Privacy
Privacy Policy
Last updated: 30 September 2026
- Your business data stays yoursWe don't sell your transactions, stock or customer ledgers. On the network, a linked business sees only what's listed below — never your customers or margins.
- Kept in IndiaYour data is stored in Mumbai (AWS ap-south-1) and is exportable in full when you leave.
- You have rightsAccess, correction, erasure and complaints under the DPDP Act, 2023 — see how to use them.
1. Who we are and who is responsible
Distiqo AI is operated by Shivaura Enterprises (“Distiqo AI”, “we”, “us”). Registered-office details are available on request at info@distiqoai.com. Distiqo AI is in private beta, and this page describes how we handle data today.
Two roles matter under India's Digital Personal Data Protection Act, 2023:
- Your business is the Data Fiduciary for personal data it puts into Distiqo about its customers, retailers, suppliers, staff and other contacts. We act as your Data Processor: we handle that data to run the service for you, on your instructions.
- We are the Data Fiduciary for the data of the people who sign up for or use our own account, and for data from this website.
2. What we handle
| Kind of data | Examples | Whose it is |
|---|---|---|
| Business contacts | Retailer and supplier names, phone numbers, addresses, area, city | Retailers, suppliers |
| A shop's customers | Names and phone numbers of customers who buy on credit, what they owe, their payments and advances | Shop customers |
| Tax identifiers | GSTIN, PAN (PAN is encrypted at rest) | Retailers, suppliers |
| Your team | Names, work email, roles; employee bank and ID-proof details if you record them | Your staff |
| Transactions | Orders, invoices, quotations, payments, ledger entries, stock | Your business |
| Network activity | Links between a shop and its distributors, orders and messages between them, and — if the shop shares it — sell-through of the distributor's own products | Linked businesses |
| Messages | The order-related content of WhatsApp conversations, and questions you ask the in-product assistant | Retailers, your team |
| Location | Retailer locations and salesman routes, when you use field-force features | Retailers, salesmen |
| Sign-in and security | Login events with IP address and device; one-time verification codes emailed to you (stored only as a one-way hash); records of browsers you choose to trust (IP address, browser type) | Users |
| Recordings | Call recordings, only where you switch that feature on and have consent | Callers |
| Your acceptance of our terms | Which version of the Terms and this policy you accepted, when, the name you typed to sign, and the IP address and browser you used | Users |
We collect only what the features you use need. We do not knowingly collect data about children.
Camera. When you scan a barcode with your phone, the camera image is read on your device to find the code. The picture is not uploaded or stored; only the code is used.
3. Why we use it
| Purpose | Basis |
|---|---|
| Taking and processing orders, invoicing, delivery, collections | Contract with you |
| GST invoicing and statutory records | Legal obligation |
| Messaging through WhatsApp | Consent |
| Passing orders, bills, messages and shared sell-through between linked businesses on the network | Contract with you, and the shop's choice to share sell-through |
| Showing shops what sells in their area, from five or more shops combined, never one shop's figures | Legitimate use |
| Keeping accounts secure and the service running | Legitimate use |
| Keeping proof that you accepted our Terms and this policy | Consent (and to show we obtained it, as the DPDP Act requires) |
| Improving the product from aggregate usage | Legitimate use / consent |
Where we rely on consent, we record it, and you can withdraw it at any time.
4. AI features
Distiqo uses language models to read messages and documents, and to answer questions. AI output is assistive: anything that changes money or stock — an order, an invoice, a reminder — waits for a person to approve it.
As of our last review (June 2026), our language and speech features use an India-based provider (Sarvam AI), and the search embeddings that help the assistant find things are computed on our own servers. We don't use your data to advertise. We'll update this section if that changes.
5. GST and government systems
Distiqo generates GST-compliant invoices as part of the order workflow. E-invoices and e-way bills are submitted to the government system through our GSP partner, Sandbox, using the e-invoice and e-way bill login your business connects; until it is connected, invoices are generated in Distiqo without a live government submission. The invoice and e-way bill details — including your customers' GSTINs and addresses — pass through Sandbox to the government portal. Distiqo also looks up GSTINs through Sandbox to fill in business names and addresses.
6. Between businesses on the network
When a shop and a distributor link their accounts, only this crosses between them:
- To the shop: the distributor's catalogue, prices and schemes for that shop, the bills issued to that shop, and their messages.
- To the distributor: the shop's orders, payments and messages sent to it, and — only if the shop leaves sharing on — units sold and on the shelf for the distributor's own products in that shop. A shop can switch this off for any distributor in its settings.
A distributor never sees a shop's customers, its other suppliers, its selling prices, margins or cash. A shop never sees another shop. “What's selling near you” combines many shops in a city and shows a product only when at least five shops sell it — never a shop's name, quantities, prices or customers.
8. Where your data is kept
The main database is in Mumbai. Some hosting and messaging components may run elsewhere, and we are working to pin all of them to India regions. If any personal data is ever transferred outside India, we will tell you and put safeguards in place first.
9. How it is protected
Traffic is encrypted in transit, sensitive fields are encrypted at rest, every business is kept separate from every other, password sign-ins are confirmed with a one-time code sent to your email, and every action is written to a tamper-evident log. The details, and what we have not done yet, are on our Security page.
10. How long we keep it
| Data | Kept for |
|---|---|
| Invoices, ledgers, orders, stock records | 8 years, because tax and company law require it |
| Retailer KYC details | Your contract plus 2 years |
| A shop's customer credit records | 8 years, as part of the shop's books |
| Employee records | Employment plus 8 years |
| Phone and email contacts | Your contract plus 2 years, or until consent is withdrawn |
| Conversations and assistant chats | 24 months |
| Audit and sign-in logs | 8 years |
| Records of your acceptance of our Terms and this policy | While your account exists plus 8 years, so we can show what you agreed to |
| Sign-in verification codes and trusted browsers | Each code is valid for 10 minutes; a trusted-browser record lasts 30 days or until you revoke it or change your password |
| Operational telemetry | 13 months |
Records the law requires us to keep can't be erased early, even on request; we'll tell you when that applies. Financial records are corrected by reversal or credit note, never by editing or deleting. Other personal data is deleted or anonymised when its period ends, when consent is withdrawn, or on a valid erasure request. The scheduled clean-up jobs are being switched on as these periods are finalised.
11. Your rights
You can ask to see, correct or erase your personal data, withdraw consent, nominate someone to act for you, and complain. Withdrawing consent is as easy as giving it: write to us, or close your account. It doesn't undo processing already done, and because an account can't run without this policy, withdrawing consent to it means closing your account. How to do each — and how we answer within 30 days — is on our DPDP rights page.
13. Leaving Distiqo
You own your customer directories, margins and ledgers. If you end your relationship with us, you can ask for a full export, and once you confirm it we delete what remains within a reasonable period, keeping only what the law requires. See Cancellation.
14. Changes to this page
If we change how we handle data in a way that matters, we'll update this page, change the date at the top and tell customers who are affected.
15. Contact and grievances
For any privacy question or complaint, write to info@distiqoai.com with the subject “Privacy”. We acknowledge every message and answer within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
Questions? Write to info@distiqoai.com or message us on WhatsApp. See also our Privacy Policy, Terms and Security pages.