Privacy Policy
Last updated 27 October 2026
ORVANTIA OS is the private operating system of ORVANTIA, a sole proprietorship run by Bakkera Abhinay Karthik (Hyderabad, Telangana, India). This policy explains what personal data the system holds, why, who can see it and how long it is kept. It applies to team members, project collaborators and client-relationship users who have an account, and to people whose details are recorded as clients or contacts.
What we collect
- Account data — name, email address, role and access, a salted password hash (never the password), two-factor settings, and security events such as sign-ins and password changes.
- Work data you create — tasks, comments, time entries, to-dos, documents you upload, and the activity history of changes.
- Business records — clients and their contacts, projects, agreements, invoices, payments and expenses, entered by the people who manage them.
- Technical data — IP address and browser details attached to sign-ins and audit entries, and standard server logs.
- Preferences — theme, board layout, saved views and notification settings.
We do not run advertising or behavioural analytics, and we do not sell personal data.
Why we use it
- To provide the service: sign you in, show you the work and records you are permitted to see, and send the notifications and emails you would expect (assignments, approvals, password resets, an optional daily digest).
- To run the business: issue invoices, track payments, deliver client projects and keep a record of agreements.
- To keep the system secure: access control, rate limiting, an audit log of who did what, and detection of abuse.
- To meet legal and accounting obligations.
Who can see it
Access is controlled by role. The Owner can see everything. Project team members see the projects and tasks they belong to. Client-relationship users see only the clients and projects assigned to them. Finance data is never shown to project-only roles. Every access rule is enforced on the server, not only in the interface.
Service providers
We use a small number of providers to run the system, each processing data only on our instructions: a managed MongoDB database for records, an S3-compatible object store for uploaded files, and an SMTP email service for outgoing mail. Data is not shared with anyone else except where the law requires.
How long we keep it
- Completed tasks are archived after a period set by the Owner (60 days by default) and remain searchable; deleted tasks stay in Trash for 30 days by default and are then permanently removed.
- Financial records and agreements are kept for as long as the law and accounting practice require.
- Audit logs and security events are kept to protect the system and the people in it.
- When an account is deactivated its sign-ins stop immediately; work it created stays so that history remains intact.
Security
Passwords are hashed with Argon2; sessions use encrypted, HTTP-only cookies; connections are encrypted in transit; access is role-based with server-side checks; sign-in attempts are rate limited; and sensitive actions are written to an audit log. No system is perfectly secure, so please use a strong, unique password and enable two-factor authentication.
Your rights
Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you may ask to access the personal data we hold about you, correct it, have it erased where we have no obligation to keep it, withdraw consent where processing relies on it, and nominate someone to exercise these rights on your behalf. You can also raise a grievance. Write to abhinaybakkera@orvantia.in; we aim to reply within 30 days.
Changes to this policy
If we change how data is handled we will update this page and its date, and for significant changes tell signed-in users inside the app.
Contact
ORVANTIA, Hyderabad, Telangana, India · abhinaybakkera@orvantia.in