Privacy Policy

1. Who we are

MANUPRIME is manufacturing ERP software operated by AnantaTech Hub Private Limited ("MANUPRIME", "we", "us", "our"), a company incorporated in India (CIN U62099GJ2025PTC164561) with its registered office at 202, Avadh Shopping Center, Baben, Bardoli – 394601, Dist. Surat, Gujarat, India.

For personal data processed through the MANUPRIME website and marketing activities, we are the data controller (in Indian terms, the Data Fiduciary).

For personal data that a customer loads into their MANUPRIME workspace — their employees, their customers, their suppliers — the customer is the controller and we act as a processor (Data Processor) on their instructions, under the agreement between us. This policy describes what we do as controller; what we do as processor is governed by that agreement and summarised in section 3.

2. Personal data we collect

We collect only what we need. The categories differ depending on how you interact with us.

3. Why we use personal data, and our legal basis

We process personal data for the purposes below. Where the GDPR or UK GDPR applies, the legal basis is named; where the Digital Personal Data Protection Act, 2023 applies, we rely on your consent or on a legitimate use as that Act defines it.

4. What we do not do

• We do not sell personal data, and we never have.
• We do not share Customer Data with other customers, and we do not pool it.
• We do not use the contents of a customer workspace to train models — ours or any third party’s — or to build features for anyone else. Where an AI feature sends data to a provider, it is sent to answer that request and under terms that exclude training on it.
• We do not run advertising networks or third-party ad tracking on this website.

5. Consent, and how to withdraw it

Where we rely on your consent, you can withdraw it at any time — by using the unsubscribe link in any message, or by writing to us at the address in section 12. Withdrawal takes effect going forward and does not make earlier processing unlawful.

Withdrawing consent to marketing does not affect messages we must send about your service — invoices, security notices, and changes to these terms.

6. Who we share personal data with

We share personal data only with the categories of recipient below, and only as far as each needs it.

• Contabo, our cloud-hosting provider, which runs the servers the service operates on, from its Indian region.
• Our payment processor, Razorpay, which handles payments and issues receipts, and the banks behind it.
• Resend, which delivers transactional email — enquiry acknowledgements, account and billing notifications. Resend operates from the United States, so this is one of the transfers described in the next section.
• Meta Platforms, where you use the WhatsApp Business integration, and any SMS provider whose account you connect. Where you bring your own provider account, that provider is your processor, not ours.
• Compliance intermediaries such as a GST Suvidha Provider, where you use e-invoicing or e-way bill generation through the product. We will name the specific intermediary here once one is contracted.
• Professional advisers — auditors, lawyers, accountants — bound by confidentiality.
• Public authorities, where we are legally required to disclose and after satisfying ourselves that the demand is valid.
• An acquirer or successor, if the business is transferred, in which case this policy continues to apply until you are told otherwise.

7. Data storage, residency and international transfers

Customer Data is stored in the region the customer belongs to — Indian customers in India, European customers in the EU, and so on for any market we enter. We are selling into the Indian market today, and every deployment currently runs on cloud infrastructure in India. If you need your data in a specific jurisdiction, name it in the agreement and we will confirm the region before anything is provisioned rather than after. Some of the providers named in section 6 operate outside India, and limited personal data (support correspondence, billing records, message delivery metadata) may be processed in those countries.

Where personal data leaves the UK or the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses (or the UK International Data Transfer Addendum) together with an assessment of the destination, unless an adequacy decision applies. Where the Digital Personal Data Protection Act, 2023 restricts a destination, we do not transfer there.

A customer on a dedicated or on-premise deployment can require that their workspace stays within a named jurisdiction; we confirm that in the agreement.

8. How long we keep personal data

9. Your rights

Subject to the law that applies to you, you have the rights below. Exercising them is free, and we will not treat you differently for doing so.

• Access — to be told what personal data we hold about you and to receive a copy.
• Correction — to have inaccurate or incomplete data corrected.
• Erasure — to have data deleted where we no longer have a basis to keep it.
• Portability — to receive data you gave us in a structured, machine-readable format.
• Restriction and objection — to limit or object to certain processing, including profiling.
• Withdrawal of consent — at any time, as described in section 5.
• Nomination — under the Digital Personal Data Protection Act, 2023, to nominate someone to exercise your rights in the event of death or incapacity.
• Non-discrimination — under the California Consumer Privacy Act, not to be discriminated against for exercising a right. We do not sell or share personal information as those terms are defined there.
• Complaint — to a supervisory authority, or to the Data Protection Board of India.

10. Making a request

Write to contact@anantatechhub.com with enough detail to identify the data you mean. We respond within 30 days; if a request is complex we will tell you why and when to expect a full answer.

Where you are an employee, customer or supplier of one of our customers, the data about you sits in their workspace and they control it. Send your request to them; if it reaches us we will pass it on and tell you we have done so.

We may ask for enough information to verify who you are. We ask for the minimum that makes verification meaningful, and we do not use it for anything else.

11. How we protect personal data

No system is perfectly secure, and we do not claim otherwise. What we commit to is a defined standard of care and honest, prompt disclosure when something goes wrong.

If a personal data breach occurs that is likely to affect you, we will notify the Data Protection Board of India and every affected person as the Digital Personal Data Protection Act requires, and any other regulator the law requires, without undue delay. Where an incident falls within the CERT-In Directions of 28 April 2022, we report it to CERT-In within the six hours those Directions specify. Where the GDPR applies to a transfer, we also meet its 72-hour notification requirement.

• Data in transit is encrypted using TLS, on every connection to the app, the API and the shop-floor entry screens.
• Role-based access control inside the product, and access to production systems limited to the people whose role requires it and removed when that role ends.
• Credentials and API tokens are held server-side and are never exposed to a browser.
• Passwords, where we hold them, are stored only as salted hashes and never in a readable form.
• Audit logging of access to production systems.
• Segregation of each customer workspace; a dedicated instance is separated at the database level.
• Systems are patched, and backups are taken and access-controlled to the same standard as the live data.
• Confidentiality obligations on every employee and contractor.

12. Children

MANUPRIME is business software and is not directed at children. We do not knowingly collect personal data of anyone under 18. If you believe a child’s data has reached us, tell us and we will delete it.

13. Cookies and similar technologies

This website uses only what it needs to function, plus Google Analytics — which is loaded only if you accept it on the banner, and not loaded at all if you decline. We do not use Google Signals, advertising features or cross-device tracking, so it does not follow you to other sites. Full detail, the cookie names and how to change your choice are in our Cookie Policy.

14. Grievance Officer and data protection contact

Indian law requires us to publish who handles complaints about personal data. Those details are below and are not hidden behind a form.

15. Changes to this policy

We update this policy when what we do changes. The effective date at the top always reflects the current version. Where a change materially affects your rights we will tell customers directly rather than relying on you noticing the date.