Privacy Policy

TurtleCanvas (turtlecanvas.design) is operated by Turtle Techsai, 74/15 Nehru Nagar (East), Durg, Chhattisgarh 490020, India. For personal data about you as a user, we are the data fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and responsible under the Information Technology Act, 2000 and its rules. This policy explains what we collect, why, who we share it with, and your rights.

Account and billing

Name, email address, password (stored only as a secure hash) or sign-in through Google, and, when you pay, billing name, address and GSTIN for your tax invoice.

Payments

Razorpay processes payments. We receive the payment status, amount, plan and a transaction reference — never your full card, bank account or UPI details.

Content you upload or import

Product photos, logos, brand colours and details, product information, instructions, and the designs, captions and plans made from them. When you import a website, we read its public pages to collect the brand’s logo, colours, description and product images.

Your clients’ responses

When your client uses a review link, we record their approvals and any notes they write.

Find clients

Business names, websites, public contact details (such as a phone number or email address published on a website or maps listing), addresses, ratings and public social media profiles, gathered from search results and the businesses’ own websites.

Messaging channels

If you connect WhatsApp, Telegram, Discord or Slack, the identifier of that account and the messages and images you send to our bot.

Usage and device data

IP address, browser and device type, pages and features used, and error logs. With your consent we use Google Analytics and Microsoft Clarity, which record how pages are used (Clarity can record anonymised on-screen sessions). See our Cookie Notice.

Messages to us

What you write when you email us or fill a form.

• To create and run your account and provide the Service you asked for, including producing designs with AI providers.
• To take payments, issue GST invoices and keep accounting records the law requires.
• To send service messages — password resets, receipts, security and policy notices.
• To send product news and offers, only if you agree; you can opt out at any time.
• To keep the Service secure, prevent fraud and abuse, and fix problems.
• To understand usage and improve the Service, using aggregated data where we can.
• To comply with the law and respond to lawful requests from authorities.

We process your personal data on the basis of your consent, which you give when you sign up and which you can withdraw at any time, and for the legitimate uses the DPDP Act allows, such as providing a service you asked for and meeting legal obligations.

When an agency uploads content about its clients — photos, logos, product details, or the names and notes of people who approve posts — the agency decides what is uploaded and why, and is responsible for having the right to share it. We process that data on the agency’s behalf and only to provide the Service. Our Data Processing Addendum sets out these terms.

Find clients and website import use information that businesses and their owners have made publicly available — on their websites, maps listings and public profiles. Personal data made public by the person it concerns falls outside most obligations of the DPDP Act, but we still use it only to help users find and pitch businesses, keep it no longer than needed, and remove it on request. To have your business’s information or a sample made for it removed, email contact@turtletechsai.com.

We do not sell personal data or share it with advertisers. We share it only with:

• Service providers who run the Service for us under contract — hosting and storage (Microsoft Azure), AI models (Azure OpenAI, OpenAI, providers reached through OpenRouter, and fal.ai for image processing), payments (Razorpay), email (Resend), web search (Serper), stock images (Unsplash), messaging (Meta WhatsApp, Telegram, Discord, Slack) and analytics (Google Analytics, Microsoft Clarity). The full list is on our Subprocessors page.
• Your clients, when you share a review link or delivery pack with them.
• Authorities, when the law requires it or to protect rights, safety and the Service.
• A buyer or successor, if our business is transferred, under the same protections.

Our servers are hosted by Microsoft Azure in the United States, and some AI providers process content in the United States and Europe. We transfer personal data outside India only to countries not restricted by the Government of India, and our providers are bound to protect it.

When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to India or the United States, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum or Swiss amendments where they apply), or on a provider’s certification under the EU-US, UK or Swiss Data Privacy Framework. For data from the UAE, Singapore, Malaysia, the Philippines and Australia, we transfer it only under contracts that require the recipient to protect it to a comparable standard. You can ask us for a copy of the relevant safeguards.

• Account data and content: while your account is open. When you delete your account, we erase it within 30 days, except what we must keep by law.
• Invoices and payment records: as long as tax and accounting law requires (currently at least six years).
• Find clients information: until you delete it, or earlier on the business’s request.
• Logs and security records: up to 180 days, unless needed to investigate an incident.
• Aggregated statistics that identify no one may be kept longer.

We use encryption in transit (TLS), access controls, private storage for uploaded product photos with short-lived signed links, hashed passwords and regular reviews. No system is perfectly secure; if a breach affects your personal data, we will inform you and the Data Protection Board of India as the law requires.

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and how we use it;
• ask us to correct, complete or update it;
• ask us to erase it, unless the law requires us to keep it;
• withdraw your consent at any time — this does not affect processing already done;
• nominate another person to exercise your rights if you die or become unable to;
• have your grievance resolved by our Grievance Officer, and if you are not satisfied, complain to the Data Protection Board of India.

European Economic Area and United Kingdom. Under the GDPR and the UK GDPR we are the controller of your account data and a processor of your clients’ data (see section 4). We rely on these lawful bases: performing our contract with you (running your account, generating designs, billing); our legitimate interests (keeping the Service secure, preventing abuse, improving it, and telling existing customers about similar features, which you can opt out of at any time); legal obligation (tax and accounting records); and your consent (optional cookies and marketing email, which you can withdraw). You can access, correct, erase, restrict or object to processing, take your data with you, and complain to your local supervisory authority — in the UK, the Information Commissioner’s Office. We do not make decisions about you with legal or similarly significant effects by automated means alone.

United Arab Emirates and the Gulf. Where the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the Saudi Personal Data Protection Law or a similar law applies, you have the rights it gives, including access, correction, erasure and objection, and we handle cross-border transfers as it requires.

Singapore, Malaysia and the Philippines. Where Singapore’s Personal Data Protection Act 2012, Malaysia’s Personal Data Protection Act 2010 or the Philippine Data Privacy Act of 2012 applies, you can access and correct your personal data and withdraw consent, and we protect data transferred out of your country to a comparable standard.

Australia. We handle personal information consistently with the Australian Privacy Principles. You can access and correct it, and complain to us and then to the Office of the Australian Information Commissioner.

United States. If you live in California or another state with a consumer privacy law, you can ask what we collect, ask us to correct or delete it, and appeal a refusal. We do not sell personal information and do not share it for cross-context behavioural advertising.

To use any of these rights, wherever you are, email contact@turtletechsai.com. We may need to verify who you are first, and we reply within the time your law allows — within one month under the GDPR.

The Service is for people aged 18 and over. We do not knowingly collect personal data from children; if we learn we have, we delete it.

We use essential cookies to keep you signed in and, with your consent, analytics cookies. You can change your choice at any time. See our Cookie Notice.

We will post changes here with a new date, and tell you by email or in the app before material changes take effect.

If you have a complaint about the Service, a payment, or how we handle your personal data, write to our Grievance Officer. We acknowledge every complaint within 48 hours and resolve it within one month of receiving it.

Akshay Gupta, Grievance Officer
Turtle Techsai, 74/15 Nehru Nagar (East), Durg, Chhattisgarh 490020, India
Email: contact@turtletechsai.com
Phone: +91 78418 53298

Turtle Techsai (Sole proprietorship), operator of TurtleCanvas

74/15 Nehru Nagar (East), Durg, Chhattisgarh 490020, India

GSTIN: 22ADEPG5633L1ZP

Email: contact@turtletechsai.com

Phone: +91 78418 53298 (Monday to Friday, 10:00–18:00 IST)