Privacy
Policy

This Privacy Policy is issued by PRAGMASYSTEMS (OPC) PRIVATE LIMITED (hereinafter referred to as “Pragma Systems”, “the Company”, “we”, “us”, or “our”). We are committed to upholding the highest standards of data confidentiality, informational sovereignty, and transparent governance in accordance with the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000, and allied regulations in the Republic of India.

This Policy applies to our website (pragmasystems.in), our client-facing portal architectures, autonomous software agent solutions, WhatsApp automation workflows (including ConnectFlow CRM), FinOps invoice processing engines, and enterprise AI integrations.

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), the legal relationship and responsibilities regarding personal data depend upon the specific operational context in which data is processed:

In delivering autonomous workflow orchestration and software engineering solutions, we process the following categories of information:

• Direct Business Inquiries: Full name, official corporate email address, contact telephone / WhatsApp number, company name, industry sector, operational requirements, and project scope details submitted via our contact and consultation request forms.
• WhatsApp Automation & Conversational Records (ConnectFlow CRM): Customer phone numbers, sender profiles, incoming inquiry text, automated routing tags, timestamp logs, interactive menu selections, and resolution statuses processed via the WhatsApp Business API (WABA) and authorized Business Solution Providers (BSPs).
• Financial Operations (FinOps) & Invoice Metadata: Vendor names, Goods and Services Tax Identification Numbers (GSTIN), invoice numbers, dates, line-item descriptions, Harmonized System of Nomenclature (HSN) codes, invoice amounts, tax breakdowns, and Purchase Order (PO) matching parameters ingested for automated accounting synchronization with systems such as Tally, SAP, and Zoho Books.
• Workflow Pipeline Payloads: Webhook signals, API payloads, form submissions, and structured transaction data orchestrated across enterprise software ecosystems using self-hosted middleware (n8n).
• Enterprise Knowledge Bases & Vector Embeddings (RAG Systems): Client-provided standard operating procedures (SOPs), manuals, compliance checklists, and corporate documentation converted into high-dimensional numerical vectors (stored in pgvector / Pinecone) solely for semantic document retrieval by private enterprise chatbots.
• Technical Telemetry & Server Logs: Internet Protocol (IP) addresses, browser type, operating system version, referring URL, time stamp, device identifiers, and session metrics collected automatically to maintain server security, load balancing, and diagnostic health.

Our AI implementation architecture is founded upon rigorous operational guardrails:

• Model-Agnostic Enterprise Architecture: We interface exclusively with enterprise-tier API endpoints featuring contractual zero-data-retention (ZDR) guarantees. Text sent to inference APIs is processed ephemeral-in-memory to generate responses and is not retained for model improvement.
• Indian Data Localization & Self-Hosting: In accordance with the data sovereignty principles of the DPDP Act 2023, our primary automation middleware (n8n) and application databases are self-hosted on dedicated private cloud servers situated within Indian geographical boundaries (e.g., AWS Asia Pacific / Mumbai region or DigitalOcean Bangalore).
• Human-in-the-Loop (HITL) Safeguards: High-stakes automated operations—including financial approvals, purchase orders exceeding predefined monetary thresholds, and regulatory GST filings—mandate human managerial verification prior to execution, mitigating automated liabilities and generative hallucinations.
• Isolated Vector Stores: Knowledge retrieval indices created for clients are segregated into isolated tenant namespaces, ensuring cross-client data contamination is mathematically impossible.

We process personal data only when grounded in a lawful basis under the DPDP Act, 2023:

We do not sell, rent, commercialize, or trade personal data to any third party under any circumstances.

To deliver high-availability cloud automation and enterprise connectivity, we engage vetted sub-processors that comply with industry-standard security certifications (ISO 27001, SOC 2 Type II) and data processing agreements:

• Cloud Infrastructure: Amazon Web Services (AWS) India (Mumbai Region) for hosting core application servers, isolated microservices, and self-hosted n8n automation clusters.
• Database & Storage: Supabase / PostgreSQL (with pgvector extension) for secure relational metadata and vector embedding storage.
• Messaging & Telephony Gateways: Meta Platforms Inc. (WhatsApp Cloud API) and authorized WhatsApp Business Solution Providers (e.g., Gupshup, WATI) for message transit.
• Enterprise AI Inference Engines: OpenAI, LLC and Anthropic, PBC under enterprise API agreements with explicit zero-data-retention and zero-model-training terms.
• Statutory Authorities: Law enforcement, judicial bodies, or tax regulators (such as the Goods and Services Tax Network - GSTN) only when strictly mandated by enforceable Indian legal orders.

In compliance with Section 8(5) of the DPDP Act 2023 and Rule 5(8) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, we implement technical, administrative, and physical safeguards:

Personal data is retained only for the duration required to satisfy the specified operational purposes, fulfill contractual obligations, or comply with statutory retention mandates:

• Prospective Client Inquiries: Retained for a maximum of twenty-four (24) months from the last documented communication, after which records are anonymized or permanently deleted.
• Enterprise Contractual & Operational Logs: Retained throughout the active term of the client agreement. Upon contract termination or client request, operational logs and vector database embeddings are cryptographically purged within thirty (30) business days.
• Accounting, Invoicing & Tax Records: In compliance with the Companies Act, 2013 and GST regulations, financial invoices, purchase orders, and transaction ledgers are retained for a statutory period of eight (8) financial years.

Under Chapter III of the DPDP Act, 2023, individuals whose personal data is processed by Pragma Systems in its capacity as a Data Fiduciary are entitled to exercise the following statutory rights:

• Right to Access Information (Section 11): You have the right to obtain a summary of your personal data being processed, the identities of all third parties with whom such data has been shared, and any other relevant processing details.
• Right to Correction & Erasure (Section 12): You may request the correction of inaccurate data, the completion of incomplete data, or the erasure of your personal data when it is no longer necessary for the purpose for which it was collected.
• Right to Grievance Redressal (Section 13): You have the right to register a grievance with our designated Grievance Officer regarding any matter pertaining to the processing of your personal data.
• Right to Nominate (Section 14): You have the right to nominate an individual who shall, in the event of your death or incapacity, exercise your data rights in accordance with the law.

To exercise any of these rights, please submit a written notice to our Grievance Officer at info@pragmasystems.in with verified identity credentials. Where Pragma Systems processes your data strictly on behalf of an enterprise client (as a Data Processor), your request will be transmitted directly to the respective client as the Data Fiduciary.

Our website utilizes minimal tracking technologies:

• Essential Local Storage: We use the browser’s native localStorage API to store your visual theme preference (darkMode: 'enabled' / 'disabled') to ensure consistent user experience across sessions without tracking your browsing history.
• Operational Session Cookies: We utilize temporary session cookies solely to preserve site navigation state and secure form submissions.
• Third-Party Analytics: We do not deploy invasive third-party cross-site marketing trackers. You can configure your browser to reject cookies, which will not impede your ability to browse the core content of our website.

In compliance with Section 13 of the Digital Personal Data Protection Act, 2023 and Rule 5(9) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the details of the designated Grievance Redressal Officer for PRAGMASYSTEMS (OPC) PRIVATE LIMITED are set forth below:

If you remain dissatisfied with the resolution provided by our Grievance Officer, you have the right under the DPDP Act 2023 to register a complaint with the Data Protection Board of India (DPBI).

PRAGMASYSTEMS (OPC) PRIVATE LIMITED reserves the right to amend this Privacy Policy periodically to reflect technological advancements, evolving enterprise service offerings, or amendments to statutory regulations. The revised document will be published on this URL with an updated “Effective Date”. We encourage users and clients to periodically review this page.

Last Updated & Effective Date: 11th July 2026 (Operational update: October 2026).