Legal
Privacy policy
What personal data this website collects, why, how long we keep it and how to exercise your rights under India's DPDP Act.
Last updated 2 October 2026
Who we are
This website is run by Suscin Innovation Labs (“GRC-Flow”, “we”), [Registered office address], Pune, Maharashtra, India. CIN [CIN], GSTIN [GSTIN].
For the personal data described here we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”). Questions about your data go to talk@grc-flow.com.
What we collect
We collect only what we need, and most of the site works without giving us anything.
- Demo requests: your name and work email (required), and optionally your company, your role, the plan you're interested in and a message. We also record that you confirmed you're 18 or older, your consent, and whether you asked for product updates.
- Privacy requests and unsubscribes: your name, email and what you're asking for, so we can act on it and keep a record that we did.
- Your cookie choice: stored in a cookie on your device. See the cookie policy.
- Server logs: our hosting provider records IP address, browser type, page requested and time, to keep the site running and secure.
We don't use analytics, advertising or tracking tools, and we don't buy or receive data about you from others. The live demo uses invented sample data. Please don't enter real personal data into it.
Why we use it
| Purpose | Data | Basis |
|---|---|---|
| Arrange and run your demo | Demo request details | Your consent (Section 6) |
| Send product updates, if you ask for them | Name, email | Your consent, which you can withdraw any time |
| Handle privacy requests and unsubscribes | Request details | Complying with the law (Section 7) |
| Keep the site secure and working | Server logs, cookie choice | Complying with the law, including the DPDP Rules' log requirements (Section 7) |
How long we keep it
- Demo requests: 12 months after our last contact, unless you become a customer.
- Product update list: until you unsubscribe or withdraw consent.
- Privacy requests: 3 years, to show we handled them.
- Server logs: 1 year.
- Cookie choice: 6 months, then we ask again.
Where it's stored
We store personal data in India. If that ever changes, we'll update this policy and transfer data only to countries the Government of India hasn't restricted under Section 16.
Your rights
Under the DPDP Act you can:
- get a summary of the personal data we hold about you and who we've shared it with (Section 11)
- have it corrected, completed, updated or erased (Section 12)
- withdraw consent at any time, as easily as you gave it (Section 6(4))
- have a grievance addressed (Section 13)
- nominate someone to exercise these rights if you die or can't (Section 14)
Use the data rights request form or email talk@grc-flow.com. We'll confirm who you are, then respond as soon as we can and within 90 days. If you're not satisfied, you can complain to the Data Protection Board of India once you've used our grievance process.
Children
This site and our product are for businesses and aren't meant for anyone under 18. We don't knowingly collect data from children, and the demo request form asks you to confirm you're 18 or older. If we learn we've collected a child's data, we'll delete it. Parents or guardians can contact us to ask for this.
Security and breaches
We protect the site with HTTPS and limit access to personal data to the people who need it. If a personal data breach happens, we'll inform the Data Protection Board and the people affected, as the DPDP Act and Rules require.
Grievance Officer
[Grievance Officer name], talk@grc-flow.com, [Registered office address], Pune, Maharashtra, India.
Changes to this policy
If we change how we use personal data, we'll update this page and its date. If a change needs fresh consent, we'll ask for it before it applies.