Privacy policy

Who we are

Boita is operated by Aariko Systems (OPC) Private Limited, Workflo Icon Tower, Office No. 702, S. No. 114/5, 115/1, 114/6/3, Baner Road, Pune 411045, Maharashtra, India. For personal data you give us to open and run an account (name, email, company, billing details, usage records) Aariko Systems (OPC) Private Limited decides why and how it is processed and is the data fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act). For the files you store and send, and the details of the people you send them to, you are the data fiduciary and Aariko Systems (OPC) Private Limited is your data processor acting on your instructions; the Data processing summary describes that role.

What we collect and why

We collect only what each purpose needs:

• Account data: name, email, password hash, two-factor secrets, workspace name, role. Purpose: to create and secure your account.
• Billing data: company name, billing address, GSTIN or tax ID, plan, invoices. Card details are handled by our payment provider and never stored by us. Purpose: to bill you and issue invoices.
• Files and metadata: the files you upload, their names, sizes, checksums, folder paths, and who uploaded them. Purpose: to store and transfer them as you instruct.
• Share and portal data: recipient email addresses, link settings, views and downloads per recipient, uploader names on portals. Purpose: to deliver what you send and show you that it landed.
• Transfer and security logs: IP addresses, timestamps, device and app version, transfer events, logins, audit-log entries. Purpose: to run the service, detect abuse and meet CERT-In log-retention directions.
• Waitlist and contact data: what you type into the waitlist form or send to our mailboxes. Purpose: to reply to you about Boita access and pricing.

What we do not do

We do not sell personal data. We run no advertising and no tracking cookies, on this website or in the product. The only analytics anywhere is Umami on this marketing site: it counts page views without cookies, without any cross-site identifier and without storing anything on your device, and it is not present in the app at all. We do not read the contents of your files except when you ask for support and grant access, or when required by law; staff have no default access to file contents, and break-glass access is ticketed, approved by a second person, time-limited and recorded in your audit log.

Legal basis and consent

We process account, billing and log data because it is necessary to provide the service you asked for and to meet legal duties (tax, CERT-In). Where the DPDP Act requires consent, for example for a non-essential purpose, we ask for it separately, in plain language, and you can withdraw it as easily as you gave it. We do not process personal data of children knowingly; Boita is for businesses and adults.

Where data is stored

Boita is built and operated in India. During the pilot, file storage is in India. Account and billing systems, transactional email and the transfer control plane may use cloud infrastructure and sub-processors listed generically in the Data processing summary; a named sub-processor list is published before launch. Where a sub-processor is outside India we make sure the transfer is permitted under the DPDP Act and our contract with them.

How long we keep it

• Files: until you delete them, then in the trash for the recovery window, then purged by the retention worker. Share links expire per plan and can be extended.
• Account and billing data: for the life of the account and then as long as tax and company law require (typically eight years for invoices in India).
• Security and transfer logs: 180 days in India in line with CERT-In directions, unless an investigation requires longer.
• Waitlist entries: until you ask us to delete them or twelve months after launch, whichever is sooner.

Your rights

You can ask for a copy of your personal data, ask us to correct it, ask us to delete it, withdraw consent where consent was the basis, and nominate someone to exercise these rights for you. Write to hello@boita.io. We reply within 30 days. If you are unhappy with our reply you can complain to our grievance officer (below) and then to the Data Protection Board of India.

Grievance officer

Snehal Pawar, Grievance Officer, grievance@boita.io, Workflo Icon Tower, Office No. 702, S. No. 114/5, 115/1, 114/6/3, Baner Road, Pune 411045, Maharashtra, India. Write with your account email and what happened; grievances are acknowledged within 48 hours and resolved within 30 days, as the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines) Rules require.

Security

Transfers are encrypted in transit, files are encrypted at rest with a key per workspace, each workspace has its own storage root, two-factor authentication is available to everyone and mandatory for our staff, and a written security programme governs how we operate. The Security page says what is live, in progress and planned. If we suffer a breach that affects you we will tell you and the authorities as the DPDP Act and CERT-In directions require.

Changes and contact

We will post changes here with a new "last updated" date and email account owners about material changes. Questions: hello@boita.io. Post: Aariko Systems (OPC) Private Limited, Workflo Icon Tower, Office No. 702, S. No. 114/5, 115/1, 114/6/3, Baner Road, Pune 411045, Maharashtra, India. This policy is governed by the laws of India; the courts at Pune have exclusive jurisdiction.