OROTOV is operated by LETSDECODE TECHNOLOGIES LLP ("OROTOV", "we", "us"), a limited liability partnership registered in India. OROTOV is in private pilot: access is granted to invited workspaces, not the general public. This policy applies to the public website at orotov.com, the hosted application, and the MCP and API surfaces OROTOV exposes to connected coding tools.
Because OROTOV is a company incorporated and hosting data in India, this policy is written primarily against India's Digital Personal Data Protection Act, 2023 (DPDP Act), the operative law for how we, as a Data Fiduciary, must handle your personal data. We also describe the data-subject rights (access, correction, erasure, portability, and withdrawal of consent) that the DPDP Act and comparable regimes such as the GDPR both recognize, because they are the rights a business evaluating OROTOV reasonably expects to see addressed regardless of which specific law applies to them.
What personal data does OROTOV collect?
OROTOV collects the minimum personal data needed to operate an account. On the account record itself, that is exactly: your email address, a bcrypt-hashed password (we never store your password in plain text, and cannot recover it), a session version counter used to invalidate old sessions, and the account's creation and trial timestamps. OROTOV does not collect your name, phone number, or postal address as part of account creation, because the product does not currently use them for anything.
The service sets no cookies. There are no tracking pixels, no third-party analytics scripts, and no behavioral advertising identifiers anywhere on orotov.com or in the application. Session state after login is a signed token (a JWT) held in your browser's local storage, not a cookie, and it is never transmitted to any party other than the OROTOV API. Because nothing is set that requires your consent to store, there is no cookie banner on this site: there is nothing to consent to.
What about the engineering data my workspace stores?
Separately from your account's personal data, a workspace you create or join stores the engineering content your team supplies as part of using the product: stories, issues, commit references, decisions, evidence records, and audit log entries. This workspace content is business data your organization controls, and OROTOV processes it strictly to provide the service to that workspace. It is isolated per workspace: every table that stores workspace content carries a workspace identifier, and every query is scoped to it, so one workspace cannot read another workspace's data through the product.
Why do we collect it, and what is the legal basis?
We collect your email address and password hash to create and authenticate your account, which is necessary to perform the contract you enter into when you sign up (DPDP Act certain legitimate uses; GDPR Article 6(1)(b) equivalent). We use the session version counter to let you and us revoke a compromised session, which is a security measure necessary for that same contract. We process workspace content because processing it is the entire point of the service you have asked us to provide. Where OROTOV sends you an email, such as a password reset, that processing rests on the same contractual necessity: you asked to reset your password, and delivering that email requires processing your address through our email sub-processor.
We do not use your personal data for advertising, we do not sell it, and we do not share it with data brokers. We do not build a profile of you beyond what is needed to operate your account and workspace.
Who processes personal data on our behalf?
OROTOV uses a small, named set of sub-processors, each engaged only for a specific purpose:
- Resend. Sends transactional email on our behalf, such as password reset messages. Resend does not receive your workspace content, only what is needed to address and send the email.
- Razorpay. Our payment processor. Live card processing is currently mock-enabled in production, meaning no real card data is processed through OROTOV today; this will change only when billing goes live, and this policy will be updated when it does.
- Utho. Provides the India-based hosting infrastructure and managed PostgreSQL database that stores account and workspace data.
- GitHub. Only when an operator of your workspace explicitly configures the GitHub connector for their own repositories. GitHub then sends signed webhook events about that repository's activity to OROTOV. OROTOV does not access any GitHub repository without this explicit, operator-driven configuration step.
We do not use sub-processors for analytics, advertising, or profiling, because we do not run any such workflow.
Where is data hosted, and does it leave India?
Account and workspace data is hosted in Bangalore, India, on infrastructure provided by our hosting sub-processor. We do not transfer personal data to a location outside India as a routine matter of operating the service. Email delivery through Resend and payment processing through Razorpay (once enabled for live payments) may involve processing outside India as an inherent part of how those named sub-processors operate their services; each is engaged under a data processing agreement that requires them to protect personal data to a standard consistent with the DPDP Act's requirements for cross-border transfer.
How is personal data protected?
Passwords are hashed with bcrypt before storage; we never store or log a plaintext password. Sessions are JSON Web Tokens signed by the server; a password reset increments the account's session version, which immediately invalidates every previously issued session token for that account, even ones still held by a stolen device. Workspace data is isolated by workspace identifier at the query level, so a bug or a compromised key in one workspace cannot read another workspace's data through the ordinary application programming interface. All traffic to orotov.com and the hosted application travels over TLS in transit. Email payloads that reference account data, such as a password reset link, are transmitted to our email sub-processor over an encrypted connection and are not retained by OROTOV in plaintext logs beyond what is operationally necessary to diagnose a delivery failure. For the complete, current list of implemented and outstanding security controls, including items still open ahead of general availability, see our security page.
How long is data retained, and how do I get it deleted?
There is currently no automated retention or purge job that deletes account or workspace data on a fixed schedule; data persists for as long as your account or workspace exists. We are telling you this plainly rather than promising an automatic deletion timeline we cannot yet honor. If you want your account or workspace data deleted, send a request to [email protected] from the email address associated with the account, describing what you want deleted (a single account, or an entire workspace and its members). We will acknowledge the request, verify you are entitled to make it, and action it as soon as reasonably possible; because deletion is currently a manual operator process rather than a self-service button, response time depends on operator availability, and we will tell you when the deletion is complete. Deleting a workspace removes the engineering content stored in it (stories, issues, commit references, decisions, evidence records, and audit log entries) along with the account records tied to it, except where we are required to retain limited records (such as billing records) to meet a legal obligation.
What rights do I have over my personal data?
Under the DPDP Act, and consistent with the rights a GDPR-style regime recognizes, you can exercise each of the following by writing to [email protected]:
- Access. Ask what personal data we hold about you and how it is being processed.
- Correction. Ask us to correct inaccurate or incomplete personal data, such as an out-of-date email address.
- Erasure. Ask us to delete your personal data, as described in Retention above, once it is no longer needed for the purpose it was collected for or you withdraw consent it depended on.
- Portability. Ask for a copy of your workspace's engineering data in a structured, commonly used format so you can move it elsewhere.
- Withdrawal of consent. Where processing depends on your consent rather than contractual necessity, withdraw that consent at any time; this does not affect processing already carried out before withdrawal.
- Grievance redressal. Raise a complaint about how we have handled your personal data or a rights request, addressed to our named grievance contact below.
We may need to verify your identity before acting on a request, and some requests may be limited where retaining data is necessary to meet a legal obligation, such as a billing or tax record.
Grievance redressal
As required under the DPDP Act, LETSDECODE TECHNOLOGIES LLP designates [email protected] as the named contact for grievances concerning the processing of your personal data. Write to that address describing your concern; we will acknowledge receipt and respond within a reasonable time.
Children's data
OROTOV is a business-to-business engineering tool. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of 18. If you believe a child's data has been provided to us, contact [email protected] and we will address it.
Changes to this policy
We will update the date at the top of this page whenever this policy changes, and where a change is material we will make reasonable efforts to notify workspace owners directly, such as by email, before it takes effect.
Contact
For privacy questions or rights requests, write to [email protected]. For general support, write to [email protected]. For security reports, see our security page. For billing questions, write to [email protected].
For how OROTOV is priced and billed, see pricing. For the terms governing your use of the service, see our Terms of Service.