MSMENXT MICRO Privacy Policy

1. Who is responsible

Zertical Private Limited is the Data Fiduciary for account, authentication, security, subscription, support and legal-administration data. For business content entered by a customer company, that company determines the purpose and means of processing and Zertical Private Limited acts as its processor under the Data Processing Addendum.

2. Personal data we process

• Username, company, role, account status, email when supplied, salted password hash, sign-in times and versioned legal acceptance.
• Session, request, security-event, hashed IP and hashed browser/device evidence.
• Business records entered by authorised company users, including billing, purchasing, stock, customer and supplier records.
• Reports, exports, support, grievance and lifecycle requests.
• When an authorised user chooses document reading: the selected PDF or image, text recognised in that user’s browser, corrected template values, and review evidence.

We do not store plaintext passwords. MSMENXT MICRO does not provide or use generative AI and does not sell personal data.

3. Purposes

We process the minimum data reasonably required to authenticate users, enforce tenant isolation and purchased seats, provide billing and inventory functions, create requested reports, preserve security evidence, provide support, prevent misuse, recover service, administer subscriptions, and meet legal obligations.

4. Sources and sharing

Data comes from the individual, their authorised company, and technical requests made to the service. Access is restricted to the customer company and authorised operational personnel. Infrastructure providers are listed in the Subprocessor Register. We may disclose data where law requires it.

5. Security and retention

Controls include salted password hashing with a server-side secret, one active session per user, an eight-hour absolute session limit, three-minute unexpected-closure recovery, server-side company routing, private object storage and security-relevant audit metadata. See Retention and Security for current lifecycle details and the pre-production archive limitation.

6. Your rights

Subject to applicable law, a person may ask for an access summary, correction, erasure, grievance resolution, withdrawal of consent, or nomination. Send the request to the Grievance Officer using the contact below. Withdrawing consent is as easy as sending that request, but it may require closure of the affected account where processing is necessary to provide the service.

7. Complaints and changes

We first provide an internal grievance route. A person may also use the statutory complaint route when available under applicable law. Material policy changes receive a new version and require fresh sign-in acceptance when appropriate.