1. Data we collect
- Account data: name, email address, authentication details managed by our sign-in provider (not plaintext passwords), or Google sign-in identifier, job title and profile details you add.
- Workspace content: projects, tasks, tickets, risks, comments, attachments and other material you or your team add.
- Billing data: plan, seat count where applicable, payment status, transaction references and billing or tax information you supply. Payment credentials are handled by Razorpay; we do not store full card numbers, CVV, bank credentials or payment PINs.
- Security and usage data: sign-in events, IP address, device and browser details, and audit logs of actions in your workspace.
2. Why we use it
- To provide, secure and support the service, and to enforce plan limits.
- To process payments and keep records required by law, including tax law.
- To send service emails such as invitations, password resets, notifications and billing notices.
- To detect abuse, investigate security incidents and keep audit trails.
We rely on performance of our contract with you, our legitimate interests in running a secure service, and legal obligations.
3. Who processes it
We share data only with service providers that help us run BerryPM, under appropriate safeguards:
- cloud hosting, database and file storage providers;
- Razorpay, for payment processing;
- email delivery providers, for service emails;
- Google, if you choose to sign in with Google.
- Slack, GitHub or import providers when your administrator enables those integrations; selected content and event data are shared as needed for that integration.
We may disclose data where required by law or to protect rights and safety. Providers may process data outside India; we use appropriate contractual and security safeguards where required by applicable law. Third-party services also process data under their own privacy policies.
4. Who can see your workspace data
Workspace access is restricted according to membership and permissions. Authorised personnel and service providers may access data where necessary for support, security, operations or legal compliance. Posts and comments in the public Community can be viewed publicly; do not include confidential or personal information that you do not intend to share.
5. Cookies and local storage
We use essential browser storage to keep you signed in and secure your session. We do not use advertising or cross-site tracking cookies.
6. Retention
We keep workspace data while your account is active. If a paid plan ends, the workspace moves to the Free plan and data is kept. On a verified deletion request we delete account and workspace data, except records we must keep by law (such as invoices) and security logs needed for legitimate security purposes. Deletion may take time to reach backup copies, which remain protected until they expire under the provider's retention cycle. An individual member's deletion request does not automatically delete organisation-owned workspace records.
7. Security
Safeguards include encryption in transit, workspace access controls, optional multi-factor authentication, attachment validation and scan-status controls, session controls and audit logging. No system is perfectly secure, and we will notify affected users of a breach as required by law.
8. Your rights
Subject to applicable law, including India's Digital Personal Data Protection Act, 2023 to the extent in force and applicable, you may request access, correction, deletion or a copy of your personal data, withdraw consent, raise a grievance, and nominate a person to act for you where provided by law. Email [email protected]. If your account belongs to an organisation's workspace, some requests may need to go through its administrator.
We may need to verify your identity and authority before acting. Withdrawing consent does not affect earlier lawful processing, and may prevent us from providing features that require the data. We may retain records required by law. Where we process workspace personal data on an organisation's instructions, that organisation decides the purpose of processing and should be your first contact for requests about those records.
9. Children
BerryPM is a business service and is not intended for anyone under 18.
10. Changes
We may update this policy and will email you about material changes before they apply.
11. Contact and grievances
For privacy questions or grievances, contact [email protected]. We aim to respond within 7 business days. 8plus2 Omnitech (OPC) Pvt Ltd, Urbano Q 1602, Palava Phase 2, Dombivali East, Thane, Maharashtra, India - 421204.
If a grievance remains unresolved, you may seek the remedies available from the competent authority under applicable law.