LEGAL
Privacy Policy
1. Who we are
This Privacy Policy explains how S29PATTERN PRIVATE LIMITED ("SEVENTEEN29", "we", "us", "our") collects, uses, stores and protects personal data when you use seventeen29.in, our free online tools, and the SEVENTEEN29 platform (together, the "Services").
We are a company incorporated in India with CIN U58201PN2026PTC257471 and registered office at House A74, Sr No 56/1/6, Lane No 1, Kawade Nagar, Pimple Gurav, Haveli, Pune – 411061, Maharashtra, India.
For personal data of website visitors, free-tool users and account holders, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025. This policy is also published under Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
Where we rely on your consent, we ask for it separately at the point of collection. You can withdraw it at any time (see Section 9).
2. Personal data we collect
We collect only what we need to provide the Services.
| Category | What we collect | When |
|---|---|---|
| Contact and enquiry data | Name, work email, phone number, company name, designation | Demo requests, contact forms, sign-ups |
| Account data | Login email, password (stored hashed), role, invited team members | When you or your company create an account |
| Free tool data | Label artwork you upload, data extracted from it (ingredients, nutrition values, claims, allergens), number of uses, email if you register | When you use our free compliance check or nutrition table tools |
| Platform content | Artwork and design files, lab reports, product formulations, nutrition data, comments, approvals | When your company uses the paid platform |
| Billing data | Billing contact, GSTIN, billing address, invoices | When you buy a plan |
| Technical data | IP address, browser and device type, pages visited, timestamps, log data, cookie identifiers | Automatically, when you use the Services |
Payments are processed by [Payment gateway, e.g. Razorpay]. We do not receive or store your card, UPI or bank account details.
Platform content is mainly business information. It may include personal data such as the names of your team members or approvers.
3. How we use your data and why
We process personal data on the basis of your consent (Section 6, DPDP Act) or for a legitimate use permitted by Section 7, such as data you voluntarily provide for a specific purpose or processing required by law.
| Purpose | Legal basis |
|---|---|
| Provide the Services: run compliance checks, generate reports, nutrition tables and design outputs | Consent / voluntarily provided for this purpose |
| Create and manage accounts, authenticate users | Consent / voluntarily provided |
| Respond to enquiries and demo requests | Voluntarily provided for this purpose |
| Billing, invoicing and tax compliance | Legal obligation |
| Improve our tools using data extracted from free-tool uploads, in de-identified form | Consent, asked for separately at upload |
| Send product updates and marketing emails | Consent; unsubscribe at any time |
| Security, fraud prevention, CERT-In and other legal requirements | Legal obligation / legitimate use |
We do not sell personal data. We do not use paid customers' platform content to improve tools for anyone else without that customer's written agreement.
If you withdraw consent, we stop the related processing within a reasonable time. Processing done before withdrawal stays lawful. Some Services may stop working without the data they need.
4. Your artwork and business content
We treat artwork, formulations, lab reports and nutrition data you upload as confidential business information.
- Paid platform customers: your company decides what content is uploaded and why. For personal data inside that content, your company is the Data Fiduciary and we act as its Data Processor, following your instructions under our agreement and Data Processing Agreement.
- Free tools: we store the data extracted from your upload. [We do not keep the original file / We keep the original file for up to X months.] With your consent, we use this data in de-identified form to improve how our tools read labels.
- Access: only authorised SEVENTEEN29 staff can access your content, and only to provide support or fix issues, or when you ask us to.
- No resale: we never sell your content or share it with your competitors or other customers.
5. Cookies and analytics
We use a small number of cookies and similar technologies.
| Type | Purpose | Can you turn it off? |
|---|---|---|
| Essential | Keep you logged in, remember free-tool usage, protect against misuse | No, the Services need them |
| Analytics | Understand which pages and features are used, via [Google Analytics / tool name] | Yes, through our cookie banner |
| Preferences | Remember your settings | Yes |
You can change your choice at any time through the cookie settings link in our footer, or by clearing cookies in your browser.
6. Who we share data with and where it is stored
We share personal data only with service providers who help us run the Services, under contracts that require them to protect it.
| Provider | Purpose | Data location |
|---|---|---|
| Amazon Web Services | Application hosting | India (Mumbai region) |
| Supabase | Database and file storage | India (Mumbai region) |
| [Payment gateway] | Payment processing | India |
| [Email provider] | Transactional and marketing email | [Location] |
| [Analytics provider] | Website analytics | [Location] |
We may also disclose personal data:
- to government authorities, courts or regulators when required by law;
- to protect our rights, users or the public from fraud or security threats;
- to a buyer or successor if our business is merged or sold, under the same protections.
We store your data primarily in India. If any provider processes it outside India, we do so only to countries not restricted by the Central Government under Section 16 of the DPDP Act.
7. How long we keep data
We keep personal data only as long as its purpose needs, or as the law requires, and then delete or anonymise it.
| Data | Retention period |
|---|---|
| Enquiry and lead data | [24] months after our last contact |
| Account data | While the account is active, plus [90] days after closure |
| Platform content | As set in your agreement; by default 18 months, including version history, then deleted or returned to you |
| Free tool data | [12] months from upload |
| Billing and invoice records | 8 years, as required by tax and company law |
| Security and system logs | At least 180 days, as required by CERT-In directions |
8. Security and breach notification
We use reasonable security practices to protect personal data, including:
- encryption in transit (TLS) and at rest;
- role-based access, so each user sees only what their role needs;
- access logging and monitoring;
- regular backups;
- security checks on the providers we use.
No system is fully secure. If a personal data breach occurs, we will inform affected users and the Data Protection Board of India as required by the DPDP Rules, 2025, and report to CERT-In within 6 hours where its directions require. We will tell you what happened, the likely impact, and the steps we are taking.
9. Your rights
Under the DPDP Act, you have the right to:
- get a summary of the personal data we hold about you and how we use it;
- correct, complete or update inaccurate data;
- have your data erased when it is no longer needed, unless the law requires us to keep it;
- withdraw consent as easily as you gave it;
- have your grievances addressed;
- nominate a person to exercise these rights if you die or become incapable.
To use any of these rights, email [privacy@seventeen29.in] or use your account settings. We may ask you to verify your identity. We will respond within 30 days.
If you are not satisfied with our response, you may complain to the Data Protection Board of India after using our grievance process.
If your data is part of a paid customer's platform content, please contact that company first. We will help them respond to you.
10. Children, changes and contact
Children. The Services are for businesses and are not meant for anyone under 18. We do not knowingly collect children's personal data. If you believe we have, contact us and we will delete it.
Changes. We may update this policy. We will change the "Last updated" date and, for significant changes, notify account holders by email before they take effect.
For questions about this Privacy Policy, contact us at support@seventeen29.in.