Privacy policy

1. Introduction and scope

This Privacy Policy explains how Niohive Technology Services Pvt. Ltd. ("Niohive", "Densyti", "we", "us" or "our"), the company that builds and operates Densyti and its apps, including Densyti Mail, Chat, Tracker and Store, the admin console, domains and email migration (the "Service"), collects, uses, discloses and protects information in connection with our website, our Service and our interactions with visitors, prospective customers, business customers ("Customer", meaning the organization that holds a Densyti account) and Customers' authorized end users.

This Policy applies to densyti.com and to the Service. It does not apply to third-party websites, applications or services that we do not control, even where linked from our Service.

If you are an end user of a Customer's Densyti account, for example an employee using a company-issued mailbox, your organization's own privacy notice governs how it uses your account, in addition to this Policy. See Section 6, "Customer Content: our role as processor".

2. Key definitions

• Account Data: information a Customer or prospective Customer provides to create, administer and pay for a Densyti account (for example business name, billing contact, domain and admin user details).
• Customer Content: the content a Customer or its end users store, send or receive through the Service, such as email messages, attachments, calendar entries and contacts in Mail, messages and files in Chat, tasks and projects in Tracker, and products, orders and shopper details in Store.
• Usage Data: technical and behavioral data generated by using the Service or website, such as sign-in times, IP addresses, feature usage, and device or browser information.
• Customer: the business entity that has registered for a Densyti account.
• End User: an individual for whom a Customer has created a mailbox or account within the Service.

3. Information we collect

3.1 Account and business data

Business name, billing and company address, tax or GST information, domain names, administrator contact name, email and phone number, and payment details. Payment card details are processed by our payment processor; we do not store full card numbers ourselves. When we register a domain for you, we collect the registrant details the domain registry requires.

3.2 Customer Content

As defined in Section 2, we collect and store Customer Content because doing so is the core function of the Service, on the Customer's instructions. When a Customer uses email migration, we use the access details it provides for the old mailbox only to copy its content into Densyti, and we do not keep them after the migration ends.

3.3 Usage and log data

Sign-in events, IP addresses, timestamps, device and browser type, feature interaction data, and mail-flow metadata such as sender and recipient headers and delivery status, needed for spam filtering, deliverability and troubleshooting.

3.4 Device and technical data

Operating system, browser type and version, screen resolution, and an approximate location (city or country level) inferred from IP address.

3.5 Cookies and browser storage

See Section 12, "Cookies and browser storage", for what we store in your browser and how to clear it.

3.6 Support and sales communications

Information you provide when you contact us, book a demo, ask for support, sign up for the newsletter or correspond with our support or sales teams, including your name, email address, company and the content of your message.

4. How we use information

• Provide, operate, secure and maintain the Service, including automated spam and malware filtering.
• Authenticate accounts and prevent fraud, abuse and unauthorized access.
• Process payments and manage billing and subscriptions.
• Provide customer support and respond to questions.
• Send service, security and administrative messages.
• With consent or a legitimate interest, send product updates and the newsletter, which you may opt out of at any time.
• Improve and develop the Service, including through aggregated or anonymized usage analysis.
• Comply with legal obligations, enforce our terms, and protect our rights and the rights of Customers and end users.

We do not use Customer Content to serve advertising, and we do not sell Customer Content or Account Data to third parties.

5. Legal bases for processing

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

• Performance of a contract: providing and operating the Service for Customers.
• Legitimate interests: security, fraud prevention, service improvement, and direct marketing to existing business customers, where those interests are not overridden by your rights.
• Consent: marketing messages to prospective customers and the newsletter.
• Legal obligation: tax, accounting and law-enforcement requests.

For processing of Customer Content specifically, our legal basis flows from our written agreement with the Customer, who determines the basis on which its end users' data is processed. See Section 6.

6. Customer Content: our role as processor

Where a Customer stores, sends or receives Customer Content through the Service, we act as a data processor (or "service provider" under the CCPA/CPRA) acting on the Customer's documented instructions, and the Customer acts as the data controller (or "business") for that content, including for its end users' and shoppers' personal data. In this role, we:

• process Customer Content only to provide, secure and support the Service, or as required by law;
• do not access, review or scan the substance of Customer Content for advertising purposes;
• limit employee access to Customer Content to what is strictly necessary for support, security or legal compliance, subject to authentication and audit logging; and
• make a data processing agreement incorporating Standard Contractual Clauses available on request to Customers who require one.

Customers are responsible for giving their own end users and shoppers appropriate privacy notices and for having a lawful basis to process their personal data within the Service.

7. How we share information

• Subprocessors and service providers: hosting and infrastructure, cloud storage, payment processing, email deliverability, domain registration and customer-support tooling providers, each bound by contractual confidentiality and data protection obligations. A current subprocessor list is available on request.
• Legal and regulatory disclosure: where required to comply with applicable law or valid legal process, or to protect the rights, property or safety of Niohive, our Customers or others.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to continued protection under this Policy or a materially equivalent one.
• With Customer instruction or consent: for example, when a Customer connects a third-party integration such as a payment provider for its store.

We do not sell or rent personal information, and we do not share Customer Content or Account Data with third parties for their own independent marketing purposes.

8. International data transfers

Customer Content is stored in the region the Customer chooses, as described on our data location page. We and our subprocessors may process other information in countries other than where you or your organization are located, including India, the United States and the European Economic Area.

Where we transfer personal data out of the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions or other lawful transfer mechanisms. Where we transfer personal data governed by India's Digital Personal Data Protection Act, 2023, we do so consistent with any conditions or restrictions notified by the Central Government from time to time.

9. Data retention

• Account Data: kept for the duration of the Customer relationship and for up to 90 days afterward to allow account recovery, then deleted or anonymized, unless a longer period is required for legal, tax or dispute-resolution purposes.
• Customer Content: kept per the Customer's plan and settings, including any retention or archiving settings the Customer enables, and deleted within 30 days of account termination, except for copies that persist briefly in encrypted backups, which are rotated out within a further 30 days.
• Usage and log data: generally kept for up to 12 months for security and troubleshooting, then aggregated or deleted.

You may ask for earlier deletion of Account Data by contacting us, subject to Section 11.

10. Security measures

• Encryption in transit with TLS for all mail and web traffic, and encryption at rest for stored Customer Content.
• Automated spam, malware and virus filtering on inbound and outbound mail.
• Two-step sign-in available on all accounts, and admins can require it for everyone.
• Domain authentication support (DKIM, SPF and DMARC) to reduce spoofing and phishing.
• Continuous infrastructure monitoring and anomaly detection.
• Automated daily backups with tested restoration procedures.
• Role-based access controls and audit logging for internal systems access.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we work to protect information using safeguards appropriate to its sensitivity, reviewed regularly as the Service and threats change. Read more on our security page.

11. Your privacy rights

11.1 GDPR and UK GDPR (EEA and UK individuals)

You have the right to access, rectify, erase or restrict the processing of your personal data, to object to processing, and to receive your data in a portable format. You may also lodge a complaint with your local supervisory authority.

11.2 CCPA and CPRA (California residents)

You have the right to know what personal information we collect and how it is used, the right to delete it, the right to correct inaccurate information, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as defined by the CCPA/CPRA, and we will not discriminate against you for exercising these rights.

11.3 India DPDP Act (Data Principals)

You have the right to access a summary of the personal data we process about you and our processing activities, the right to correction and erasure, the right to grievance redressal through our Grievance Officer (Section 16), and the right to nominate another individual to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of the above rights, contact privacy@densyti.com. We will verify your identity before fulfilling a request and will respond within the timeframe required by applicable law. If you are an end user of a Customer's account, we may direct your request to your organization as the controller of your Customer Content.

12. Cookies and browser storage

This website stores only your light or dark theme choice and, on the launch checklist, your ticks, and both stay in your own browser. The Densyti apps use essential cookies for sign-in and security. We do not use advertising or analytics cookies, or third-party tracking. You can clear this storage at any time in your browser settings, and the website works the same without it.

For the full list of what we store and why, see our cookies page.

13. Children's privacy

Densyti is a business product intended for use by organizations and their employees. It is not directed to, and we do not knowingly collect personal information from, individuals under the age of 16. If we become aware that we have collected personal data from a child by mistake, we will take steps to delete it.

14. Third-party links

Our website and Service may contain links to third-party websites or services we do not own or control. This Policy does not apply to those third parties, and we encourage you to review their privacy policies before giving them information.

15. Changes to this policy

We may update this Policy from time to time to reflect changes in our practices, technology or legal requirements, or for other operational reasons. We will post the updated Policy on this page with a revised date, and where changes are material, we will notify Customer account administrators by email before the change takes effect.

16. Contact us and Grievance Officer

Niohive Technology Services Pvt. Ltd., operating Densyti, is the entity responsible for the information described in this Policy.

• General privacy questions: privacy@densyti.com
• Grievance Officer (India Digital Personal Data Protection Act, 2023): grievance-officer@densyti.com. Our Grievance Officer will acknowledge and respond to complaints within the timeframe prescribed by applicable law.
• Postal address: available on request from the contacts above.