In short
- This notice covers the people who sign up for and sign in to MatruOS: owners, staff, accountants and others they invite.
- Service providers that run parts of MatruOS are named on the Sub-processors page, with where each one works.
- MatruOS runs on servers in the United States today. A move to Amazon Web Services in Mumbai is planned, and the notice will be updated when it is done.
- MatruOS's own pages use only the cookies they need to work. No advertising or cross-site tracking cookies.
- You can see, correct and ask to erase your data under the DPDP Act, and complain to the Grievance Officer.
This notice explains how Code Colonies Private Limited ("MatruOS", "we") handles the personal data of the people who sign up for and sign in to MatruOS: business owners, their staff, accountants and others they invite. It is given under section 5 of the Digital Personal Data Protection Act 2023 (DPDP Act) and rule 3 of the DPDP Rules 2025.
Two different roles.
- For your own account,
- we are the "Data Fiduciary". That covers your name, phone, email, sign-ins and billing details, and we decide how they are used, as this notice explains.
- For the data your business keeps in MatruOS,
- your business is the Data Fiduciary and we are its "Data Processor". That covers its customers, suppliers, staff records and so on. That data is handled under the Data processing addendum. To ask about it, please contact the business itself. You can find its privacy notice and privacy centre on its own website or invoices.
Section 1What we collect, and why
| What | Why we need it | Lawful ground |
|---|---|---|
| Your name, mobile number and email | To create your account, sign you in with a one-time code, and contact you about your account | You give it to use MatruOS (DPDP Act s.7(a)) |
| Your role and the businesses you belong to | To show you the right business and permissions | s.7(a) |
| Business identity of the owner: GSTIN, Udyam or PAN (a sole proprietor's PAN is personal data) | To check the business is real, fill in its details and issue GST invoices | s.7(a), and the CGST Act for invoices |
| The service partner who introduced your business, if you signed up through a partner's link | To record how your business came to MatruOS | s.7(a) |
| The business whose "Made with MatruOS" link you followed, and the kind of page it was on (an invoice, a store), if you tapped "Set up" from it | To record how your business came to MatruOS. Nothing about your visit is kept before you sign up | s.7(a) |
| Sign-in records: time, device, browser, IP address, approved devices and approximate location from the IP address | To keep your account safe, spot unusual sign-ins and meet CERT-In's log rules | s.7(a), and legal duty (s.7(c)) for CERT-In logs |
| Passkeys and two-step sign-in settings | To sign you in securely. We never see your fingerprint or face: these stay on your device | s.7(a) |
| Payment details: plan, invoices, UPI mandate reference, and the last 4 digits of a card | To bill you and keep tax records. Card and UPI details are held by the payment gateway, not by us | s.7(a), and legal duty for tax records |
| Messages to support, and support visits you allow | To help you, and to show you what support staff saw | s.7(a) |
| How you use MatruOS: pages opened, features used, errors and speed | To fix problems, keep MatruOS fast and improve it. We use this only in aggregated, de-identified form and never sell it | s.7(a) |
| Anonymous counts of which built-in ways of working helped your business | Only if your owner turns on "Share anonymous counts of what worked" in Settings › Your data, to improve every MatruOS AI team. Counts are combined with at least 25 other businesses and never identify you | Consent of the owner, which can be withdrawn by turning it off |
| Optional items, such as a profile photo, your language and marketing emails | Only if you choose to give them | Your consent, which you can withdraw at any time |
We do not collect more than we need. We never sell your personal data, and we never use it for third-party advertising.
Section 2Who we share it with
- Service providers
- who run parts of MatruOS for us, under contracts that bind them to use the data only for us and to keep it secure. They are listed on the Sub-processors page, which shows which are in use now (hosting, database, email, bot checks and AI processing) and which are planned (SMS, WhatsApp and payments).
- The businesses you belong to
- Owners and admins of a business can see your name, role, sign-ins to that business and the work you do in it.
- Authorities,
- only when the law requires it and through a written order. We tell the person concerned unless the law forbids it.
- A buyer of MatruOS,
- if the company is sold. The buyer would be bound by this notice.
Section 3Where it is stored
- Now: MatruOS runs on servers in the United States: the application in Cleveland, Ohio (Vercel) and the database in Ohio (Neon, on Amazon Web Services). The Sub-processors page names every provider and where it works.
- Planned: we are moving hosting, the database, file storage and email to Amazon Web Services in Mumbai, India. We will update this notice and tell you in the app when the move is complete. We do not give a date until it is done.
- The DPDP Act allows personal data to be transferred outside India except to countries the Central Government restricts under section 16; none is restricted today. Every transfer is protected by contract and by encryption in transit and at rest.
Section 4How long we keep it
| What | How long |
|---|---|
| Account details | While you belong to an active business on MatruOS. When the business closes or removes you, 30 days for export, then deleted within a further 30 days |
| Accounts that are no longer used | If you have not signed in for 3 years and belong to no active business, we erase your account. We email you at least 7 days before, and signing in keeps it |
| A business that never chose a plan | View-only after its 7-day free trial. If still unpaid 90 days after that, we may delete it after telling the owner at least 7 days before |
| Sign-in and security logs | 1 year (DPDP Rules r.6(1)(e)); CERT-In logs at least 180 days |
| Invoices and payment records | 8 years, as tax and company law require |
| Support messages | 2 years after the conversation ends |
| Usage statistics | Kept only in aggregated form that does not identify you |
| Anonymous counts you chose to share | Deleted within 90 days of turning sharing off |
Copies in encrypted backups are overwritten as the backups expire, within 90 days of deletion.
Section 5How we protect it
Encryption in transit and at rest, strict separation of each business's data, two-step sign-in, passkeys for staff, approved devices, access by MatruOS staff only with the business's consent, logs that cannot be altered, regular backups, and an incident plan. MatruOS is built to ISO 27001 and SOC 2 standards. If a breach affects your personal data, we tell you and the Data Protection Board of India as the DPDP Rules require.
Section 6Your rights
Under the DPDP Act you can:
- see
- a summary of your personal data and how it is used, and who it has been shared with (s.11);
- correct, complete or update
- it (s.12);
- erase
- it, unless we must keep it by law (s.12);
- withdraw consent
- for anything that is based on consent, as easily as you gave it (s.6(4)). Withdrawal does not affect what was done before;
- nominate
- someone to act for you if you die or cannot act (s.14);
- complain
- to us first, and then to the Data Protection Board of India (s.13).
Some of this you can do yourself:
- correct your name, phone and language in Settings › My profile;
- download a full copy of your business's data, or close the business (which erases it after the notice period), in Settings › Your data, if you are the owner;
- stop marketing emails with the unsubscribe link in any of them;
- turn "Share anonymous counts of what worked" on or off in Settings › Your data, if you are the owner.
For everything else (a summary of your data, erasing your own account inside a business you do not own, a nomination, or a complaint), write to consulting@codecolonies.com. Withdrawing consent by email is as valid as any button. We reply within 30 days at most, and usually much sooner. We may ask you to confirm who you are.
Section 7Cookies
MatruOS's own pages use only the cookies it needs to work: your sign-in session, security checks, approved device, and your language choice. We do not use advertising or cross-site tracking cookies. If we ever add optional analytics, we will ask first and you can say no.
Business websites and stores built on MatruOS show their own consent banner, run by the business, for any cookies they choose to use.
Section 8Children
MatruOS is for businesses and is not meant for anyone under 18. We do not knowingly collect children's data for our own purposes. A school, coaching centre or other business that keeps children's data in MatruOS is responsible for getting a parent's or guardian's verifiable consent, and MatruOS gives it the tools to do so.
Section 9Changes to this notice
When we change this notice we update the date and version below. If the change affects how we use your data, we tell you in the app before it applies and, where needed, ask for your consent again.
Section 10Contact and complaints
- Privacy questions and requests: consulting@codecolonies.com.
- Grievance Officer: Dr. Mahipatsinh Sagar, with the Consulting team, Code Colonies Private Limited, consulting@codecolonies.com. See the Grievance page for how complaints are handled.
- If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
Code Colonies Private Limited, 12th Floor, Office 1216 and 1217, i-Square, Science City Road, Sola, Ahmedabad 380063, Gujarat, India. CIN U62091GJ2023PTC140196 · GSTIN 24AAKCC9592Q1ZO · Udyam UDYAM-GJ-01-0264196.