Swiftexa

Policy

Privacy policy

Last updated 1 November 2026

This policy explains how Sihrsalt Digital Solutions Private Limited, trading as Swiftexa (“we”), collects and uses personal data. It is written to meet the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

1. Data we collect and why

  • To provide your service and sign the agreement: legal and trade name, constitution, billing address and state, contact person's name, designation, mobile and email, and the tools you use.
  • To invoice you and meet tax law: GSTIN, PAN and, where you deduct TDS on our fees, TAN.
  • To log you in to the client portal: your email or mobile number, to send a one-time login code.
  • To support you: your tickets, messages, appointment requests and documents you upload.
  • Payments: transaction reference and amount. Card and bank details are handled by Razorpay, not by us.

We never ask for Aadhaar numbers, passwords, OTPs, card numbers or digital signatures. If you send us one by mistake, we delete it.

2. Your consent

We ask for your consent in the client portal before we use your data, with a separate box for each purpose. Only the service consent is needed to use Swiftexa. These are optional and can be withdrawn at any time, as easily as you gave them, from Settings → My consents or by writing to us:

  • AI help on your support tickets
  • Marketing messages by WhatsApp or email (reply STOP to opt out)
  • Publishing your name and results as a case study
  • Recording training and support calls

Withdrawing consent does not affect anything we did before you withdrew it. Withdrawing the service consent ends the service. Records the law requires us to keep, such as tax invoices, are kept for the periods in section 6 even if you withdraw consent.

3. AI processing

If you consent, our AI assistant (Claude, made by Anthropic) reads your tickets and messages to sort them and draft replies. A person reviews anything about money, refunds or complaints. We use Anthropic's business terms, under which your data is not used to train AI models. If you do not give this consent, a person handles your tickets.

4. Who we share data with

We share data only with service providers who work for us under contract: Cloudflare (website, portal and login), Amazon Web Services in Mumbai (storage of system logs in India), Anthropic (AI drafting, only with your consent), Google Workspace (email and files), Razorpay (payments) and Meta (WhatsApp messages). Some of them process data outside India, which the law allows except for countries the government restricts. We also share data with authorities where the law requires it. We do not sell personal data.

5. Your clients' customers' data

When we set up Claude in your accounts, your customers' data stays in your accounts. You are the Data Fiduciary and we act as your Data Processor: we use that data only on your instructions to deliver the service, limit access to staff working on your account, never use it to train AI, and delete our working copies within 30 days of handover or end of care. You are responsible for having a lawful basis and any consent needed for your customers' data.

6. How long we keep data

  • Invoices, payment and GST records: 72 months from the due date of the annual GST return for that year (CGST Act, section 36).
  • Books of account: 8 years (Companies Act, section 128).
  • Agreements and consent records: for the relationship plus 8 years.
  • Tickets, messages and appointment history: for the relationship plus 1 year.
  • System logs: at least 180 days, stored in India, as required by CERT-In.
  • Enquiries that did not become clients: 12 months from the last contact.

After these periods we delete or anonymise the data.

7. Security and breaches

We use access controls, one-time login codes, encryption in transit and audit logs. If a breach affects your data, we will tell you without delay, in plain language, what happened, what it may mean for you and what we have done, and report it to the Data Protection Board of India and CERT-In as the law requires.

8. Children

Our services are for businesses and people aged 18 or over. We do not knowingly collect data of anyone under 18.

9. Your rights

You can ask for a summary of your data, correct or update it, ask us to erase it, withdraw consent, and nominate someone to exercise these rights for you. Raise a request from the client portal or by email. We reply within 7 working days and resolve requests within 30 days. We refuse erasure only for records the law requires us to keep, and we tell you which records and until when.

10. Grievance Officer

Grievance Officer: Almaas Sayyed, [email protected]. Write with the subject “Data request”. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

11. Language

This policy and our data notice are available in Hindi and Marathi on request.

Contact

Sihrsalt Digital Solutions Private Limited (brand: Swiftexa), 503/341, Sector-3, Srishti Complex, Mira Road (East), Thane 401107, Maharashtra. Email [email protected] · Phone/WhatsApp +91 99201 90711.