Privacy Policy

This Privacy Policy explains what personal data CoreOctal (—) — we, Tile Stage — collects when you use https://tilestage.in and the Tile Stage service, why, how long we keep it, who processes it for us and what your rights are. It is written for the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the rules under them. Where the DPDP Act uses "Data Principal" we say you; where it says "Data Fiduciary" we say we. The Cookie Policy and Security & Responsible Disclosure form part of this policy.

1. Who is responsible

For the personal data of the people who sign up, administer and use Tile Stage accounts, we are the data fiduciary. Where a Customer enters personal data about its own staff, customers or contacts (for example the "prepared by" name or a client name on a brochure), the Customer is the data fiduciary and we are its processor under the Data Processing Addendum.

Privacy questions: —.

2. What we collect

Account data — your name, e-mail address, phone number, password (stored only in a form from which it cannot be read back), an optional two-factor secret (stored encrypted), your role and permissions, the company you belong to.

Company data — the company's name, legal name, type, registration and tax identifiers, website, e-mail, phone, address, logo and brochure defaults; for partners, the firm name, work type and referral code.

Content you upload — tile images, company logos and the details you type for brochures (company, project, client, prepared-by names, prices, notes).

Records of use — the spaces you open, the renders, brochures, downloads and uploads you make, profile and user changes, each with the time and the network address (IP) it came from.

Security records — sign-ins and failed sign-ins, security events concerning your account, the sessions you hold and the browser and operating system they run on, network addresses.

Technical data — the session cookie, the preferences the studio keeps in your browser (see the Cookie Policy), screen size and graphics capability used to choose a rendering resolution.

Payment data — when you pay, our payment aggregator collects your payment details directly; we receive the payment status, amount, method type, the last digits of a card and a transaction id, never your full card number, CVV or banking credentials.

Correspondence — e-mails and messages you send us, and the service e-mails we send you.

We do not collect special categories of data and we do not knowingly collect data of persons under 18.

3. Why we use it (purposes and lawful basis)

Purpose	Data	Basis
Creating, verifying and running your account and company; providing the studio, renders and brochures	account, company, content, technical	performing the contract; your consent at sign-up
Counting previews and brochures against the plan; invoicing; collecting payment	records of use, company, payment	contract; legal obligation (tax)
Protecting the service and the Spaces against copying, automated use, fraud and abuse	records of use, security records, technical	legitimate use for security, as the DPDP Act allows; contract
Sending service e-mails: verification, approval, invitations, security notices, changed terms, payment notices	account	contract; legal obligation
Support and grievances	account, correspondence	contract; legal obligation
Improving the service with aggregated statistics (which features and spaces are used)	records of use, anonymised	legitimate use
Complying with the law, court orders and regulators; establishing or defending legal claims	any	legal obligation

We do not sell personal data, we do not use it for advertising, and we do not profile you for marketing.

4. Protection of the service

Because the Spaces are the core asset of the service, the signed-in pages are protected against copying and automated use: your use is recorded (section 2), fair-use limits apply, and use that looks automated or abusive — including the use of the browser's developer tools on the signed-in pages — may sign you out and suspend the account pending our review. Your company's administrator sees counts of your previews and brochures; the full records are read only by our operators for security, support and billing.

5. Who processes data for us

Provider	What it does for us	Where
Cloud hosting provider	runs the application, the database, the files and the backups	India
Content delivery and security provider	delivers the site and protects it from attacks and bots; your network address and browser signals pass through its network	global network
Payment aggregator (RBI-regulated)	collects payments and issues refunds	India
E-mail delivery provider	sends our service e-mails	global

Each provider acts under a contract that limits it to our instructions; the current list of providers is available on request at —. We share personal data otherwise only with professional advisers under confidentiality, with a buyer of the business (you will be told), with authorities when the law requires, and to protect our rights or safety.

6. Where data is kept and transfers

Our application and its database run on servers in India. The content delivery and e-mail providers may process data outside India as part of operating global networks; transfers follow the DPDP Act and the Government of India's notifications on restricted countries.

7. How long we keep it

Data	Retention
Account and company data	while the account exists, then up to 90 days after deletion, except what tax and company law require us to keep (invoices: 8 years)
Content, renders, brochures	per the Customer's retention setting (default: while the account exists); 30 days' download window after termination, deletion within 90 days
Records of use	12 months
Security records	90 days
Sessions	until sign-out or expiry
Service e-mails	90 days
Backups	rolling copies that are replaced on a short cycle
Payment records	8 years (tax law)

8. Security

Every connection to the service is encrypted; passwords are never stored in readable form; two-factor authentication is available to every user; access by our operators is limited to what their role needs and is logged; the service is monitored, kept up to date and backed up regularly. No system is perfectly secure; if a breach affects you, we notify you and the Data Protection Board of India as the DPDP Act requires. See Security & Responsible Disclosure.

9. Your rights

Under the DPDP Act you may: access a summary of the personal data we hold about you and how it is processed; have inaccurate or incomplete data corrected or updated; have data erased when it is no longer needed for the purpose or you withdraw consent (except what we must keep); withdraw consent for processing based on consent, with effect for the future; nominate a person to exercise your rights if you are unable to; and raise a grievance. Your company's administrator can change your account data directly; for anything else write to —. We answer within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

10. Cookies and browser storage

See the Cookie Policy. In short: one strictly necessary session cookie, a few preferences that stay in your own browser, and the strictly necessary security cookies of our content delivery provider. No advertising or analytics cookies.

11. Children

The service is for businesses and for persons aged 18 or more. If you believe a minor has given us data, write to — and we delete it.

12. Changes

We publish changes at https://tilestage.in/legal/privacy with the effective date and a summary, notify account holders by e-mail, and ask users to accept the new version at their next sign-in when the changes are material.

13. Contact

CoreOctal, — · —