Privacy policy
Version 2026-10-25 · Effective 25 October 2026 · What changed ·
This policy explains what personal data Drasken Labs Private Limited collects when you use Drasken Cloud, our website and our documentation. It says why we use it, who we share it with, how long we keep it, and the rights you have.
On this page
The short version
This summary helps you find your way. The sections below give the detail.
- We collect what we need to run your account, bill you, support you and keep the service safe.
- Personal data inside your apps, databases, volumes and backups is yours. We handle it only for you, under our data processing addendum.
- We do not sell personal data, and we do not use it for advertising.
- Google Analytics runs only if you allow it: on our website and documentation today, and in the console once we switch it on there.
- Apps and databases run in Mumbai, India. Some providers we use, such as Cloudflare and Google, may store or process data outside India.
- Indian law makes us keep some records after you leave: up to 5 years for account records and 8 years for invoices.
- You can see, download, correct and erase your data, withdraw consent, nominate someone, and complain to us or to the Data Protection Board of India.
1. About this policy
In short
We decide how your account data is used, so this policy covers it. Data you put in your apps and databases is yours; we handle it for you.
1.1 Who we are
Drasken Cloud is run by Drasken Labs Private Limited (CIN U62091DL2025PTC453940), registered office 416, Block C (Old No. C-196), Gali No. 7, Om Nagar, Badarpur, South Delhi, Delhi 110044, India. In this policy, "we", "us" and "our" mean Drasken Labs Private Limited.
1.2 What this policy covers
For the personal data in this policy, we decide why and how it is used. Under the Digital Personal Data Protection Act, 2023, we are its Data Fiduciary. It covers:
- your account: the details of everyone who signs in to the console;
- members and invitations in your organisation;
- billing and payment details;
- support requests and the emails you send us;
- records of how the service is used and kept safe, such as sign-ins and logs;
- visitors to our website (draskencloud.com) and documentation (docs.draskencloud.com).
1.3 What it does not cover: your content
When your apps, jobs, databases, volumes, backups or logs hold personal data about other people, such as your own customers, you decide why and how it is used. You are its Data Fiduciary, and we are your Data Processor. We use that data only to run the service for you, under our terms of service and data processing addendum.
You are responsible for telling those people what you do with their data and for answering their requests. If one of them writes to us, we pass the request to you and tell them we have done so.
1.4 How this policy relates to the terms
This policy is information for you. It is not a contract you agree to, and it does not take away any right you have under the law. Our terms of service are the agreement for using Drasken Cloud.
1.5 Words we use
Words such as organisation, owner, billing contacts, your content and console mean what section 1.8 of the terms says. Personal data means information about a person who can be identified from it. "You" means the person the data is about.
1.6 Language
This policy is written in English. If you would like it in another language listed in the Eighth Schedule to the Constitution of India, write to privacy@draskencloud.com.
2. What we collect
In short
What you give us, what the service records as you use it, and a little from our payment partner. We never see your full card number.
2.1 What you give us
| What | Details | When |
|---|---|---|
| Account | Your name, email address and password. We keep the password only as a one-way hash | Sign-up |
| Acceptance of the terms | That you are 18 or older and accepted the terms of service and acceptable-use policy, which version, and when | Sign-up, invitation, each new version |
| Two-step sign-in | The secret for your authenticator app, kept encrypted, and your recovery codes, kept as hashes | If you turn it on |
| Preferences | Theme, and whether we email you about sign-ins from a new device | When you change them |
| Organisation | Organisation and project names, members and their roles | As you use the console |
| Invitations | The name and email address of the person you invite | When you invite someone |
| Billing details | Business or individual; legal name; postal address and state; GSTIN and PAN where you give them; purchase order reference; extra invoice email addresses; a mobile number | When an owner or Billing member enters them |
| Payment methods | Our payment partner Razorpay collects them. We keep only a short label (for example your UPI ID, or the last four digits of a card or bank account), its limit and status | When you add one |
| Support | What you write in a support request or email, files you attach, and the rating you give | When you contact support |
| Monitors and alerts | Addresses you ask Drasken Uptime to check, and the email addresses alerts are sent to | When you set them up |
| Website enquiries | Your name, email address and what you tell us about your needs | If you use our contact form |
Some details are required to provide the service: name, email address and password for an account, and billing details and a payment method before you create paid resources. Others are optional. If you do not give us required details, we cannot provide that part of the service.
2.2 What we record as you use Drasken Cloud
| What | Details |
|---|---|
| Sign-up record | The network (IP) address and time you signed up |
| Sessions | For each sign-in: the network address, the browser and device, and when it was used and ended |
| Sign-in attempts | The email address tried, the network address, the browser, the time, and whether it worked |
| Acceptance log | Each acceptance of the terms, with its network address and browser |
| Activity history | What members do in an organisation (for example "created a database"), with their name |
| Staff actions | What our staff change in an account or organisation, with the staff member and their network address |
| How you found us | If you arrive from a campaign link or another website: the campaign labels, the other website's name, the first page you opened and your country. We store this with your account when you sign up |
| Usage | What resources ran, their size and for how long, so we can bill you |
| Emails | Which account, billing and alert emails we sent you, and whether they were delivered |
| Logs | Requests to the console and our services: network address, browser, page or address requested and the time. We remove the query part of an address, where email confirmation, password reset and invitation links carry their codes, before we store our access logs |
2.3 What we receive from others
- Razorpay, our payment partner: whether a payment or mandate worked, its reference and a masked label of the method. We never receive or store your full card number.
- Cloudflare, which carries traffic to our sites: the country a request comes from.
- Google Analytics, only if you allow it: reports on how pages are used, which do not name you.
- Members of your organisation who invite you or enter billing details that name you.
2.4 Sensitive information
Under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, passwords and payment details are sensitive personal data. We handle passwords as section 8 describes. Full card and bank details stay with Razorpay; we keep only the masked label in 2.1. We do not ask for health, biometric or other sensitive information. Please do not send it to support.
3. How we use it
In short
To run your account, bill you, support you, keep Drasken Cloud safe and meet the law. We ask your consent for analytics. We do not sell your data.
3.1 What we use it for
| Purpose | What we use | Why we may |
|---|---|---|
| Create and run your account, sign you in, keep sessions | Account, sessions, two-step sign-in | You give it to us to use the service |
| Run your organisation: members, roles, invitations, activity history | Account, organisation, invitations, activity | You give it to us to use the service |
| Bill you: work out charges, issue GST invoices, take payments, collect what is owed | Billing details, usage, payment records | You give it to us to use the service; GST and company law |
| Answer support requests | Support, account, the resources you ask about | You give it to us to get help |
| Send account, security, billing and alert emails | Email address, name | You give it to us to use the service |
| Keep the service and your account safe: lock repeated failed sign-ins, warn you of new devices, detect abuse and fraud | Sessions, sign-in attempts, logs, staff actions | You give it to us to use the service; IT Act and CERT-In duties |
| Keep the records Indian law asks for (section 7) | Sign-up record, acceptance log, invoices, logs | Legal obligation |
| Answer courts, government agencies and CERT-In | What a lawful order asks for | Legal obligation |
| Understand which campaigns bring sign-ups | How you found us | Recorded when you sign up, as this policy says. Ask us and we erase it |
| See how our website and documentation are used | Google Analytics reports | Your consent |
| Reply to website enquiries | Contact form details | You give it to us to hear back |
3.2 Why we may use it
The Digital Personal Data Protection Act, 2023 lets us use personal data with your consent, or for certain legitimate uses listed in section 7. We rely on:
- Data you give us for a purpose you know. You give us your account, billing and support details to use Drasken Cloud. Section 7(a) lets us use them for that purpose, as this policy describes.
- Legal obligations. Some records must be made and kept by law, for example GST invoices and the records the CERT-In Directions of 28 April 2022 ask for.
- Consent. For website and documentation analytics, we ask first. You can withdraw consent at any time, as easily as you gave it (section 4).
The 2011 Rules ask for your consent before we collect a password or payment details. You give it when you set a password, and when you add a payment method yourself. This is separate from accepting the terms. You can withdraw it by closing your account or removing the payment method. We then cannot provide that part of the service.
3.3 What we do not do
- We do not sell or rent personal data.
- We do not use personal data for advertising, or share it with advertisers.
- We do not send marketing emails today. If we start, we will ask you first and every email will let you stop.
- We do not look at your content to learn about you. Our terms say when staff may look at your content.
3.4 Decisions made automatically
Some things happen automatically: a sign-in is locked for a while after repeated failures, and an organisation with an overdue invoice is limited and then suspended on the timings in our billing documentation. A person reviews a suspension if you ask, and before an agreement is ended.
3.5 Account emails
Account, security, billing and alert emails are part of the service. You can turn off emails about sign-ins from a new device, and choose who receives alerts. You cannot turn off emails we must send, such as invoices, payment notices and legal notices.
4. Cookies and analytics
In short
The console uses cookies to keep you signed in. Google Analytics runs only if you allow it.
4.1 The console
The console sets two cookies to keep you signed in: one lasts 15 minutes and is renewed while you work, the other lasts up to 30 days. Page scripts cannot read them, and they are sent only over HTTPS. The console also keeps a few settings in your browser, such as your theme, last organisation and project, and an unsent support draft.
The console does not send analytics today. When we switch it on, it asks first, as our website does, and nothing goes to Google until you select Allow analytics. You can change your answer at any time under Profile → Your data → Usage analytics. It never sees your apps, databases, names or passwords.
4.2 Our website and documentation
Our website and documentation ask before they load Google Analytics. Nothing from Google loads until you select Allow analytics. Your answer is kept in your browser. You can change it at any time from Analytics settings at the foot of each website page, or Cookie settings in our documentation. Turning it off stops sending at once and deletes Google's cookies.
If you allow it, Google Analytics sets cookies named _ga and _ga_… and tells us which pages are used. It does not receive your name, email address or what you write to us. We turn off Google's advertising features.
Our cookie policy lists every cookie and how long it lasts.
5. Who we share it with
In short
With the providers who help us run Drasken Cloud, with the people in your organisation, and with authorities when the law requires. Never for sale.
5.1 Providers who process data for us
We use other companies to run parts of Drasken Cloud. They handle personal data only on our instructions and for the purpose we give them. They include:
| Provider | What they do | Personal data they handle |
|---|---|---|
| OVHcloud | The servers in Mumbai that run the console, our databases and your apps | Everything in section 2 that we store |
| Cloudflare | Carries traffic to our sites; hosts the console and documentation; receives emails sent to support; stores backups, logs and support attachments | Network addresses, browser details, logs, support emails and files |
| Amazon Web Services | Sends our emails from Mumbai; runs Drasken Uptime's checks in Mumbai; keeps copies of our own databases | Email addresses and email contents; monitor addresses; our database copies |
| Razorpay | Takes payments and runs payment mandates in India | Name, email address, mobile number, payment details |
| Google Analytics on our website and documentation, and later the console, if you allow it | Pages viewed, device and approximate location | |
| Let's Encrypt | Issues certificates for domains | Domain names only |
The full, current list, with where each provider works, is on our sub-processors page. We update that page before we add a provider.
5.2 People in your organisation
Members of an organisation see each other's names, email addresses and roles, and the activity history of the organisation. Owners and Billing members see the billing details, invoices and payment methods. Support requests are visible to the members allowed to see them in the console.
5.3 Authorities
We give personal data to courts, government agencies, CERT-In and the Data Protection Board of India when the law requires it, as section 4.10 of the terms describes. We check that a request is lawful and give only what it requires.
5.4 Others
- Our professional advisers, such as auditors, chartered accountants and lawyers, under a duty of confidentiality.
- A buyer or successor, if all or part of our business is sold or reorganised. They must keep using personal data as this policy says, and we tell you before that happens.
- Anyone else you ask us to, for example when you ask us to send an invoice to your accountant.
6. Where it is stored
In short
The console and your apps and databases run in Mumbai, India. Some providers store or process data outside India.
6.1 Where
The console's data, the billing records and your apps and databases are held on servers in Mumbai, India. Other data is held by the providers in section 5:
- backups, logs and support attachments are stored with Cloudflare, which may keep them outside India;
- Cloudflare's network, which carries traffic to our sites, works around the world;
- Google Analytics data, if you allow it, is processed by Google outside India;
- emails are sent, and Drasken Uptime runs, from Amazon Web Services in Mumbai;
- copies of our own databases are kept with Amazon Web Services.
The sub-processors page says where each provider works.
6.2 Transfers outside India
The Digital Personal Data Protection Act, 2023 allows personal data to go outside India, except to countries the Government of India restricts. We will not send personal data to a restricted country. Where a provider handles data outside India, it does so under its contract with us.
7. How long we keep it
In short
As long as your account is open, and after that only what the law makes us keep, for as long as it makes us keep it.
7.1 Periods
| Data | How long | Why |
|---|---|---|
| Account details (name, email address, password, two-step sign-in) | While your account is open | To run your account |
| Sign-up record: name, email address, organisations, the network address and time of sign-up, network addresses used, last sign-in | 5 years after your account is closed | CERT-In Directions, 2022 |
| Acceptance log of the terms | 8 years after each acceptance | Proof of what was agreed |
| Sessions and sign-in attempts | 1 year | Security, and the minimum the law asks for logs |
| Organisation activity history and staff action records | 3 years after the event | Security, investigations and disputes |
| Billing details, invoices, credit and debit notes, payments and the accounts | 8 years | GST law and company law |
| Usage detail | 18 months in our billing system, then archived and deleted with the invoices after 8 years | Working out and checking charges |
| Support requests, messages and attachments | 3 years after the request is solved | Help with follow-up questions and disputes |
| Emails you send to our support reply address, as received | 90 days | Checking where an email came from |
| Alert history | Resolved alerts 90 days; records of alert emails sent 30 days | Showing you recent alerts |
| Drasken Uptime check results | 30 days on the free plan | Showing you uptime history |
| Logs of our own services | 14 days today. We are moving these to at least 180 days, kept in India, as CERT-In asks | Security and investigating incidents |
| Copies of our own databases | 14 days | Recovering from a failure |
| How you found us | While your account is open | Understanding which campaigns work |
| Website and documentation analytics | 14 months in Google Analytics | Seeing how pages are used |
| Your cookie and analytics choice | In your browser, until you clear it | Remembering your answer |
| Website enquiries | 2 years after your last message | Following up your enquiry |
Where a court or authority asks us to keep something for longer, or we need it for a legal claim, we keep it until that is over.
7.2 When you close your account
When you close your account, we remove your name, email address, password, two-step sign-in and memberships from it, and you are signed out everywhere. The account's identifier stays, so that history which names it, such as invoices and activity, still makes sense; it then shows as "Deleted user". We first write the 5-year sign-up record above. Other records are kept for the periods in 7.1 and then deleted.
Closing your account does not close your organisations. Their data, including billing records, belongs to the organisation and follows section 8.7 of the terms when its agreement ends.
7.3 Copies in backups
Deleted data can stay in copies of our own databases for up to 14 days, until those copies expire. We do not restore it from them except to recover from a failure.
8. How we protect it
In short
We take reasonable steps to protect personal data. No system is perfectly secure, and we tell you if a breach affects you.
8.1 What we do
- Traffic to the console, our website and our documentation is encrypted with HTTPS.
- Passwords are stored only as a one-way hash. Two-step sign-in secrets are encrypted. Email confirmation, password reset and invitation links, and recovery codes, are stored only as hashes.
- Sign-in cookies cannot be read by page scripts.
- Repeated failed sign-ins lock the account for a while, and you can turn on two-step sign-in.
- Payment details stay with Razorpay; we never store your full card number.
- Only staff who need it can reach personal data, and changes staff make to accounts are recorded.
- We remove the query part of an address, where those links carry their codes, before we store our access logs.
We do not claim any security or data-protection certification. We review these measures as Drasken Cloud grows.
8.2 What you can do
Use a strong password that you do not use anywhere else, turn on two-step sign-in, and remove members who no longer need access. Tell us at once at support@draskencloud.com if you think your account has been misused.
8.3 If there is a breach
If a breach affects your personal data, we tell you without undue delay: what happened, what it may mean for you, what we are doing and what you can do. We report personal data breaches to the Data Protection Board of India, and cyber security incidents to CERT-In, within the times the law sets.
9. Your rights
In short
You can see, download, correct and erase your data, nominate someone, withdraw consent and complain. Ask us first; we reply within 30 days.
9.1 Your rights
Under the Digital Personal Data Protection Act, 2023 you can:
- See your data. Ask for a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
- Correct and update it. Ask us to correct data that is wrong, complete what is missing, or update it.
- Erase it. Ask us to erase data we no longer need. We keep what the law makes us keep (section 7) and tell you what that is.
- Withdraw consent. Where we rely on your consent, withdraw it at any time. This does not affect what we did before.
- Have your complaint heard. Complain to us, and then to the Data Protection Board of India.
- Nominate someone. Name a person who can use these rights for you if you die or become unable to act.
9.2 What you can do yourself in the console
| To | Where |
|---|---|
| Download your account data | Profile → Your data → Download my data: your profile, organisations, sessions and sign-ins, as a file |
| Correct your name or email address | Profile |
| Correct billing details | Billing → Billing details (owners and Billing members) |
| See your sessions and sign-ins, and sign out devices | Security |
| Close your account | Profile → Close account |
| Change your analytics choice | Analytics settings at the foot of our website, Cookie settings in our documentation, and Profile → Your data → Usage analytics in the console once analytics is on there |
Our documentation explains each step. The download covers your account. For anything else, such as your support requests or the acceptance log, write to us.
9.3 How to ask us
Write to privacy@draskencloud.com from the email address on your account, or through Support in the console. Say which right you want to use. If you write from another address, or for someone else, we may ask you to prove who you are, or that you may act for them.
We reply within 30 days. If we cannot do what you ask, we tell you why, for example because the law makes us keep the data. Using your rights is free.
9.4 Nominating someone
To nominate a person, write to us as 9.3 says, with their name and email address. We record the nomination and confirm it to you. You can change or cancel it the same way.
9.5 Personal data in our customers' apps
If your data is in an app or database a Drasken Cloud customer runs, that customer decides how it is used. Please ask them. If you write to us, we pass your request to them (1.3).
9.6 Your duties
The law asks you to give us true information, not to impersonate anyone, and not to make false or frivolous complaints.
10. Children
In short
Drasken Cloud is for people aged 18 or older.
You must be 18 or older to create an account or join an organisation. We do not knowingly collect personal data about children. If we learn that an account belongs to someone under 18, we close it and delete their personal data, except what the law makes us keep. If you think a child has given us personal data, write to us at privacy@draskencloud.com.
11. Changes to this policy
In short
We tell you by email at least 30 days before a change that reduces your rights or uses your data in a new way.
Each version of this policy has a date at the top, and every earlier version stays readable from What changed.
Some changes reduce your rights or use your personal data for a new purpose. For those, we email account holders and show a notice in the console at least 30 days before the change takes effect. Where a new purpose needs your consent, we ask for it. We may make other changes, such as corrections or clearer wording, when we publish them.
12. Contact and Grievance Officer
In short
Write to our Grievance Officer about personal data. We acknowledge within 24 hours and resolve within 15 days.
12.1 Grievance Officer
Our Grievance Officer answers questions and complaints about personal data, and about how we handle it.
| Name | Suraj Kumar Aggarwal |
| Designation | CEO & Founder |
| privacy@draskencloud.com | |
| Other complaints | grievance@draskencloud.com |
| Post | Drasken Labs Private Limited, 416, Block C (Old No. C-196), Gali No. 7, Om Nagar, Badarpur, South Delhi, Delhi 110044, India |
The same officer handles complaints under our terms; their details are also on our grievance page.
12.2 Timelines
We acknowledge a complaint within 24 hours and resolve it within 15 days. Requests to use your rights are answered as 9.3 says.
12.3 Data Protection Board of India
If you are not satisfied with how we handled your complaint, you may complain to the Data Protection Board of India. The law asks you to use our grievance process first. The Board works online; its website explains how to file a complaint.
What changed
| Version | Effective | What changed |
|---|---|---|
| 2026-10-25 | 25 October 2026 | First published version. |