1. Commitment to Privacy & Legal Framework

Simb Technologies, operating under its registered trade name Otbix Systems ("Company", "we", "us", or "our"), is committed to safeguarding the privacy and confidentiality of personal data and business information entrusted to us.

This Privacy Policy describes how we collect, store, process, protect, and handle data when you visit www.otbix.com, engage our AI automation services, or communicate with us across digital channels. This policy is formulated in compliance with:

• The Digital Personal Data Protection Act, 2023 (DPDP Act);
• The Information Technology Act, 2000 (IT Act), including Section 43A;
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules).

2. Categories of Information Collected

Depending on how you interact with Otbix Systems, we may collect the following types of information:

3. Purpose of Processing & Lawful Grounds

We process personal and business data only for specified, lawful business purposes:

• To evaluate your business processes and provide tailored AI Workflow Audit recommendations.
• To engineer, deploy, host, and maintain custom AI Employees as per service contracts.
• To generate GST-compliant invoices and facilitate payment processing via Razorpay.
• To monitor system uptime, identify API errors, and maintain cybersecurity defense.
• To comply with statutory legal and tax obligations under Indian law.

4. Third-Party Service Providers

We partner only with reputable, SOC-2/ISO compliant infrastructure and technology providers under strict confidentiality agreements:

• Payment Gateways: Razorpay Software Private Limited for processing UPI, debit/credit cards, and Net Banking. Payment credentials are handled directly by Razorpay under RBI guidelines; Otbix Systems never stores your card CVV or net banking passwords.
• Messaging Infrastructure: Meta Cloud API for WhatsApp Business messaging dispatch and receipt.
• Cloud Infrastructure: Enterprise cloud hosts located in secure tier-3/4 data centers.

5. Reasonable Security Practices & Retention

In compliance with Rule 8 of the SPDI Rules 2011, we implement comprehensive technical, operational, and physical security measures, including TLS 1.3 encryption in transit, AES-256 encryption at rest, token-based API authentication, and restricted role-based internal access.

Data is retained only for as long as necessary to fulfill the operational contract, satisfy GST recordkeeping requirements (minimum 6 years for financial records as per Indian tax statutes), or until a valid data erasure request is received.

6. Your Rights Under Indian Data Privacy Law

Under the Digital Personal Data Protection Act, 2023, you are entitled to:

• The right to access a summary of personal data being processed by us.
• The right to correct, complete, or update inaccurate personal data.
• The right to request erasure of your data, subject to statutory tax and financial retention laws.
• The right of grievance redressal regarding data handling practices.