1. Who we are
Cora Retail ERP is operated by Techcora Corporation Private Limited (“Techcora”, “we”), 12/180, Makkamoola, Gudalur, The Nilgiris, Tamil Nadu 643212, India. Contact: info@techcoracorp.com.
This policy covers:
- this website and its demo request form;
- the Cora Retail ERP service that businesses subscribe to — the POS, back office, branded shopping app and delivery tools (together, “the service”); and
- the personal data stores handle through the service about their customers and staff.
The Cora Rider delivery app has its own policy: Cora Rider privacy policy.
2. Our two roles
When we decide why data is used — visitors to this website, people who ask us for a demo, and the owners and staff of businesses that hold a Cora Retail ERP account — Techcora is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
When a store decides — the data a store keeps about its own customers, staff and suppliers in the service — the store is the Data Fiduciary and Techcora processes that data only on the store's behalf and instructions, as its Data Processor. If you are a customer of a store, the store is responsible for how your data is used; you can contact it directly, or write to us and we will pass your request on and help the store answer it.
3. This website
- Nothing else tracks you. Apart from that optional cookie, this website runs no analytics or advertising scripts, sets no cookies, and loads its fonts from our own server. Your cookie choice itself is remembered in your browser's local storage, not sent to us.
- The demo request form: if you fill it in, we receive your name, phone or WhatsApp number, business name, city, number of stores and any message you add, together with the address of the page you sent it from (including any campaign tags in that address), your IP address and your browser type. These go into our own CRM so our team can contact you about a demo, and are used to prevent spam and abuse of the form.
- WhatsApp and phone links: if you tap one, the conversation happens in WhatsApp (operated by Meta) or your phone's dialer, under their own terms.
- Server logs: our hosting provider (Google Firebase Hosting) records technical request data such as IP address and browser type to deliver and secure the site.
4. Businesses using Cora Retail ERP
For a business that subscribes to the service, we collect:
- Account and staff details: names, phone numbers, email addresses and roles of the owner and the staff you add. Passwords are checked by our sign-in service and never stored in readable form.
- Business details: business name, store addresses, GSTIN and the settings you choose.
- Subscription and billing records, and your communications with our support team.
- Usage and security logs: sign-ins, actions taken in the service and the devices used, to keep accounts secure and to investigate problems.
We use this to provide, bill for, support and secure the service, and to tell you about changes to it. We do not sell it or use it for advertising.
5. Data stores process through the service
A store's own records live in the service: its products, stock, purchases, sales, invoices and reports. Where they concern people, they can include:
- Customers: name, phone number, email, delivery addresses, orders and bills, credit (khata) balances, loyalty or membership details, and payment status. When a customer pays online, the payment is handled by the store's payment gateway; the service receives the result and a reference, never the full card or bank details.
- Shopping app users: the sign-in phone number, profile, addresses, cart and order history, and a device notification token for order updates.
- Messages: one-time sign-in codes, order and delivery updates, and invoices a store sends by SMS, WhatsApp or email through the service.
- Deliveries: the rider assigned and, during a delivery, the rider's location, so the store and the customer can track it (see the Cora Rider privacy policy).
- Staff and suppliers: the contact details a store keeps for them.
We process this data only to run the service for the store: to store it, show it to the store's authorised users, send the messages the store asks for, and keep it secure. We do not use a store's customer data for our own marketing, do not sell it, and do not share one store's data with another.
6. Legal basis
We process personal data with the consent of the person it is about, or for a legitimate use permitted by the DPDP Act — such as providing a service you asked for, meeting a legal obligation (for example tax and GST record-keeping), or responding to an emergency. Where consent is the basis, you can withdraw it at any time; this does not affect processing already done.
7. Who we share it with
- Service providers that host and operate the service for us, bound by contract
to use the data only for that purpose:
- Google Cloud and Firebase — servers, sign-in, file storage, notifications and website hosting;
- Neon — our main database, hosted on Amazon Web Services;
- MSG91 — SMS and WhatsApp message delivery;
- Google Workspace — email.
- Meta Platforms, for advertising measurement on this website, only if you allow the advertising cookie (see section 3).
- Payment gateways a store chooses (for example Razorpay or ICICI Bank), which receive the details needed to process a payment under their own policies.
- The store you buy from or work for, for data about you in its records.
- Authorities, where Indian law requires it, and professional advisers under a duty of confidentiality.
- A buyer or successor of our business, if one arises, under this policy's protections.
8. Where it is stored
Data is stored and processed in India (Google Cloud, Mumbai) and in Singapore (our main database on Amazon Web Services, and parts of Firebase). The DPDP Act permits this transfer; we apply the same protections to the data wherever it is held.
9. Security
All data travels over encrypted connections (HTTPS). Stored credentials, such as the keys that connect a store to its payment gateway, are additionally encrypted. Each store's data is separated from every other store's, and access is limited to the store's authorised users and to Techcora staff who need it to run and support the service. If a personal data breach occurs, we will notify affected stores, and the Data Protection Board and affected people as the law requires.
10. How long we keep it
- Demo requests: for up to 24 months after our last contact with you, unless you become a customer or ask us to delete them sooner.
- Business accounts and store data: for as long as the subscription is active. When it ends, the store can ask for an export of its data within 30 days; we then delete it within 90 days, except records we or the store must keep longer by law, such as tax and GST records.
- Security logs: for as long as needed to secure the service and investigate incidents, then deleted.
11. Your rights
Under the DPDP Act you can:
- ask what personal data we hold about you and how it is used;
- ask us to correct, complete, update or erase it;
- withdraw consent you have given;
- nominate someone to exercise these rights for you if you die or become unable to; and
- raise a grievance with us, and then with the Data Protection Board of India.
Write to info@techcoracorp.com with the subject “Privacy request”. We may ask you to confirm your identity first. If your data is in a store's records, tell us which store; we will pass the request to the store, which decides on it as the Data Fiduciary, and help it respond.
12. Children
The service is meant for businesses and is not directed at children. We do not knowingly collect personal data of anyone under 18 for our own purposes. If you believe a child has given us their data, write to us and we will delete it.
13. Grievance officer
Grievance Officer, Techcora Corporation Private Limited — info@techcoracorp.com. We acknowledge grievances within 7 days and aim to resolve them within 30 days. If you are not satisfied, you can escalate to the Data Protection Board of India.
14. Changes
We will update this page and its effective date when our practices change, and tell businesses using the service before a change that affects how their data is processed takes effect.