Privacy Policy
Last updated: 18 October 2026
This policy is written to meet India’s Digital Personal Data Protection Act, 2023 and, for people in the UK and EU, the GDPR.
1. Who we are. Crystal Lotus Solutions LLP (LLPIN AAZ-6912), with its registered office at 3-36, Aikya, Tapovanam, Anantapur, Andhra Pradesh 515004, India, provides Metacaliper. Privacy contact: the Grievance Officer, Crystal Lotus Solutions LLP, privacy@metacaliper.com.
2. Our role. We are the controller (data fiduciary) for personal data about people who visit our website, sign up, or use the Service as Members. We are a processor for personal data contained in Customer Data, such as names in Salesforce metadata or commit authors in a repository; for that data we act only on our customer’s instructions, under our Data Processing Addendum.
3. What we collect and why.
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, password hash, Workspace memberships, role | Create and secure your account; provide the Service | Contract |
| Language, region, time zone, clock preference | Show dates and times as you set them | Contract |
| Sign-in records, IP address, device and browser details, actions taken in the Service | Security, audit trail, preventing abuse, troubleshooting | Legitimate interests |
| Support messages | Answer your requests | Contract; legitimate interests |
| Billing name, email, country, tax number, subscription and invoice records | Manage your subscription (payment card details are collected by Paddle, not by us) | Contract; legal obligation |
| Product announcements and marketing emails | Inform you about the Service | Consent, which you can withdraw at any time |
4. Who we share it with.
- Paddle, our reseller and merchant of record, which processes orders, payments, tax and refunds as an independent controller under its own privacy notice.
- Service providers that host or support the Service (listed on our Subprocessors page), bound by contracts that limit their use of the data.
- Services you connect, such as Salesforce and git providers, when you instruct the Service to act on them.
- Professional advisers, such as lawyers and auditors, under confidentiality.
- Authorities, where the law requires it.
We do not sell personal data.
5. International transfers. We are based in India and host the Service on Amazon Web Services in the United States (N. Virginia). Where personal data from the UK or EU is transferred, we rely on Standard Contractual Clauses (and the UK Addendum) or an adequacy decision.
6. How long we keep it. Account data for as long as your account is active, then up to 90 days. Security and audit records for 12 months. Billing records for the period Indian tax and accounting law requires. Customer Data as set out in our Terms and Data Processing Addendum.
7. Your rights. Depending on where you live, you may access, correct, update or erase your personal data, object to or restrict processing, receive your data in a portable format, withdraw consent, and nominate another person to exercise your rights. To exercise a right, email privacy@metacaliper.com; we respond within one month. You may also complain to the Data Protection Board of India or, in the UK or EU, to your supervisory authority. For personal data inside Customer Data, contact the organization that owns the Workspace.
8. Security. We use encryption in transit and at rest, encrypt stored credentials, separate each Workspace’s data at the database level, limit and log staff access, and follow SOC 2-aligned controls. If a breach affects your personal data, we notify you and the authorities as the law requires.
9. Cookies. We use cookies and browser storage only to run the Service: to keep you signed in, to keep accounts secure, to process payments, and to remember settings you choose. We use no advertising or analytics cookies. The one optional cookie remembers the website theme, and is set only if you allow preference cookies. Cloudflare (the bot check at sign-up and sign-in) and Paddle (checkout) may set their own necessary cookies. Every cookie, what it is for and how long it lasts, and your settings, are on our Cookies page.
10. Children. The Service is for businesses and is not directed at anyone under 18.
11. Changes. We will post changes here and, for material changes, notify account holders by email.