Privacy Policy

Avana may collect account details such as full name, business contact information, login credentials, and organization metadata needed for platform access and role-based controls.

We also process operational logistics data entered by users, including shipment records, party details, vehicle information, billing references, and communication metadata generated through normal system usage.

Collected information is used to provide, secure, and improve the Avana platform, including user authentication, shipment workflows, invoice processing, reporting, and customer support.

We may also use limited usage metrics for product reliability, fraud prevention, and service optimization, always aligned with legitimate business operations.

AVARTANA LABS LLP does not sell personal information. Data may be shared with trusted infrastructure and service providers only to the extent required for hosting, communications, analytics, and security monitoring.

Information may be disclosed when required by applicable law, regulatory authority, or legally binding process.

We maintain administrative, technical, and procedural safeguards appropriate for a logistics SaaS platform, including controlled access, encrypted transport, and monitored infrastructure.

Data is retained for operational continuity, compliance, and dispute resolution needs, then archived or deleted according to internal retention controls and legal requirements.

The Avana application and its database run on Oracle Cloud Infrastructure in the Mumbai (India) region. Files you upload — scanned consignment notes, proofs of delivery, and similar documents — are stored in Backblaze B2 object storage in the European Union. Those files are therefore held outside India.

Payments are processed by Razorpay, which stores payment-instrument data on its own systems in India as its regulatory obligations require. AVARTANA LABS LLP does not store card numbers, UPI credentials, or bank credentials at any point.

The Digital Personal Data Protection Act, 2023 permits transfer of personal data outside India except to territories that the Central Government has restricted by notification. The European Union is not restricted at the date of this policy. If that changes, we will relocate the affected storage and update this page.

Oracle Cloud Infrastructure (Mumbai, India) — application hosting and database.

Backblaze B2 (European Union) — object storage for uploaded documents and files.

Razorpay (India) — subscription payments, UPI mandates, and payment records.

Meta Platforms (WhatsApp Business Platform) — delivery of shipment and document notifications to the mobile numbers you register against a consignment. The information sent is the recipient's number and the reference details needed to identify the shipment.

Google (Gmail SMTP, or the SMTP relay configured for your deployment) — transactional email: verification links, password resets, billing receipts and account notices.

Hugging Face (model CDN) — the optical-character-recognition model is downloaded to your browser from this CDN. No document, image or field value is sent to it; extraction runs entirely on your device.

We do not sell personal data, and we do not share it with anyone outside this list except where the law compels disclosure.

Bilty (consignment note) PDFs can be shared with a consignor or consignee through a link that does not require an account. The link embeds a signed, time-limited token that grants access to that one document.

Anyone who holds the link can open and download the document for as long as the token is valid. The document contains the consignor and consignee names, addresses, GSTIN where recorded, cargo details and freight value. Treat a share link as you would the printed document: send it only to the intended recipient.

Share links cannot currently be revoked individually before they expire. If you have sent a link to the wrong recipient, contact us at mayank@avartanalabs.com and we will treat it as a personal-data incident under section 8 of this policy.

If a personal data breach occurs, we will notify each affected Data Principal and the Data Protection Board of India as required by section 8(6) of the Digital Personal Data Protection Act, 2023.

Notification will describe what happened, the categories of data involved, and the steps we are taking, without waiting for the investigation to conclude.

You may ask for a copy of the personal data we hold about you, ask us to correct it, ask us to erase it, and withdraw a consent you previously gave. Several of these can be actioned directly: export from Settings → Data Export, and consent from Settings → Privacy.

For anything not available in the product, or to nominate another person to exercise these rights on your behalf, write to our Grievance Officer, Mayank Batra, Co-Founder, at mayank@avartanalabs.com. We acknowledge within 5 business days and aim to resolve within 30 days.

Where we decline a request — for example because a record must be retained to meet a statutory obligation — we will tell you which obligation applies.

Avana is a business operations platform and is not directed at children. We do not knowingly collect personal data of a child under the age of eighteen, and we do not undertake tracking or behavioural monitoring of children or targeted advertising directed at them.

Where a transport operator enters a minor's details as an emergency contact or a nominee, that operator is responsible for obtaining any consent the Digital Personal Data Protection Act, 2023 requires. If you believe a child's data has reached us, write to mayank@avartanalabs.com and we will erase it.

We may update this policy. Material changes are notified in the product or by email to account administrators before they take effect, and the effective date above always reflects the current version.