Privacy Policy
What personal data OctaPages collects, why, who sees it, how long we keep it, and your rights under India's Digital Personal Data Protection Act, 2023 and, where it applies, the EU and UK GDPR.
Last updated: 30 September 2026
1. Who we are
Minivet System LLP, which operates OctaPages, is the Data Fiduciary for the personal data described here. Our registered address is Unit No. 12ES4, 12th Floor, East Tower Mani Casadona IT Building, Plot #2 F/4, AA II, F Newtown, Chakpachuria West Bengal 700156, India. Contact us at [email protected].
2. What we collect
We collect only what the service needs:
- Account details: your name, email address, phone number, a hashed password (never the password itself), and an optional profile photo.
- Business details you choose to publish: the listing's name, address, phone, hours, services, prices and photos. These are public by design.
- Reviews you write, shown publicly with your first name, the initial of your last name, and your profile photo if you added one.
- Enquiries you send to a business: your name, the contact details you enter and your message.
- Security records: the devices you sign in from, with their IP address and browser, so you can see and end your sessions.
- Visit counts for listings. We count views and taps on a listing, with no IP address, cookie or identifier of the visitor.
- Where you came from when you send an enquiry: the page on OctaPages, or the name of the website that linked you (for example "google.com"), never the full address or anything about you. Until then, the previous page is kept only in your browser tab.
- Error reports: when a page fails, the kind of page and the error message, with email addresses, phone numbers and passwords removed.
- Billing details, if your business buys a plugin: the billing name, address, state and optional GSTIN for the tax invoice. Payments are handled by Razorpay; we receive only the payment reference and status, never your card number, UPI PIN or bank details.
3. Data inside business workspaces
When a business uses a plugin such as the WhatsApp CRM, the contacts, conversations and files it keeps in its workspace are its own records. For that data the business is the Data Fiduciary and we are its Data Processor: we store and process it only to provide the service, on the business's instructions and under our Data Processing Addendum. If you are a customer of such a business, ask the business first about your data; we will help it answer you.
Each business's workspace data lives in a separate database that no other business can reach, and backups of it are encrypted with a key unique to that backup.
4. Photos
Photos are re-encoded when you upload them, and all hidden data (including the GPS location phones add) is removed. Profile photos are cropped to a square automatically.
5. Why we use it
To run the directory and your account, to deliver your enquiries and notify businesses, to show reviews, to keep the service secure and prevent abuse, to meet legal obligations, and to answer you. We rely on your consent, given when you create an account, and on the legitimate uses the DPDP Act allows. We don't sell your personal data and we don't use it for advertising.
7. Where it is stored
Our servers are in Hetzner's data centre in Nuremberg, Germany (European Union); files and backups are stored with Cloudflare R2. The DPDP Act permits transferring personal data outside India except to countries the Government restricts, and we only use providers bound by contract to protect it.
8. How long we keep it
- Account data: until you delete your account. We then remove your name, email, phone and photo; your reviews stay, shown as written by a deleted user.
- Enquiries: kept with the business you sent them to.
- Listing visit counts: 90 days.
- Rejected photos: deleted 7 days after the decision.
- Security and audit records: as long as needed to protect the service and meet legal duties.
- Error reports: 90 days after the error was last seen.
- A business's workspace data: for as long as the business keeps its workspace. When a workspace is deleted, its encrypted backup is kept for 30 days (1 month) so the business can ask for it back, then deleted permanently with the workspace's files.
- Invoices and payment records: as long as Indian tax law requires (at least 72 months).
9. Your rights
Under the DPDP Act you can: get a copy of your data (Settings → Privacy → Download my data); correct it (Settings → Profile); erase it (Settings → Privacy → Delete my account); withdraw consent, which works the same way as deleting your account; nominate someone to exercise your rights if you die or cannot act; and complain to us, then to the Data Protection Board of India.
Our Data Rights page (https://octapages.com/data-rights) explains each right and has a form for anything the settings don't cover. We reply within 30 days, and resolve grievances within 15 days.
Write to [email protected] or our Grievance Officer (https://octapages.com/grievance) for anything else.
10. Children
OctaPages is not meant for children. We don't knowingly collect data from anyone under 18 without a parent's or guardian's verifiable consent.
11. Security
Data travels encrypted (HTTPS). Passwords are stored as one-way hashes (argon2id). Each business's workspace has its own database, and backups are encrypted. Two-step verification is available for every account, and every staff decision is logged. If a breach affects your data, we'll tell you and the Data Protection Board of India without delay, as the DPDP Rules require.
13. If you are in the European Union or the United Kingdom
The EU and UK GDPR apply to personal data of people there. We process it to perform our contract with you (your account, your enquiries, your plugins), for our legitimate interests (keeping the service secure and preventing abuse), to meet legal obligations (tax records), and with your consent where we ask for it.
You have the rights of access, rectification, erasure, restriction, data portability and objection, and you may withdraw consent at any time. Use the settings or the Data Rights page, or write to us. You may also complain to your local data protection authority.
Your data is processed in the European Union (Germany) and by providers who may process it elsewhere under the EU Standard Contractual Clauses or an adequacy decision.
14. Changes
We'll post changes here with a new date, and email account holders about important changes.