OPSENO
Legal centre

Privacy Notice

Standalone notice under the Digital Personal Data Protection Act, 2023 — how Opseno processes personal data

Last updated: September 6, 2026

1. Introduction

TorpedoWeb LLC, a Delaware limited liability company ("Opseno", "Opseno", "we", "us"), provides this Privacy Notice so you can give informed consent or understand processing under certain legitimate uses where the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") apply.

Opseno is a cloud business platform operated by TorpedoWeb LLC. Registered office: 8 The Green, Suite B, Dover, Delaware, USA 19901. Company site: https://torpedoweb.org.

This Notice is a standalone document. It is not a clause of our Terms of Service. Where Terms refer to this Notice, they do not replace it.

Notice version: 2026-09-06.3. Product focus for this Notice: India DPDP. Contract governing law is the State of Delaware, United States. This Notice does not constitute legal advice.

2. Data roles

Opseno is generally a Data Fiduciary for account, billing, platform security, and Service-operations personal data for which we decide purposes and means.

For Customer Data you enter about your guests, customers, employees, and suppliers, you are typically the Data Fiduciary and Opseno is a Data Processor, processing that data on your instructions to provide the Service.

You must give appropriate notices and obtain consent or rely on a lawful legitimate use before uploading others’ personal data into Opseno.

3. Personal data we process (itemised)

We process the following classes of personal data (field names reflect our application schema). Exact fields present depend on modules you enable.

3.1 Account and workspace staff

  • users: email, password_hash, email_verified_at.
  • profiles: full_name, role, preferred_language, workspace_id, status.
  • sessions / auth_tokens: user linkage, token hashes, expiry (not the raw cookie value in logs).
  • workspace_invites: invitee email, role, token hash.
  • workspaces (business contact): name, phone, email, address, gst_number, billing/plan fields.

3.2 Retail / CRM parties and leads

  • parties: name, phone, email, address.
  • crm_leads / crm_contacts: contact_name or full_name, phone, email, title, notes.
  • crm_accounts: name, gstin, notes.
  • crm_loyalty_accounts and campaign/segment memberships linked to guests or parties.

3.3 Hospitality guests and stays

  • guests: first_name, last_name, phone, email, address, nationality.
  • guests identity documents: id_type, id_number, passport_number, passport_expiry, visa_number, visa_expiry, FRRO/C-form related fields.
  • reservations: guest linkage, adults, children (count), notes, channel references.
  • folios / folio_payments and related stay billing identifiers.
  • dining_orders.delivery_phone; table_reservations.guest_phone.

3.4 Payroll and HR (Customer Data)

  • payroll_employees: full_name, email, phone, department, designation, bank_account, bank_ifsc, pan_masked, gender, salary components.
  • payroll runs/lines, advances, leave; hr_attendance_records punch times; hr_documents file metadata and stored files (e.g. ID proofs).

3.5 Technical, support, and optional AI

  • workspace_audit_logs / admin_audit_logs: actor_email, ip_address, action metadata, before/after JSON that may include personal data.
  • support_tickets: contact_email and message content.
  • Device/browser signals used for session security; essential cookies for login.
  • When AI modules are enabled: prompts and tool context in ai_messages / ai_query_logs that may include personal data you enter.
  • Client offline queue / local caches may temporarily hold mutation payloads including party or guest fields on the device.

4. Purposes (tied to goods and services)

Opseno provides multi-tenant POS, hospitality PMS, F&B, CRM, payroll/HR, and optional AI tooling. Processing supports these concrete purposes:

  • Account registration, authentication, role-based access, and workspace administration.
  • Delivering the subscribed Service modules (billing, inventory, reservations, folios, CRM, payroll/HR, APIs).
  • Subscription billing, trial management, and tax invoice records for the Service.
  • Security monitoring, abuse prevention, incident investigation, and tenant isolation.
  • Customer support and Service notices (outages, security alerts, material product changes).
  • Optional product updates / marketing emails — only with consent (Section 5).
  • Optional AI assistance — only when you enable AI features and related consent/settings apply.
  • Complying with applicable law (including responding to lawful requests) and enforcing Terms.

7. Sharing and recipients

We do not sell personal data. We share data only with:

  • Data Processors / subprocessors that host or support the Service (Section 8), under contract.
  • Parties you instruct us to send data to (e.g. WhatsApp, payment gateways you connect, exports you run).
  • Authorities when required by law.
  • Successor entities in a merger or acquisition, subject to continued protection consistent with this Notice.

8. Subprocessors and infrastructure

Representative categories and providers (enabled providers depend on your deployment configuration):

  • Application hosting / CDN: Vercel.
  • Database: PostgreSQL (Neon Marketplace and/or self-managed / VPS — region depends on deployment; confirm with Opseno for your environment).
  • Transactional email: Resend (when configured).
  • Payments: Razorpay (when configured); card data is handled by the payment provider.
  • Error monitoring: Sentry (when configured).
  • AI model providers (OpenAI / Anthropic or similar) only when AI modules are enabled.
  • Public inventory (engineering source of truth): /legal/subprocessors.
  • Signed data-processing terms with each processor are maintained by Legal; contact privacy@opseno.com.

9. Cross-border transfers and residency

Under DPDP Act Section 16, personal data may be transferred outside India except to countries or territories restricted by the Central Government (negative-list model). The Act does not impose a blanket rule that all Indian personal data must remain only on servers in India. We do not treat EU-style adequacy decisions or Standard Contractual Clauses as the legal basis for transfer under the DPDP Act.

Opseno’s intended primary database residency for production Customer Data is India (intended primary database region, e.g. Noida / India cloud region when production is so configured). Application hosting, CDN, email, monitoring, and optional AI providers may still process limited personal data outside India as listed in our subprocessors inventory.

Hosting in India supports latency, customer preference, and operational control; it does not by itself replace notice, consent, security, rights, or other DPDP duties.

Some subprocessors may process data outside India. We will not transfer to a restricted country if and when such a list is notified. Certain categories of data may later be required to be stored in India by notification; we will update this Notice and our architecture accordingly.

Enterprise customers may discuss stricter residency options under a separate agreement.

10. Retention and erasure

We retain personal data only for the purposes stated above, then erase or anonymise it, subject to law. Indicative schedule (engineering implements jobs progressively; statutory holds win):

  • Account / workspace operational data: while the workspace is active; after closure, target erasure or anonymisation within 90 days unless a legal hold or tax obligation applies.
  • Security-relevant access and mutation logs (workspace_audit_logs and equivalent): at least 1 year (DPDP Rules Rule 6), then purge unless legal hold.
  • Billing / tax invoices for the Service: as required under Indian tax and commercial law (often several years — confirm with counsel for your entity).
  • Consent and withdrawal records: retained to demonstrate compliance (typically at least as long as related processing evidence is required).
  • Backups: limited rolling window, then expire.
  • Where Rules require advance notice before erasure for specified classes, we will provide at least 48 hours’ notice through available contact channels.

11. Cookies and similar technologies

Essential cookies support authentication, session management, and security. Non-essential analytics cookies, if used on marketing pages, require consent where the DPDP Act requires it. Disabling essential cookies may prevent login.

12. Security measures

We apply reasonable security safeguards described on our Security page, including encryption in transit, access controls, tenant isolation, field encryption for selected high-risk fields (e.g. payroll bank details; guest identity numbers as rolled out), monitoring, and backups. No method of transmission or storage is 100% secure.

13. Your rights (Data Principal)

Under the DPDP Act you may have rights to: access a summary of personal data and processing; correction, completion, updating, and erasure; withdraw consent; grievance redressal; and nominate another individual in the event of death or incapacity (as provided in the Act).

This Notice does not invent rights the Act does not grant (for example, we do not promise a GDPR-style data-portability right or a standalone right to object to automated decision-making).

Request route: signed-in Privacy controls at /settings/privacy#consent, or email privacy@opseno.com. We may verify identity. If we process your data only as a processor for a Customer, contact that Customer first; we will assist them.

14. Children (under 18)

Under the DPDP Act a child is an individual under 18 years of age. The Service is for business users aged 18+. We do not knowingly create platform accounts for children.

Hotels and other Customers who record guest stays that involve children must not process a child’s personal data in Opseno without verifiable parental or guardian consent (or another lawful basis under the Act), and must not use the Service for tracking or targeted advertising directed at children. See product guidance for minor-guest ID handling.

15. Personal data breach

If a personal data breach occurs, we will intimate affected Data Principals and the Data Protection Board of India as required under the DPDP Act and Rules (including the Rule 7 timeline for Board reporting). Our internal runbook is maintained by Security.

16. Changes to this Notice

We may update this Notice when purposes, data classes, or processors change. Material changes will be communicated by email, in-app notice, and/or a new notice version. New purposes that require consent will seek fresh consent.

17. Grievance Officer, queries, and the Board

Grievance Officer: Ubaid Ur Rahman Siddiqui, Grievance Officer.

Email: privacy@opseno.com. Phone: +91-9889301201. Postal: 8 The Green, Suite B, Dover, Delaware, USA 19901.

Support: support@opseno.com. Company: hello@opseno.com.

We aim to acknowledge grievances within 72 hours and resolve them within the period prescribed under the DPDP Rules (confirm exact Rule 14 timeline with counsel against the Gazette).

You may also make a complaint to the Data Protection Board of India under the DPDP Act. Use the Board’s published online mechanism when available; until then, write to privacy@opseno.com and we will provide the current Board filing instructions we have. Board complaint reference page: /privacy#grievance.