Last updated: 22 September 2026 · Effective for all users of ratnos.com and the Ratnos application
Ratnos (“Ratnos”, “we”, “us”) is a product of Ataraxy Solutions Private Limited, a company incorporated in India. This policy explains how we collect, use, disclose, and protect personal data when you visit ratnos.com or use the Ratnos application (together, the “Service”).
Ratnos is a multi-tenant business platform. If you are an employee or customer of a business that uses Ratnos (a “Tenant”), that business is the data controller for the data it enters about you, and we act as its data processor. This policy covers both: how we handle Tenant account data as a processor, and how we handle data about visitors to ratnos.com and Tenant administrators as a controller.
Account & registration data: company name, country, admin name, email, phone, and password (stored as a salted hash, never in plain text).
Business data you enter into the Service: customer records, inventory, invoices, payment records, KYC documents (PAN/GST for India, TRN for UAE) where your business is legally required to collect them, and staff accounts. This data belongs to your business (the Tenant); we process it on your behalf under the terms of our Terms of Service.
Payment data: subscription payments are handled by a third-party payment processor. We do not store full card numbers on our servers.
Usage & device data: IP address, browser type, pages visited, and timestamps, collected automatically for security, fraud prevention, and service reliability.
Cookies: ratnos.com uses only strictly necessary cookies (session state, security tokens). We do not use third-party advertising or tracking cookies on the marketing site.
We do not sell personal data. We do not use Tenant business data to train third-party AI models.
Certain features connect to external services strictly necessary to provide them. Each only receives the minimum data needed for its function:
We disclose data to law enforcement or regulators only where legally compelled (e.g. a valid court order, or a regulatory filing your business is itself obligated to make, such as an Indian CTR or a UAE DPMSR/goAML report — which your business controls and initiates, not us).
Data is stored on cloud infrastructure that may be located outside your country. We take contractual and technical measures with our infrastructure providers to protect data in transit and at rest (encryption using industry-standard algorithms).
India DPDP Act 2023 & DPDP Rules 2025: the Digital Personal Data Protection Rules were notified by MeitY on 13 November 2025, with obligations phasing in and full enforcement by the Data Protection Board of India expected by May 2027. As a Data Fiduciary, we aim to provide a clear, plain-language notice (this policy), honour Data Principal rights to access, correct, complete, update and erase personal data and to withdraw consent, and to notify the Data Protection Board and affected Data Principals of a personal data breach within the timelines the Rules specify. Where your business handles data types subject to specific localization or Significant Data Fiduciary requirements, confirm the current position with counsel, as implementing guidance continues to be issued.
UAE note: if you operate under a UAE free zone with its own data protection regime (e.g. DIFC, ADGM), that regime may impose additional or different requirements than UAE federal PDPL — confirm which applies to your specific registration.
Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data, and to withdraw consent for optional processing. If you are an end customer of a Tenant business (not a Ratnos subscriber yourself), please direct these requests to that business first, since they control your data; we assist them in fulfilling it. If you are a Tenant administrator, contact us directly using the details below.
We retain account and business data for as long as your subscription is active, plus a reasonable period after cancellation to allow data export and to meet legal retention obligations (for example, UAE DNFBP rules require 5-year retention of certain compliance records, which your business — not Ratnos — remains responsible for meeting independently of your subscription status).
We use encryption at rest for sensitive fields (KYC identifiers, financial account details), role-based access control, and audit logging of data access. No system is completely secure; we encourage strong, unique passwords and prompt reporting of any suspected account compromise.
The Service is a business tool not directed at children, and we do not knowingly collect data from anyone under 18.
We will post material changes here with an updated effective date, and notify Tenant administrators by email for changes that materially affect how their data is handled.
For privacy questions or to exercise your rights, contact Ataraxy Solutions Private Limited at [email protected].