Privacy Policy
What personal data OctaPages collects, why, who sees it, how long we keep it, and your rights under India's Digital Personal Data Protection Act, 2023 and, where it applies, the EU and UK GDPR.
Last updated: 28 October 2026
1. Who we are
Minivet System LLP, which operates OctaPages, is the Data Fiduciary for the personal data described here. Our registered address is Unit No. 12ES4, 12th Floor, East Tower Mani Casadona IT Building, Plot #2 F/4, AA II, F Newtown, Chakpachuria West Bengal 700156, India. Contact us at [email protected].
2. What we collect
We collect only what the service needs:
- Account details: your name, email address, phone number, a hashed password (never the password itself), and an optional profile photo.
- Business details you choose to publish: the listing's name, address, phone, hours, services, prices and photos. These are public by design.
- Reviews you write, shown publicly with your first name, the initial of your last name, and your profile photo if you added one.
- Enquiries you send to a business: your name, the contact details you enter and your message.
- Security records: the devices you sign in from, with their IP address and browser, so you can see and end your sessions.
- Visit counts for listings. We count views and taps on a listing, with no IP address, cookie or identifier of the visitor.
- Where you came from when you send an enquiry: the page on OctaPages, or the name of the website that linked you (for example "google.com"), never the full address or anything about you. Until then, the previous page is kept only in your browser tab.
- Error reports: when a page fails, the kind of page and the error message, with email addresses, phone numbers and passwords removed.
- Billing details, if your business buys a plugin: the billing name, address, state and optional GSTIN for the tax invoice. Payments are handled by Razorpay; we receive only the payment reference and status, never your card number, UPI PIN or bank details.
3. Data inside business workspaces
When a business uses a plugin such as the WhatsApp CRM, the contacts, conversations and files it keeps in its workspace are its own records. For that data the business is the Data Fiduciary and we are its Data Processor: we store and process it only to provide the service, on the business's instructions and under our Data Processing Addendum. If you are a customer of such a business, ask the business first about your data; we will help it answer you.
Each business's workspace data lives in a separate database that no other business can reach, and backups of it are encrypted with a key unique to that backup.
3A. Data from your Google account
Some features let a business connect its own Google account. We ask only for what each feature needs, and only when a person in the business chooses to connect:
- OctaSEO — Google Search Console (read-only, webmasters.readonly) and Google Analytics (read-only, analytics.readonly): we read the search clicks, impressions, average position, queries and pages of the site the business chose, and its sessions, users and conversions by landing page and channel. We show these figures to that business, inside its own workspace, in its SEO reports. We never change anything in Search Console or Analytics.
- Sending email from a member's own Gmail (gmail.send): we only send the emails that member writes in OctaPages. We cannot read, list or delete their mail.
- Appointments in Google Calendar (calendar.events): we add, update and remove the business's own bookings and read busy times only if the business asks us to block them.
- Sign-in with Google: your name, email address and profile picture, to sign you in.
3B. How we treat Google user data
OctaPages' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We use Google user data only to provide the feature the business connected, as described above. We do not sell it, we do not use it for advertising or to build profiles, we do not use it to train artificial-intelligence models, and no person at OctaPages reads it unless the business asks us to for support, it is needed for security, or the law requires it. We do not share it with anyone except the service providers that host the service for us, under contract.
Google's access tokens are encrypted before they are stored and are never shown to anyone. The figures are kept in the business's own workspace database, which no other business can reach. When the business disconnects Google in OctaPages, we delete the tokens, ask Google to revoke our access, and delete every figure we synced from that account. You can also remove our access at any time at myaccount.google.com/permissions.
4. Photos
Photos are re-encoded when you upload them, and all hidden data (including the GPS location phones add) is removed. Profile photos are cropped to a square automatically.
5. Why we use it
To run the directory and your account, to deliver your enquiries and notify businesses, to show reviews, to keep the service secure and prevent abuse, to meet legal obligations, and to answer you. We rely on your consent, given when you create an account, and on the legitimate uses the DPDP Act allows. We don't sell your personal data and we don't use it for advertising.
7. Where it is stored
Our servers are in Hetzner's data centre in Nuremberg, Germany (European Union); files and backups are stored with Cloudflare R2. The DPDP Act permits transferring personal data outside India except to countries the Government restricts, and we only use providers bound by contract to protect it.
8. How long we keep it
- Account data: until you delete your account. We then remove your name, email, phone and photo; your reviews stay, shown as written by a deleted user.
- Enquiries: kept with the business you sent them to.
- Listing visit counts: 90 days.
- Rejected photos: deleted 7 days after the decision.
- Security and audit records: as long as needed to protect the service and meet legal duties.
- Error reports: 90 days after the error was last seen.
- A business's workspace data: for as long as the business keeps its workspace. When a workspace is deleted, its encrypted backup is kept for 30 days (1 month) so the business can ask for it back, then deleted permanently with the workspace's files.
- Invoices and payment records: as long as Indian tax law requires (at least 72 months).
9. Your rights
Under the DPDP Act you can: get a copy of your data (Settings → Privacy → Download my data); correct it (Settings → Profile); erase it (Settings → Privacy → Delete my account); withdraw consent, which works the same way as deleting your account; nominate someone to exercise your rights if you die or cannot act; and complain to us, then to the Data Protection Board of India.
Our Data Rights page (https://octapages.com/data-rights) explains each right and has a form for anything the settings don't cover. We reply within 30 days, and resolve grievances within 15 days.
Write to [email protected] or our Grievance Officer (https://octapages.com/grievance) for anything else.
10. Children
OctaPages is not meant for children. We don't knowingly collect data from anyone under 18 without a parent's or guardian's verifiable consent.
11. Security
Data travels encrypted (HTTPS). Passwords are stored as one-way hashes (argon2id). Each business's workspace has its own database, and backups are encrypted. Two-step verification is available for every account, and every staff decision is logged. If a breach affects your data, we'll tell you and the Data Protection Board of India without delay, as the DPDP Rules require.
13. If you are in the European Union or the United Kingdom
The EU and UK GDPR apply to personal data of people there. We process it to perform our contract with you (your account, your enquiries, your plugins), for our legitimate interests (keeping the service secure and preventing abuse), to meet legal obligations (tax records), and with your consent where we ask for it.
You have the rights of access, rectification, erasure, restriction, data portability and objection, and you may withdraw consent at any time. Use the settings or the Data Rights page, or write to us. You may also complain to your local data protection authority.
Your data is processed in the European Union (Germany) and by providers who may process it elsewhere under the EU Standard Contractual Clauses or an adequacy decision.
14. Changes
We'll post changes here with a new date, and email account holders about important changes.