How we protect data

Encryption in transit. The site and the API are served over HTTPS.
Passwords are stored as salted hashes. We cannot read your password.
Sessions use an HttpOnly, Secure, SameSite cookie, so scripts on a page cannot read it.
Mill separation. Every record belongs to one mill, and every request is checked against the mill of the signed-in user.
Roles. Owner, admin, manager, accountant, gate operator, production operator and viewer see only what their role needs. Money figures are hidden from roles that do not handle them.
Audit trail. Important changes are recorded with who and when, and the database refuses edits to the audit log.
Protected records. Invoices, payments and stock history cannot be hard-deleted, so a mistake or a bad actor cannot erase your history. When an account is closed these records are kept with personal details removed.
Bot and abuse controls. A bot check and rate limits protect sign-up, login and password reset.
Tally Sync tokens are stored as one-way hashes and can be revoked by the owner.

Service providers (sub-processors)

Provider	What for	Data involved
Cloudflare	Hosting, database, file storage, bot check, delivery network	Everything stored in the service; IP addresses
Resend	Sending password-reset, verification and invitation emails	Recipient email address and the message
Google (Gemini)	Optional in-app AI assistant	Your question and, when needed, stock item names and quantities
Google (Analytics, Fonts)	Visit counts on public pages, only if you accept; web fonts	Page visits and browser details; font requests
Razorpay	Online payments, only when paid plans exist	Payment details go directly to Razorpay; we receive the status

We will update this list when it changes.

Your control of your data

Export. The mill owner can download all the mill's data as a file from Settings, and many lists also export to CSV or Excel. Tally and GST exports are available too.
Correction. Edit records in the app, or ask us to fix personal data at connect@equaseed.com.
Deletion. The mill owner can close the account in Settings under Your data. There is a 14-day waiting period in which it can be cancelled; after it, personal data is deleted or irreversibly anonymised, except records the law requires us to keep. Any remaining paid plan time is not refunded. Staff and other individuals can ask us at connect@equaseed.com.

What we cannot promise

No online service is risk-free. Use a strong, unique password, give each person their own login with the lowest role that works, remove people who leave, and export regularly. Read how we handle a breach in the Privacy Policy.

Report a problem

Spotted something? Email connect@equaseed.com with "Security" in the subject. See Contact.

Security and data handling

How we protect data

Service providers (sub-processors)

Your control of your data

What we cannot promise

Report a problem