Legal

Privacy policy

Version 0.1 (draft) · Last updated 23 October 2026

Draft. This text describes Setubandh as it runs today. It is a working draft and may change before it is final; the version and date above change with it.

This policy explains what personal data Setubandh handles, why, where it is kept, who else touches it, how long we keep it and what you can ask us to do with it. It is written to India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”).

1. Who we are

Setubandh is software for freight forwarders, run by Setubandh Labs (“Setubandh Labs”, “we”, “us”), whose registered office is at Indore, Madhya Pradesh, India. Our full company details are on the contact and company details page.

This policy covers:

this website, setubandh.co.in;
the Setubandh application — its company addresses (such as yourcompany.setubandh.co.in), its sign-in service and its test system at app.setubandh.co.in;
the e-mails the application sends, and e-mails you send us.

In this policy:

a company is a business that subscribes to Setubandh — usually a freight forwarder;
a user is a person who has a Setubandh login given by a company;
a company's customers are the shippers, consignees and others the company works for.

2. Two roles: when we decide, and when the company decides

Company data — the company decides. The bookings, shipments, containers, documents, invoices and the contact details of a company's customers that a company keeps in Setubandh belong to that company. For the personal data in it, the company is the Data Fiduciary under the DPDP Act and we are its Data Processor: we process it only to run Setubandh for the company, on its instructions, under our data processing addendum. If you are a company's customer and want to know what it holds about you, or want it corrected or erased, please ask that company. If you write to us instead, we pass your request to the company and help it answer.

Our own data — we decide. We are the Data Fiduciary for the personal data we use to run the service itself: users' account and sign-in data, the security records described below, and the e-mails people send us. The rest of this policy is mainly about this data.

No backdoor. Setubandh staff do not read a company's data. Our own administrator accounts carry no company's data and are refused on every company address. If a company wants our help with its data, it creates a user for us, which it can remove at any time.

3. The personal data we process

What	Examples	Where it comes from	Why we use it
Account data	Name, work e-mail address, company, roles and permissions. Your password is held by our sign-in service only as a salted hash, never in readable form.	Your company's administrator, when they create your user; you, when you set your password.	To let you sign in, show your colleagues who did what, and send account e-mails (set or reset your password).
Activity record	Which user created or changed a record and when; the history of assignments, workflow steps and document versions; actions the assistant took on your behalf, marked as such.	Created by Setubandh as you work.	The audit trail your company relies on to settle “who did what”, and the security of the service.
Sign-in and security data	Your active sign-in session, with the IP address and browser it came from; service logs that record a user identifier and the time of a request. Logs never contain passwords or sign-in tokens.	Created by Setubandh when you sign in and use it.	To keep you signed in, protect accounts, and find and fix faults.
Assistant messages	What you type to the assistant, and the text of a booking copy you give it to read.	You.	To answer your question or fill in a form for you to check. Conversations are held in memory for up to 30 minutes and are not stored after that.
Document approvals	When a company's customer approves a draft bill of lading through a link: the name they type, the time, their IP address and browser.	The person approving.	To keep the company's record of who approved which version (we process this for the company).
Enquiries	Your name, e-mail address and whatever you write to us.	You.	To reply, and to discuss Setubandh with you.

This website sets no cookies and runs no analytics, advertising or tracking. Your light/dark theme choice is kept only in your own browser. See cookies.

We do not sell personal data, use it for advertising, or use a company's data to train artificial-intelligence models.

4. Why we are allowed to process it

Under the DPDP Act we process personal data for a lawful purpose and on one of these grounds:

Consent — given freely for the purposes in this policy, for example when you set up your account and sign in. You can withdraw it at any time (section 7 below).
Legitimate uses allowed by section 7 of the DPDP Act — for example, where you have given us your data for a purpose (such as writing to us) and have not told us you do not consent to its use for that purpose, or where a law requires us to keep or disclose it.

For company data, the company decides the ground it relies on; we process that data on its instructions.

5. Where your data is kept

Setubandh's databases, documents and backups are kept in India, in Amazon Web Services' Asia Pacific (Mumbai) region (ap-south-1). The live system runs on its own server, separate from our test and development systems, which hold no company's real data.

Some processing happens outside India, and only for these purposes:

when you use the assistant, your message and the records it reads to answer are sent to our AI model provider in the United States to produce the answer;
e-mails sent to our @setubandh.co.in addresses pass through our domain and e-mail providers;
container and booking numbers a user chooses to track are sent to our tracking-data provider.

The DPDP Act allows transfers outside India except to countries the Government of India restricts; we will follow any such restriction.

6. Who else processes it

We use these service providers (“sub-processors”), each only for the purpose shown:

Category	Provider	What they handle	Location
Cloud hosting, storage, backups, encryption keys and secrets	Amazon Web Services	All data in Setubandh	India (Mumbai)
Sending e-mail (account e-mails, status reports, notices)	Amazon Web Services (Simple Email Service)	Recipient addresses and the e-mail's contents	India (Mumbai)
AI model for the assistant	Anthropic, PBC	Assistant messages and the records read to answer them	United States
Container tracking data	Shipsgo	Container, booking and bill-of-lading numbers and carrier codes — no personal data is needed	Outside India (the provider's own servers)
Domain name and forwarding of e-mail sent to us	Porkbun	E-mails sent to our addresses	United States
Our mailbox	Google (Gmail)	E-mails sent to our addresses	Google's data centres, which may be outside India

We tell companies before we add or replace a sub-processor that handles their data, as set out in the data processing addendum. We may also disclose personal data where an Indian law or a lawful order requires it.

7. How long we keep it

Company data — for as long as the company subscribes. When a subscription ends the company can export its data for 30 days; we then delete it. Deleted data leaves our routine backups as they expire: daily backups are kept 7 days, weekly backups 4 weeks, and the backup taken before each release is kept for the last five releases.
Account data — while your user is active. When your company removes your user, you can no longer sign in; your name stays in the activity record of the records you worked on for as long as the company keeps those records, because an audit trail must not be rewritten.
Sign-in sessions — until you sign out, after 2 hours without use, or after 24 hours at most.
Assistant conversations — in memory for up to 30 minutes; not stored.
Service logs — today, for the life of each version of the service (they are replaced when a new version is deployed). From 13 May 2027, when this obligation of the DPDP Rules applies, we will keep processing logs for one year and then delete them, unless a law requires longer.
Enquiries — 12 months.

We may keep data longer where an Indian law requires it (for example, tax records), and only for that purpose.

8. Your rights and how to use them

Under the DPDP Act you have the right to:

access a summary of the personal data we process about you and how we process it, and of whom we have shared it with;
correction, completion and updating of your personal data;
erasure of personal data we no longer need or no longer have a ground to keep;
grievance redressal — a complaint to us, answered by our Grievance Officer;
nominate another person to exercise these rights for you if you die or become unable to;
withdraw consent at any time, as easily as you gave it.

To use any of these, write to privacy@setubandh.co.in from the e-mail address you sign in with (or tell us that address), so that we can identify you. We answer as soon as we can and in any case within 90 days. Withdrawing consent does not affect processing done before it, and we may then no longer be able to give you an account. Many account details — your name, roles, or removing your user — can also be changed by your company's administrator.

If you are a company's customer, please send requests about the company's data to that company; we help it answer.

If you are not satisfied with our answer to a grievance, you may complain to the Data Protection Board of India once you have used our grievance process.

9. Grievance Officer

Name: Parinit Mishra
Designation: Founder
E-mail: grievance@setubandh.co.in
Address: Indore, Madhya Pradesh, India

This person also answers questions about how we process personal data.

10. How we protect it

Each company's data is separated by the database itself; data is encrypted in transit and at rest; access is limited and recorded; backups are taken daily. The security page explains this in plain words.

11. If something goes wrong

If a personal data breach affects data we are responsible for, we will tell the people affected without delay — what happened, when, how far it reached, its likely consequences, what we have done and what they can do — and who to contact. We will tell the Data Protection Board of India without delay and send it a full report within 72 hours, as the DPDP Rules require. If the breach affects company data, we tell the company without delay so that it can meet its own duties, and help it do so.

12. Children

Setubandh is a business service for adults. It is not meant for anyone under 18, and we do not knowingly process children's personal data. If we learn that we have, we will delete it.

13. Changes to this policy

When we change this policy we update the version and date at the top. If a change matters, we tell company administrators by e-mail 30 days before it applies.