Privacy Policy

Effective date: 24 September 2026

This policy explains what Business Monitor collects, why, who else handles it, how long we keep it and the rights you have. Business Monitor is operated by Business Excellence Empire (“we”, “us”). It is a business tool: a company (“the customer”) signs up, adds its own people, and uses Business Monitor to assign tasks and follow them up. For the business data a customer enters, the customer decides what goes in and we process it on their behalf. For account, security and usage data, we act as the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).

1. Data we collect

• Account data: name, email address, phone number (if given) and the role your company gave you. Passwords are stored only as a one-way hash, never in readable form.
• Business data you enter: tasks, their descriptions, due dates and times, notes, status and revision history, and the people tasks are assigned to (“doers”: name, email and phone number).
• Communications metadata: for each WhatsApp message or email we send about a task, whether it was sent, delivered or failed, and when. When a doer marks a task done from a message or link, we record that action.
• Usage and security logs: each sign-in (the time and the method: password, Diamond Arena or single sign-on) and an audit log of administrative changes such as adding users, changing roles or settings. We do not store your IP address with a sign-in.
• Cookies and browser storage: only what the service needs to work: a session cookie that keeps you signed in; short-lived security cookies set by our sign-in system; a sign-in prefill cookie (10 minutes) when you arrive from Diamond Arena; and a state cookie (10 minutes) while a company connects a Google account. Your browser’s local storage remembers display choices, such as your default task view. We use no advertising or analytics cookies and no third-party trackers.

2. How we use it

• To deliver tasks and reminders to doers by WhatsApp and email, and to record when a task is done.
• To show dashboards and performance views.
• To sign you in, enforce the roles your company set, protect accounts and investigate misuse.
• To answer support requests and meet legal obligations.

We do not sell personal data, use it for advertising, or use it to train AI models.

3. Service providers

We share data only with providers that help us run Business Monitor, and only what each needs:

• Vercel: hosting (Singapore region).
• Neon: database (Singapore region).
• AiSensy and WhatsApp (Meta): sending WhatsApp messages to doers.
• Optyflo: sending email.
• Google: only if a company connects Gmail (to send email).
• Diamond Arena: our sign-in partner, if your company signs in through it.

Data may be processed outside India (for example in Singapore), as the DPDP Act permits, except where the Government of India restricts transfer to a country.

4. Google user data (Limited Use)

Business Monitor’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Gmail (gmail.send): Business Monitor only sends emails on your behalf (task and reminder emails your company set up). It never reads, stores or shares the content of your mailbox. We keep only the connected Google account’s email address and the access token.
• Tokens are encrypted at rest (AES-256-GCM). Google data is used only to provide these features, is never transferred to others except as needed to provide them, for security or by law, is never used for advertising, and is never read by people except with your consent, for security, or where the law requires.
• You can revoke access at any time: Disconnect in Business Monitor Settings (we also revoke the token with Google), or from your Google Account’s third-party access page.

5. How long we keep it

• Tasks: until the customer deletes them (in Business Monitor). A deleted task is removed with its history and delivery records.
• Doers: until the customer deletes them; tasks they had stay, without the link to them.
• User accounts: deactivating a user blocks sign-in but keeps the account so past records stay accurate. We delete it on request (see section 7).
• Sign-in records: 180 days. Other audit records (administrative changes) are kept for the life of the customer’s account, for security and accountability.
• Message delivery records (whether a WhatsApp or email was sent or failed): 1 year.
• Task links sent to doers: valid for 30 days, then deleted about 30 days later.
• Login-attempt counters (an email address or IP address, used only to block repeated password guessing): 2 days.
• Google tokens: stop being used when disconnected; deleted with the customer’s account or on request.
• Short-lived sign-in data (setup links, Diamond Arena handoffs, cookies above) expires in minutes to days.
• When a customer leaves: on written request we delete the organisation and all its data. Backups kept by our database provider roll off on their own schedule.

6. Security

• All traffic uses HTTPS.
• Secrets such as Google tokens are encrypted at rest; passwords are hashed.
• Role-based access: each person sees only what their role allows, and each company only its own data.
• Administrative changes are recorded in an audit log.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the DPDP Act requires.

7. Your rights and grievances

Under the DPDP Act you may ask us to:

• Access a summary of your personal data and how it is processed.
• Correct or update data that is wrong or incomplete.
• Erase data we no longer need, or withdraw consent where we rely on it.
• Nominate someone to exercise these rights if you die or become unable to.
• Seek redress for a grievance.

If your company added you, you can also ask your company’s admin, who can correct or remove your data directly. For any of these requests, or a complaint, contact our Grievance Officer:

Grievance Officer, reachable through your program team in Diamond Arena, Business Excellence Empire, India.

We will reply within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

8. Children

Business Monitor is for businesses and is not meant for anyone under 18. We do not knowingly collect children’s data; if you think we have, contact us and we will delete it.

9. Changes to this policy

We may update this policy. We will change the effective date above and, for significant changes, tell customer admins by email or in the app before they take effect.

10. Contact

Questions: your program team in Diamond Arena. See also our Terms of Service.