Privacy Policy

1. Introduction

Aatrex ("we," "us," or "our") is committed to protecting the privacy of our customers and their users. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data in connection with the Aatrex platform ("Service"). This Policy applies to all users of the Service and visitors to our website.

Aatrex operates as a data processor with respect to Customer Data (email, files, and other content belonging to Customer's tenants) and as a data controller with respect to account information, billing data, and operational data collected directly from individuals who register and use the Service.

This Privacy Policy is incorporated into and forms part of our Terms of Service.

Customer Data is processed on cloud infrastructure located in India. Customers with specific data residency requirements should contact support@aatrex.in before subscribing.

2. Data We Collect

2.1 Account Information

When you register, we collect your name, work email address, organization name, and password (stored as a salted cryptographic hash).

2.2 Billing Information

Payment card details, billing address, and transaction records. Payment card data is processed by our payment processor (Stripe or Razorpay) and is not stored on Aatrex servers.

2.3 Migration Metadata

Source and destination tenant identifiers, migration job identifiers, migration progress statistics, error logs, timestamps, and the identity of users who initiated or modified migration operations. Email and file content is processed in-memory only and is not stored.

2.4 API Credentials

Connection credentials you provide for source and destination systems, which vary by platform: Microsoft 365 / Exchange Online app registrations (tenant ID, client ID, client secret) for OAuth app-only access; Google Workspace service-account keys (JSON, containing a private key) used with domain-wide delegation; and, for IMAP, on-premises Exchange, and similar systems, the server address and account credentials. All such credentials are encrypted at rest using AES-256-GCM, used solely to authenticate migration operations, and deleted upon project completion or account termination.

2.5 Audit Logs

Records of actions performed within the Service, including the authenticated user's identity, the action taken, and the timestamp. Audit logs are retained for a minimum of 180 days.

2.6 Usage Data

IP addresses, browser type, device identifiers, pages visited, and feature usage patterns, collected via server logs and analytics tools for service improvement and security monitoring.

2.7 Support Communications

Records of customer support interactions, including the content of messages sent to our support team.

3. How We Use Your Data

We use collected data to:

(a) Provide, maintain, and improve the Service;

(b) Authenticate and authorize access to the Service;

(c) Process Migrations as directed by the Customer;

(d) Generate and maintain audit trails for compliance purposes;

(e) Process payments and manage billing;

(f) Send service communications, including account notifications, security alerts, and policy updates;

(g) Detect, investigate, and respond to security incidents;

(h) Comply with legal obligations, including CERT-In incident reporting requirements;

(i) Enforce our Terms of Service and Acceptable Use Policy.

We do not use Customer Data for training machine learning models, advertising, or any purpose other than providing the Service.

4. Legal Basis for Processing

For users in the European Union or United Kingdom (GDPR), we process personal data on the following legal bases:

(a) Contract performance — processing necessary to provide the Service you have contracted for;

(b) Legitimate interests — security monitoring, fraud prevention, service improvement, and audit logging;

(c) Legal obligation — compliance with applicable laws including CERT-In, DPDPA, and GDPR;

(d) Consent — where explicitly obtained, such as for marketing communications.

For users in India (DPDPA 2023), we process personal data on the basis of consent (provided at account registration) and for purposes necessary to provide contracted services.

Aatrex obtains consent at account registration for the processing purposes described in this Policy. As the Digital Personal Data Protection Act 2023 rules are notified, we will update our consent mechanisms to meet any additional granularity requirements.

5. Data Sharing and Subprocessors

We do not sell, rent, or trade personal data. We share data only with the following categories of recipients:

(a) Cloud infrastructure providers (e.g., AWS, Azure, or GCP) for hosting the Service;

(b) Payment processors (Stripe, Razorpay) for billing;

(c) Email delivery providers for transactional email;

(d) Error monitoring and analytics tools for operational monitoring;

(e) Law enforcement or regulatory authorities when required by law, court order, or to protect against fraud or illegal activity.

All Subprocessors are contractually bound to process data only as directed by Aatrex and to maintain appropriate security measures. A current list of Subprocessors is available upon written request to support@aatrex.in.

Aatrex will notify registered Customers of any intended addition or replacement of a material Subprocessor at least 30 days in advance by email. Customers with data protection concerns about a proposed Subprocessor change may object in writing to support@aatrex.in within 14 days of notification. If the objection cannot be resolved, Customer may terminate the affected Service without penalty.

6. International Data Transfers

Aatrex may transfer personal data across international borders in connection with the provision of the Service. For transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to countries not recognized as providing adequate data protection, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms.

For transfers of personal data subject to DPDPA 2023, we comply with applicable rules regarding cross-border data transfers as notified by the Government of India.

Where Standard Contractual Clauses are relied upon, Aatrex conducts transfer impact assessments (TIAs) as required by applicable law to verify that the level of protection guaranteed by the SCCs is not undermined by the law of the destination country. Customers may request a summary of applicable TIAs by contacting support@aatrex.in.

7. Data Retention

We retain personal data for as long as necessary to provide the Service and fulfill the purposes described in this Policy. Specifically:

Retention periods may be extended where required by applicable law or regulatory investigation. Erasure requests under Section 8 are subject to these legal retention obligations.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Right of Access: Request a copy of the personal data we hold about you.

Right to Rectification: Request correction of inaccurate personal data.

Right to Erasure: Request deletion of your personal data, subject to legal retention obligations.

Right to Data Portability: Receive your data in a structured, machine-readable format.

Right to Object: Object to processing of your personal data based on legitimate interests.

Right to Restrict Processing: Request restriction of processing in certain circumstances.

Right to Withdraw Consent: Where processing is based on consent, withdraw consent at any time.

To exercise any of these rights, contact support@aatrex.in. We will respond within 30 days. We may request verification of your identity before fulfilling any request.

If you are located in the EU/UK, you have the right to lodge a complaint with your local supervisory authority. If you are located in India, you may contact the Data Protection Board of India (established under DPDPA 2023) at https://dpboard.gov.in or as directed by the Board's published procedures.

In the event of a personal data breach, Aatrex will notify affected Customers without undue delay (and in any event within 72 hours of becoming aware), and will provide all information reasonably necessary to assist Customers in notifying affected data subjects and regulatory authorities as required by applicable law.

9. Security Measures

We implement the following technical and organizational security measures:

— AES-256-GCM encryption for all credentials stored at rest

— TLS encryption for all data in transit

— Role-based access controls on all internal systems

— Per-operation audit logging with user attribution

— Regular security assessments of our infrastructure

— Incident response procedures consistent with CERT-In requirements

Despite these measures, no system is completely secure. We cannot guarantee the absolute security of your data. In the event of a personal data breach affecting Customer Data, Aatrex (as data processor) will notify the affected Customer without undue delay, providing sufficient information to enable the Customer (as data controller) to meet its own notification obligations to supervisory authorities and affected data subjects. For CERT-In purposes, Aatrex will report security incidents to CERT-In within 6 hours of becoming aware, as required by the CERT-In Directions 2022.

10. Cookies and Tracking

We use essential session cookies for authentication and service delivery. You may disable cookies in your browser settings, but this may impair the functionality of the Service.

We do not use third-party advertising or cross-site tracking cookies. Analytics tools used for service improvement are listed in our Subprocessor list (available on request). You may opt out of non-essential analytics by contacting support@aatrex.in.

11. Children's Privacy

The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a minor, we will delete it promptly.

12. Updates to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to registered users via email at least 30 days before the effective date. Each version of this Policy is identified by the Effective Date shown at the top. The version you agreed to at account registration is stored with your account record. The "Effective Date" at the top of this Policy indicates when it was last updated. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

13. Contact and Data Protection Officer

For privacy inquiries, data subject requests, or to contact our data protection officer:

Email: support@aatrex.in

For GDPR-related inquiries from EU/UK users, please indicate "GDPR Request" in the subject line.

15. Jurisdiction-Specific Privacy Rights

In addition to the rights described in Section 8, the following rights apply to residents of specific jurisdictions. To exercise any of these rights, contact support@aatrex.in with your jurisdiction and the right you wish to exercise. We will respond within the timeframe required by applicable law.

15.1 United States — California (CCPA/CPRA)

California residents have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the third parties with whom we share it.
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: Aatrex does not sell or share personal information for cross-context behavioural advertising. No opt-out is required, but you may contact us to confirm.
• Right to Limit Sensitive PI Use: Request that we limit use of sensitive personal information to purposes necessary to provide the Service.
• Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA right.

Categories of personal information collected: Identifiers (name, email, IP address); commercial information (subscription tier, payment history); internet or network activity (usage logs, session data); professional information (job title, organization). We do not collect sensitive personal information beyond account credentials.

Shine the Light: California Civil Code §1798.83 permits California residents to request information about disclosure of personal information to third parties for direct marketing. Aatrex does not disclose personal information to third parties for their direct marketing purposes.

15.2 Canada (PIPEDA / Quebec Law 25)

Canadian residents have the right to access personal information held about them and to request correction of inaccurate information. Under Quebec Law 25, Quebec residents additionally have the right to data portability and to be informed about automated decision-making that produces legal or significant effects. To exercise these rights, contact support@aatrex.in. If you are unsatisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or, for Quebec residents, the Commission d'accès à l'information (www.cai.gouv.qc.ca).

15.3 Australia (Privacy Act / APPs)

Australian residents have the right to access and correct their personal information under the Privacy Act 1988 (Cth). You also have the right to complain about a breach of the Australian Privacy Principles (APPs) to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. We will acknowledge privacy complaints within 7 business days and aim to resolve them within 30 days. Where we cannot resolve a complaint, we will advise you of further options including external dispute resolution.

15.4 Singapore (PDPA)

Singapore residents have the right to access and correct personal data held about them under the Personal Data Protection Act 2012 (PDPA). Data access requests will be responded to within 30 calendar days. Correction requests will be actioned within a reasonable time. If you are dissatisfied with our handling of your personal data, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg. For data breach notifications affecting Singapore residents, we will notify you and the PDPC within 3 calendar days of assessing the breach as notifiable.

15.5 Brazil (LGPD)

Brazilian data subjects have the following rights under the Lei Geral de Proteção de Dados (LGPD) (Law No. 13,709/2018):

• Confirmation of the existence of processing and access to personal data
• Correction of incomplete, inaccurate, or outdated data
• Anonymisation, blocking, or deletion of unnecessary or excessive data
• Portability of personal data to another service or product provider
• Deletion of personal data processed with consent
• Information about public and private entities with which Aatrex has shared data
• Information about the possibility of denying consent and the consequences
• Revocation of consent

Requests may be submitted to support@aatrex.in. If unsatisfied, you may contact Brazil's Autoridade Nacional de Proteção de Dados (ANPD) at www.gov.br/anpd.

15.6 Japan (APPI)

Japanese data subjects have the right to request disclosure, correction, addition, deletion, and suspension of use of their personal information under Japan's Act on the Protection of Personal Information (APPI). Requests may be submitted to support@aatrex.in. Aatrex will respond within a reasonable period. Aatrex does not provide personal information to third parties without consent except where permitted under APPI. Before transferring personal information overseas, Aatrex ensures that the recipient maintains adequate protection measures equivalent to APPI standards.

15.7 United Arab Emirates (PDPL)

UAE residents have the following rights under UAE Federal Decree-Law No. 45 of 2021 (PDPL): the right to access their personal data; the right to correct inaccurate data; the right to request erasure of personal data where processing is no longer necessary; and the right to withdraw consent where processing is consent-based. Requests may be submitted to support@aatrex.in. Aatrex will cooperate with the UAE Data Office upon request.

15.8 General International

For residents of jurisdictions not specifically listed above, Aatrex will endeavour to honour privacy rights requests that are consistent with the principles set out in Section 8 of this Policy. Where applicable local law imposes rights or obligations beyond those described here, Aatrex will comply with such local law to the extent it is applicable to Aatrex as a data processor or controller in your jurisdiction. The Customer (as data controller) remains primarily responsible for ensuring its use of the Service complies with local data protection law applicable to its end users.

14. Automated Decision-Making

Aatrex uses automated systems for fraud detection, abuse prevention, and account suspension risk scoring. These systems may result in account suspension decisions. Where such automated decisions have significant effects on Customers, Customers have the right to: (a) request human review of the decision; (b) express their point of view; and (c) contest the decision by contacting support@aatrex.in. We do not make automated decisions that produce legal effects concerning individual data subjects based on Customer Data content (email, files).