Privacy Policy
This policy explains how Morya Digitech ("we") collects and uses personal data when you use MDFAST Counter POS, its website and admin tools. It is issued under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 with its rules.
1. Two kinds of data
| Data | Whose | Our role |
|---|---|---|
| Account data: shop name, owner name, mobile, email, GSTIN, address, city, state, usernames, plan and payment records | The shop owner and Users | We are the Data Fiduciary |
| Business records entered in the POS: the shop's customers (names, mobiles, addresses, GSTIN), bills, payments, stock | The shop's own customers | The shop is the Data Fiduciary; we process it only on the shop's behalf as a Data Processor |
2. What we collect
- Details you give at signup, renewal or support, or when you ask for a free demo / call back (name, mobile, shop name, city, what you need) — used only to contact you about MDFAST.
- Login and security records: username, date and time, IP address, browser type, failed login attempts, acceptance of the License Agreement.
- Fair use of free trials: a random identifier for your browser (stored in your browser and as a cookie) and the IP address used at sign-up and login, compared with earlier sign-ups only to stop the same business taking repeated free trials.
- Website visits (mdfast.in): the page opened, the website you came from, browser type, phone or computer, and the country / state / city worked out from your IP address — the IP address itself is not saved. Visits are counted with the same random browser identifier (kept only as a one-way code), are used only to see how the website is used, are not shared with anyone and are deleted after 13 months.
- Questions typed in the website chat (“💬 Ask us”): the question only — email addresses and phone numbers in it are blanked out — kept 6 months to improve the answers.
- Payment records: order number, amount, GST, payment reference and status. Card, UPI and bank details are handled by the payment gateway (Razorpay) and are not stored by us.
- Emails we send you (invoices, reminders) and messages you send us.
- Support tickets you raise in Help: what you write, the screenshots you attach, and — added by the Software — the screen you were on, the POS build, your browser and the error messages shown just before. Screenshots may show your business records; only MDFAST support staff see them.
3. Why we use it
- To create and run your account, let your Users log in, and provide the features of your plan.
- To take payments, issue GST invoices and keep accounts as required by tax law.
- To send login details, invoices, renewal reminders and important service or security notices.
- To keep the service secure, prevent misuse and fraud, and fix problems.
- To meet legal obligations and answer lawful requests of authorities.
We process account data on the basis of your consent given when you accept the License Agreement and this policy, and for the legitimate uses allowed by the DPDP Act (such as complying with law and performing what you asked for). We do not sell personal data and do not use it for third-party advertising.
4. Who we share it with
- Hosting provider: Amazon Web Services, servers in Mumbai, India.
- Payment gateway: Razorpay, for payments you make.
- Email service provider, to deliver emails.
- Our professional advisers (accountant, lawyer), and government authorities when required by law.
Each of them receives only what is needed for that purpose.
Google Drive backup (optional). If the shop owner connects a Google account (Settings → Safe copies), the Software asks Google only for permission to see, create and delete the files it makes itself (scope drive.file). It creates one folder and puts the shop's backup files there, each encrypted with the shop's own backup password, keeps the number of copies the owner chose and deletes older copies it made. It does not read, use or share any other file in that Google account, and Google user data is never used for advertising, never sold and never used to train any model. The Google permission is stored encrypted on our server only to make these backups, and is removed when the owner presses Disconnect (it can also be removed at myaccount.google.com). The use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
5. Where and how long it is kept
- Data is stored in India.
- Account data is kept while the account is active and for 90 days after it ends; invoices and payment records are kept for the period required by GST and income-tax law (generally 8 years).
- Shop business records are kept while the account is active and for 90 days after it ends, then deleted, unless the shop asks for earlier deletion or the law requires longer retention.
- Backups are overwritten on a rolling basis.
- Support tickets are kept while the account is active; their screenshots are deleted 180 days after the ticket is closed.
6. How we protect it
We use reasonable security practices: encrypted connections (HTTPS), hashed passwords, a separate database for every shop, access only by authorised persons, limited login attempts, server hardening, regular security updates and daily backups. No system is completely secure; if a personal data breach affects you, we will inform you and the Data Protection Board of India as required by law.
7. Your rights
Under the DPDP Act you may ask us to: give a summary of your personal data we process; correct or complete it; erase it when it is no longer needed (subject to legal retention); withdraw consent (this may end the service); and nominate a person to exercise these rights on your behalf. Customers of a shop should contact that shop for data it holds; we will help the shop respond.
8. Cookies and browser storage
The Software stores your login token and screen settings in your browser's local storage so that you stay logged in. We use one cookie (a random browser identifier) for the fair-use check of free trials and to count website visits, as described in section 2. We do not use advertising cookies and we do not let any other company track you on our website.
9. Children
The Software is meant for businesses and is not directed to children under 18. We do not knowingly collect their personal data except as entered by a shop as part of its own business records.
10. Grievance Officer
Morya Digitech, India
Email: moryadigisolutions@outlook.com · Phone: +91 92702 33319
We will acknowledge a complaint within 48 hours and try to resolve it within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.
11. Changes
We may update this policy. The new version will show its date and you will be asked to accept it at your next login.