This policy explains how Digital Poonam ("we") handles personal data on oyyzo.com: your Oyyzo account and the Oyyzo partner program. We decide why and how this data is used, so for it we are the data fiduciary under India's Digital Personal Data Protection Act, 2023.
Each Oyyzo app has its own privacy policy for the data you put into it. For example, Track's policy at track.oyyzo.com/privacy covers companies and the employee activity they record there.
1. What we collect and why
Your Oyyzo account
- Name and email: to identify you, let you log in and send you account emails (confirming your email, password resets, security notices).
- Password: stored only as a salted scrypt hash. We can't read it.
- Login sessions: a random token in a cookie on your browser. We store only a one-way hash of it, with an expiry date, and the date you last logged in.
- If you change your email, the new address is kept as "pending" until you confirm it.
The partner program (only if you join it)
- Your Oyyzo account (above), and anything you tell us about your website or how you'll promote us.
- Payout details: your UPI ID or bank account (holder name, account number, IFSC), and your PAN, which Indian tax law needs for TDS on commission.
- Referral activity: clicks on your links (time, which app) and the businesses that sign up through them, with the amounts they pay and refunds, which our apps report to us so we can calculate your commission.
- For people who click a link or sign up through one, and for partners when they sign up, we keep a one-way keyed hash of the network (IP) address, never the address itself. We use it only to count each visitor once and to spot partners referring themselves.
Security
To slow down password guessing we briefly keep, in the server's memory only, a count of failed attempts per email and network address. It is cleared within about 15 minutes and is never written to disk.
2. Why we may use it (legal basis)
- Running your account and the partner program you signed up for: your consent and our agreement with you.
- Paying partners and deducting TDS: our legal obligations under Indian tax law.
- Keeping the service secure and preventing fraud, such as fake referrals.
We do not sell personal data, show ads, or use advertising or analytics trackers on oyyzo.com.
3. Cookies and browser storage
| Name | What it does | How long |
|---|---|---|
| oyz_session | Keeps you logged in to your Oyyzo account. | 30 days, or until you log out |
| oyz_ref | Set when you open a partner's link: remembers the partner code on oyyzo.com and our app subdomains so the partner is credited if your business signs up. It holds nothing else. | 60 days |
| theme | Your light or dark mode choice, saved in your browser's storage. It never reaches our server. | Until you clear it |
All of these are needed for the site to work as you asked or for the partner program; there are no optional tracking cookies to accept or refuse.
4. Who we share it with
- Hostinger: hosts this website and its database, and sends our emails.
- Razorpay (RazorpayX): if we pay a partner through it, it receives the partner's name, email and payout details.
- Our own apps: each app tells us about sign-ups and payments of businesses that came through a partner's link. Partners see only a shortened business name and their own commission.
- Tax authorities: PAN and amounts paid to partners, when TDS rules require it.
- Anyone else only if the law requires it (for example a court order).
5. Where it is stored
On Hostinger servers in [set HOSTING_REGION]. If that ever changes to a place outside India, it will only be one the Government of India allows.
6. How long we keep it
- Account: until you delete it. Deleting it (from your account page) removes your account and logs you out everywhere straight away.
- Login sessions: until they expire (30 days) or you log out.
- Partner data: while your partner account exists. Records of commission and payouts (amounts, dates, PAN) are kept for 8 years, because tax law requires us to keep them. To close a partner account, email us.
7. How we protect it
Connections use HTTPS. Passwords are hashed with scrypt, login and email links are stored only as one-way hashes, network addresses are stored only as keyed hashes, and only named staff accounts with a confirmed email can open the partner admin page. If a breach affects your data, we will tell you and the Data Protection Board of India as the law requires.
8. Your rights
You can ask us to:
- tell you what personal data we hold about you and who we shared it with;
- correct or update it (you can change your name, email and password yourself on your account page);
- delete it, unless the law requires us to keep it;
- withdraw your consent (this ends the account or partner membership it was for);
- name someone to act for you if you die or can't act yourself.
Email digitalpoonam21@gmail.com from the address on your account. We reply within 30 days. If you're not satisfied, contact our Grievance Officer below, and after that you may complain to the Data Protection Board of India.
9. Children
Oyyzo is for businesses and adults. Don't create an account or join the partner program if you are under 18.
10. Contact and Grievance Officer
Digital Poonam, Kool Homes, A 404, Dubey Colony, Mowa, Daldal Seoni, Raipur, Chhattisgarh 492002
Email: digitalpoonam21@gmail.com
Grievance Officer: Aanchal Tiwari (connect@oyyzo.com)
11. Changes
If we change this policy in a way that matters, we'll email account holders before it takes effect and update the date at the top.