Privacy Policy

Last Updated: 22 May 2026

This Privacy Policy describes how T.M Enterprises ("we", "us", "our"), operating the PaddyAce platform accessible at paddyace.com, collects, uses, stores, and protects the information of users.

1. About Us

PaddyAce is a Software-as-a-Service (SaaS) platform designed for Indian rice mill owners to manage procurement, milling, government CMR/OSCSC operations, sales, expenses, parties, employees, banking, and compliance.

Operated by: T.M Enterprises (Proprietorship)
GSTIN: 21GDNPM7209B1ZR
Address: Plot No-2773, Khata No-994/833, Jeypur Malkangiri Road, Malkangiri, Odisha - 764045
Email: support@paddyace.com
Phone: +91 77355 43215

2. Information We Collect

2.1 Information You Provide

Account information: Name, email address, mobile number, password (hashed)
Business information: Mill name, business address, GSTIN, PAN, business type
Operational data: Procurement records, milling batches, sales invoices, purchase records, party ledgers, employee details, banking entries, government CMR/AC note records, stock movements
Payment information: Subscription billing details (processed via Razorpay; we do not store card or bank details on our servers)
Optional uploads: Bank statement CSVs (processed for reconciliation), supporting documents

2.2 Information Collected Automatically

Device and usage data: IP address, browser type, device type, operating system, access times, pages viewed
Cookies and local storage: For session management, authentication, and offline-first functionality
Activity logs: Actions performed within the Platform for audit and security purposes

2.3 Information from Third Parties

Authentication providers: If you sign in via Google, we receive your name, email, and profile photo
Payment processor: Razorpay shares transaction status with us but not raw card data

3. How We Use Your Information

Provide, maintain, and improve the PaddyAce Service
Process subscriptions, billing, and payment-related transactions via Razorpay
Authenticate users and prevent unauthorized access
Send transactional emails (subscription receipts, password resets, account alerts)
Send service notifications (subscription expiry, document expiry alerts, overdue payment reminders)
Respond to support queries via email, phone, or WhatsApp
Detect, prevent, and address fraud, abuse, or security incidents
Comply with legal obligations under Indian law
Generate aggregated, anonymized analytics to improve the Platform
Allow authorized platform personnel to access account-level information (name, contact details, subscription status, mill details, and usage activity) for customer support, troubleshooting, security monitoring, and platform administration

We do not sell, rent, or trade your personal or business data to third parties for marketing purposes.

4. Data Storage and Security

Hosting: PaddyAce is hosted on cloud infrastructure (Vercel and Supabase). Data is stored in regions compliant with applicable data protection norms.
Encryption: Data is encrypted in transit (HTTPS/TLS) and at rest.
Access controls: Row-level security (RLS) is enforced at the database level.
Authentication: Passwords are hashed using industry-standard algorithms. Optional PIN/biometric app lock available.
Backups: Regular automated backups are maintained for disaster recovery.

5. Data Sharing and Disclosure

Service providers: Hosting (Vercel, Supabase), payment (Razorpay), SMS (MSG91), email delivery, analytics.
Legal compliance: When required by Indian law, court order, or government authority.
Business transfer: In case of merger, acquisition, or sale of assets.
With your consent: When you explicitly authorize sharing (e.g., exporting data, sharing invoices via WhatsApp).

6. Data Retention

Active accounts: Data retained as long as your account remains active.
After cancellation: Data retained for 3 years from subscription expiry.
Permanent deletion: After the 3-year retention period.
Earlier deletion: Request via support@paddyace.com — honoured within 30 days.

7. Your Rights

Access: Request a copy of your personal data.
Correction: Update inaccurate information via account settings.
Export: Download your full mill data via the Backup feature (Excel or JSON).
Deletion: Request complete deletion of your account and all associated data by emailing support@paddyace.com. Deletion requests are honoured within 30 days, subject to legal retention obligations.
Withdraw consent: May limit your ability to use the Service.
Grievance: Raise a complaint with our Grievance Officer (see Section 12).

8. Cookies, Tracking, and Analytics

PaddyAce uses cookies and browser local storage for session authentication, user preferences, and offline functionality. We do not use third-party advertising cookies or cross-site tracking.

We use Vercel Analytics and Speed Insights to collect anonymized, aggregated usage data (page views, performance metrics). This data cannot identify individual users and is used solely to improve service performance. You may opt out of analytics tracking via the cookie preferences available in the application.

9. Children's Privacy

PaddyAce is intended for business use by adults. We do not knowingly collect personal information from minors under 18.

10. Third-Party Services

PaddyAce integrates with Razorpay (billing), Google (authentication), Supabase (backend), Vercel (hosting), MSG91 (SMS OTP), and WhatsApp (sharing). Their respective privacy policies apply.

11. Updates to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notice.

12. Grievance Officer

Name: Tanmay (Proprietor, T.M Enterprises)
Email: support@paddyace.com
Phone: +91 77355 43215
Address: Plot No-2773, Khata No-994/833, Jeypur Malkangiri Road, Malkangiri, Odisha - 764045

We will respond to grievances within 30 days of receipt.

13. Governing Law

This Privacy Policy is governed by the laws of India. Disputes shall be subject to the exclusive jurisdiction of courts in Malkangiri, Odisha.

For questions, contact support@paddyace.com.