Privacy Policy

This policy explains what personal data Green Rajasthan Private Limited (Comriq) collects, why, and the choices you have. It covers comriq.com, including Studio, and the Comriq products.

Two roles, so you can judge the rest

• Where we decide why and how data is used, we are the data fiduciary under the Digital Personal Data Protection Act, 2023. That is the case for visitors to this site, people who ask for a demo, a quotation or support, and the people who manage a subscription (owners, admins, billing contacts).
• Inside the products, the company, hotel or school that subscribes is the data fiduciary for the personal data it puts in (its employees, guests, students, parents, customers). Comriq is its data processor and acts only on its instructions, under the Data Processing Addendum. If you are an employee, guest, student or parent, the organisation that uses Comriq is the one to ask first; we will help it answer you.

What we collect as fiduciary

• A demo request, a quotation request or a message: your name, work email, organisation, role, country, size, what you use today and what you write. We record the moment you ticked the consent box and the version of this notice.

• An account: the email address you sign in with, sign-in events, the second factor for admins, and what is done through the account.

• Billing: the billing contact, GSTIN, address, invoices, payments, mandate references and TDS certificates. Card and UPI details are handled by the payment processor; we never see or store a card number.

• Site data: limited technical data and the preferences described in the Cookie Policy.

• Records of earlier work: where we delivered company-services work before October 2026, the documents you gave us for it are still held under the retention rules below. We are not asking for any more of them.

• Security records: when you sign in to a product we keep the time, the device type and browser, the country and city derived from your network address, and a hashed form of that address, so we can show you your devices, let you sign any of them out, and spot a sign-in that is not you. These records are kept for twelve months and are used for nothing else. We make no automated decision about any person from them beyond asking for an extra step when a sign-in looks unusual.

Riq, the assistant on this site, answers from the site's own content inside your browser. What you type is not sent to us or to anyone else. If you choose to pass a question to the team, the email and question you enter are used only to reply.

How we use it

To reply to you and arrange demos; to run your subscription, invoice it and collect payment; to provide support; to keep records the law requires; and to keep the site and the products secure. We do not sell personal data, we do not use it for anyone else's marketing, and we do not use product data to advertise to anyone. We send product news and offers only if you have asked for them, and every such email carries an unsubscribe link that works at once; service messages (invoices, security notices, sign-in codes) are sent regardless, because the service needs them.

Consent, and taking it back

Forms on this site are sent only when you tick an unticked box. You can withdraw consent at any time by writing to privacy@comriq.com from the address concerned. Withdrawing is as easy as giving consent: one email, no form, no reason needed.

Who processes it

Named, so you can check them.

A WhatsApp messaging provider will be named here before the first WhatsApp message is sent from a product. Postmark is the one processor that holds data outside India by design: the recipient's address and the message itself. For that transfer we rely on a written data-processing agreement with Postmark that includes standard contractual clauses, and we send through it nothing but the message and the address it goes to.

How long we keep it

• A demo or quotation request that did not become a customer: deleted within 24 months of the last contact, or on request, whichever is sooner.
• Subscription and billing records: for eight financial years, because books of account and the papers behind them must be kept for that long under s.128 of the Companies Act, 2013, and GST records for 72 months.
• Records of company-services work delivered before October 2026: eight years from the end of the financial year the work relates to, for the same reason.
• Customer data inside the products: as the customer sets, then deleted as the Cancellation and Suspension Policy describes.
• Security records (sign-in events and devices): twelve months.
• Server and edge logs: thirty days.

Children

Campus may hold children's data for the schools that use it. The school is the data fiduciary and obtains verifiable parental consent per purpose before a child's data is processed, under the DPDP Rules. Campus does not profile students or advertise to them, collects no student biometrics, and shares bus location with parents only during the ride. Comriq's own site is not directed at children.

Security

Data is encrypted in transit and at rest, access is logged, and each organisation's data is separated by row-level security. Bank account and identity-document numbers are encrypted a second time inside the database. Sign-in is by invitation only with a one-time code, and sessions can be revoked from any device. Comriq staff see a customer's workspace only through the read-only, time-limited, logged support view described in the Terms. No system is perfectly secure. If a personal data breach touches your data we tell the affected organisation and, where we are the fiduciary, you, without delay, and we notify the Data Protection Board of India in the form and time the DPDP Rules prescribe; where the GDPR applies, the supervisory authority within 72 hours.

Your rights

Ask what we hold about you, ask us to correct or erase it, nominate someone to act for you, or withdraw consent, by writing to privacy@comriq.com. We acknowledge within one business day and answer within 30 days. Where we must keep a record for longer, we say so, say why, and tell you the date it can go.

Grievance Officer

Complaints about how we handle personal data go to our Grievance Officer at grievance@comriq.com. We acknowledge within 48 hours and resolve within one month.

If we do not resolve it

You may complain to the Data Protection Board of India. You do not need our permission, and you do not need to tell us first.

If you are outside India

• European Economic Area and United Kingdom. Where the GDPR or the UK GDPR applies, Green Rajasthan Private Limited is the controller for the site and for the people who manage a subscription, and the processor for data inside the products. Our lawful bases are: performance of a contract (running your subscription), legitimate interests (security, fraud prevention, answering an enquiry you sent), consent (marketing, cookies we may add later) and legal obligation (tax and accounting records). You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent; write to privacy@comriq.com. You may complain to your local supervisory authority (in the UK, the Information Commissioner's Office). Your data is stored in India; transfers to us and to the processors above rest on standard contractual clauses and the safeguards in the Data Processing Addendum.
• United Arab Emirates. Where the UAE Personal Data Protection Law applies, the same rights apply and the same addresses answer them.
• California. We do not sell or share personal information for cross-context advertising, and we have not done so in the last twelve months. You may ask what we hold, ask for deletion or correction, and you will not be treated differently for asking.

What we do not claim

We do not claim a certification we do not hold. Our incident procedure and data processing addendum are written and are being reviewed by counsel.

Changes

New versions are published here with the date and a summary of changes. Earlier versions stay readable.