Transactional email providers — to deliver account, billing, and notification email.
• Google Analytics / PostHog — usage analytics. You can opt out via your browser's Do Not Track setting.

We do not sell or rent personal data. We never share S3 credentials with third parties.

5. Your rights

You can access, correct, export, or delete your account data at any time from the workspace settings page or by emailing privacy@storafleet.com.

6. Retention

Invoices and ledger records are retained for 8 years to comply with Indian tax law. Everything else (usage logs, metadata cache, S3 credentials) is purged within 30 days of account closure.

7. Data location

Our application servers and databases are hosted in Mumbai, India (ap-south-1). Backups are encrypted and retained in the same region.

8. Changes

We will announce material changes to this policy via email and an in-app notification at least 14 days before they take effect.