1. Overview & Data Fiduciaries
This Privacy Policy & Data Residency Statement governs the collection, processing, and storage of personal and business data by Arilator India Pvt Ltd (GSTIN: 36ABGCA4968F1ZG, acting as the Data Fiduciary in India for Customer accounts, INR/UPI orders, GSTIN verification, prepaid usage ledgers, and statutory GST tax invoicing) and Arilator Inc. (a Delaware corporation, USA, responsible for global Vendor onboarding and monthly USD wholesale settlements).
2. Information We Collect from Customers
- Account & Profile Information: When you register a Customer account or place an order, we collect your work email address, full name, account type (Organization or Individual), organization/company name, billing address, state, and order parameters (selected software package, seat count, or prepaid usage tier).
- GSTIN Verification: Providing a 15-character Indian GSTIN is mandatory when registering as (or converting an account to) an Organization, and optional for Individual registrations. When you submit a GSTIN, we verify it in real time against official Indian GST taxpayer records through authorized GST compliance verification services to confirm active registration status, validate that the registered Legal Name or Trade Name matches your organization name, and populate your statutory State Code and Place of Supply on your B2B Tax Invoice.
- API Gateway & Prepaid Usage Telemetry: When you use an Arilator-provisioned API Gateway key for a usage-metered or Pay-As-You-Go product, we record operational metering metadata — specifically timestamp, product identifier, request unit or token counts, HTTP status, and atomic INR ledger deduction amounts — to maintain an accurate prepaid wallet audit trail.
3. Payment Information & RBI Data Localization
Customer payments are collected in Indian Rupees (INR) via domestic UPI or bank transfer (NEFT/RTGS) to Arilator India Pvt Ltd's designated collection account displayed at checkout. Arilator never collects, processes, or stores raw payment card numbers (PAN/CVV).
In strict compliance with Reserve Bank of India (RBI) directives on Storage of Payment System Data, all Indian customer order records, UPI transaction references (UTR/RRN), payment callback payloads, GSTIN verification logs, INR prepaid credit ledgers, and domestic GST tax invoices are processed and stored exclusively within secure data centers located in India.
4. Information We Collect from Software Vendors
When a software provider onboards through the Partner Manager portal, we collect the Vendor's legal and display company name, authorized representative name, work email address, product catalog and pricing schedules, fulfillment configuration (API endpoints, encrypted master API credentials, or single-use coupon pools), and USD settlement bank account details for monthly payouts.
5. Purpose & Lawful Basis of Processing
We process personal and business data strictly for the following lawful commercial and statutory purposes:
- To generate locked INR checkout quotes, reconcile domestic UPI and NEFT/RTGS payments, and issue compliant Indian GST Tax Invoices and Credit Notes under GSTIN
36ABGCA4968F1ZG. - To authenticate buyer GSTINs and Legal/Trade Names against official GST records so eligible B2B buyers can claim 18% Input Tax Credit (ITC) in GSTR-2B.
- To provision software subscriptions, license keys, and metered API Gateway entitlements upon payment confirmation.
- To meter real-time usage against prepaid INR credit wallets and prevent unauthorized or over-balance API consumption.
- To calculate, audit, and remit monthly Net-15 USD wholesale settlements to Vendors and maintain immutable financial audit trails.
- To respond to customer support requests, refund claims, and statutory regulatory or tax inquiries.
6. Data Sharing & Strict Minimization
Arilator never sells personal data and never uses customer or vendor data for third-party behavioral advertising. We share only the minimum data necessary to execute and comply with your transaction:
- Authorized GST Verification Providers: Your supplied 15-character GSTIN is transmitted over encrypted TLS to our authorized Indian GST compliance verification provider solely to verify active GST registration status, Legal Name / Trade Name match, and registered state code.
- Banking & Settlement Partners: Domestic Indian banking partners for INR UPI and NEFT/RTGS reconciliation, and regulated US banking partners for outbound USD wholesale wire/ACH settlements to Vendors.
- Software Vendors: Strictly the minimum identifier required to provision your software entitlement (such as work email, organization name, and purchased plan/seat count, or a pseudonymized tenant identifier on proxied API gateway calls). We do not share your domestic UPI banking metadata or Indian tax records with Vendors.
- Tax & Regulatory Authorities: Invoice and GSTIN particulars required for statutory GST return filings (such as GSTR-1 / GSTR-3B) under Indian tax law.
7. Statutory Data Retention
In accordance with Section 36 of the Central Goods and Services Tax (CGST) Act, 2017 and Indian corporate accounting regulations, domestic GST tax invoices, credit notes, GSTIN verification records, and order payment ledgers are retained in data centers located within India for a minimum of eight (8) years from the due date of furnishing the annual return for the relevant financial year.
8. Your Rights Under the India DPDP Act (2023) & Global Privacy Laws
Under the Digital Personal Data Protection Act, 2023 (India) and applicable international data protection laws, Data Principals have the right to:
- Access & Summary: Obtain a summary of the personal data being processed by Arilator and the processing activities undertaken.
- Correction & Updating: Request correction, completion, or updating of inaccurate or incomplete account data (note that already-issued statutory GST tax invoices cannot be retroactively altered once locked, except via formal GST Credit/Debit Notes where permitted by law).
- Erasure & Withdrawal of Consent: Request erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to mandatory 8-year statutory tax and financial audit retention obligations under Indian law.
- Grievance Redressal: Register a formal privacy or data-handling grievance with our Grievance Officer.
To exercise any of these rights, contact our Privacy & Grievance Desk at refunds@arilator.com or partnerships@arilator.com.
9. Technical & Organizational Security Controls
We enforce encryption in transit (TLS 1.2+) and encryption at rest (AES-256), strict role-based access controls across Customer, Partner Manager, and BackOffice portals, authenticated session isolation, one-way cryptographic hashing of customer API keys, outbound SSRF protection on proxy gateway routes, and hardware-backed key isolation for vendor provisioning secrets. Visit our Trust, Security & Regulatory Compliance page for further architectural details.
10. Updates to This Policy
We may update this Privacy Policy periodically to reflect operational, legal, or regulatory developments. Material changes will be published on this page.
11. Grievance Officer & Contact Information
In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, questions, data rights requests, or grievances regarding privacy and data residency may be directed to our Grievance Officer: