Your data, handled with care

Metadologie India Private Limited is a Salesforce consulting firm and software vendor registered in India. We build tools and applications for business productivity, including apps on the Salesforce AppExchange and Zoho Marketplace.

This Privacy Policy applies to all users of our website (metadologie.com), our proprietary software platforms - MetaShip, M-Pay, M-Quote, DocsBag, and MetaTax - and our marketplace applications (collectively, the "Services").

We comply with the Digital Personal Data Protection Act 2023 (DPDP Act), the IT Act 2000 and SPDI Rules 2011, and - where applicable - the GDPR. At Metadologie, we are committed to protecting your privacy and ensuring transparency in how your personal information is collected, used, and safeguarded.

We only collect what we actually need (data minimisation). Here's what that looks like in practice:

Chat assistant: when you use our website chat assistant, we record the conversation along with technical metadata (including your IP address and browser user-agent) for support, quality, and security purposes. You can download a copy of your conversation at any time using “Request Transcript” in the chat menu.

We process your information to:

• Provide, operate, and maintain our products and services.
• Process transactions, generate shipping labels, payment links, quotes, and tax workflows.
• Automate business processes and improve operational efficiency.
• Enhance user experience and platform performance.
• Communicate updates, alerts, and support responses.
• Ensure security, prevent fraud, and comply with legal obligations.

We process your data on the following legal bases, mapped to specific purposes:

We will ask for fresh consent before using your data for any purpose not listed here.

• Service providers - e.g. Salesforce, Zoho, Google Cloud. All are bound by a Data Processing Agreement and may only use your data on our instructions.
• Payment gateways and financial institutions - for M-Pay transactions.
• Shipping carriers and logistics providers - for MetaShip operations.
• Cloud storage providers - for DocsBag (OneDrive, Google Drive, Dropbox, Box, SharePoint, AWS S3, Azure).
• Tax authorities or compliance systems - for MetaTax, where required by law.
• Technology and infrastructure partners - hosting, analytics, support.
• Professional advisors - lawyers and auditors, under strict confidentiality obligations.
• Authorities - only when required by law or court order. We will notify you where legally permitted.
• Business successors - if Metadologie is acquired or merges, you will be notified in advance and can exercise your rights before any transfer.

Yes. We use three categories of cookies:

• Strictly necessary - the site won't work without these. No consent needed.
• Analytics (Google Analytics / Zoho) - anonymised traffic data. You can decline these.
• Marketing - retargeting and campaign tracking. Only activated with your explicit consent.

You can change your cookie preferences at any time via the Cookie Consent Manager on our site, or through your browser settings.

We retain your data only for as long as necessary, with the following maximum retention periods:

When the retention period ends, data is cryptographically erased (digital) or cross-cut shredded (physical).

We implement enterprise-grade security controls to protect your data:

• AES-256 encryption at rest
• TLS 1.2 / 1.3 in transit
• Multi-factor authentication
• Role-based access control
• Annual penetration testing
• 72-hour patch SLA for critical CVEs
• Tamper-evident audit logs
• Endpoint encryption (EDR)

All staff with access to personal data receive mandatory annual security training. We conduct background checks for roles handling sensitive data.

Data breach response

Security vulnerability disclosure

Found a security vulnerability? Email support@metadologie.com with subject "Security Disclosure" - we respond within 48 hours.

While we strive to protect your data, no system is completely secure.

Our Services are intended for business use and are for users aged 18 and over. We do not knowingly collect data from minors.

If you believe a child's data has been shared with us, contact us immediately - we will delete it within 72 hours of verification.

You have the following rights regarding your personal data:

• Access - get a copy of the data we hold about you.
• Rectification - ask us to correct inaccurate data.
• Erasure - request deletion of your data.
• Restriction - ask us to pause processing while a dispute is resolved.
• Portability - receive your data in CSV or JSON format.
• Object - opt out of marketing or profiling at any time.
• No automated decisions - not to be subject to fully automated decisions that significantly affect you.
• Nominate - designate someone to act on your behalf (DPDP Act provision).
• Withdraw consent - at any time, where processing is based on consent.

Some browsers offer Do-Not-Track (DNT) features. Currently, our systems may not respond to DNT signals due to lack of industry-wide standardisation.

• We process information received via the Meta Graph API - Instagram User IDs, usernames, and message content - solely to facilitate customer support and communication within our Salesforce environment.
• This data is used to create and manage support cases and is not shared with unauthorised third parties.
• We may access limited data from your connected Meta accounts to enable features such as viewing Instagram messages directly within Facebook or connected systems. All access is strictly with your authorisation and in accordance with Meta's platform policies.
• We comply with all Meta Platform Terms and Developer Policies regarding the handling of user data.
• All data retrieved through Meta integrations is handled securely and retained only as necessary to provide the service.

Users can manage or revoke access to their Meta accounts at any time through their account settings.

U.S. residents (such as California users) may have rights under laws like CCPA, including:

• Right to know what data is collected.
• Right to request deletion.
• Right to opt out of certain data sharing.
• Right to non-discrimination for exercising privacy rights.

Users in regions such as the EEA, UK, and India may have additional rights under GDPR and the India DPDP Act, including:

• Right to access and correct personal data.
• Right to withdraw consent.
• Right to request erasure of data.
• Right to lodge a complaint with a supervisory authority (e.g., the Data Protection Board of India).

By providing your phone number, you consent to receive SMS notifications related to:

• Transactions and alerts.
• Service updates.
• Customer support.

You may opt out at any time by replying STOP or contacting support@metadologie.com.

If we make material changes to this policy, we will:

• Email registered users at least 15 days before the new policy takes effect.
• Display a notice on our website.

Continued use of our Services after the effective date constitutes acceptance of the updated policy.

Have a question or want to exercise a right? Reach us here:

You may request access, correction, or deletion of your personal data by emailing support@metadologie.com. We will respond in accordance with applicable laws and within the timelines specified in Section 17.