BuffOps Privacy Policy

Welcome to BuffOps (“BuffOps”, “we”, “our”, or “us”), a cloud-based modular operations platform developed and operated by BufferBytes Technologies (“Company”), registered at 2nd Floor, Kinfra ATP, Ramanattukara, Calicut, Kerala, India.

This Privacy Policy describes how we collect, store, process, protect, and share personal information when you access or use our website (buffops.com), our web applications, our standalone and integrated modules—including People Management (HRMS), Customer Relations (CRM), Cashflow & Growth (Finance), and Project Management (PMS)—or communicate with our team.

We adhere strictly to modern data privacy principles. We do not sell, rent, or trade your personal or organizational data to any third-party advertisers or data brokers. We process data solely to provide, secure, and improve our services in accordance with your business agreements and applicable data protection regulations.

The categories of personal data we collect depend on how you interact with BuffOps, whether as a website visitor, account administrator, employee, or authorized user:

Device & Telemetry Data: When you access BuffOps web applications, our servers automatically record internet protocol (IP) addresses, browser type, operating system, referring URLs, device identifiers, and request timestamps to maintain security and monitor application stability.

We process personal data only when we have a legitimate, legal basis to do so. BuffOps uses collected data for the following specific purposes:

• •
  Providing and Maintaining the Service: Provisioning your organization workspace, routing data across selected modules (HRMS, CRM, Finance, PMS), and authenticating authorized users.
• •
  Billing and Account Management: Processing subscription payments, calculating plan seat tiers, issuing tax invoices, and administering renewals.
• •
  Customer Support & Incident Resolution: Responding to help tickets, troubleshooting bugs, diagnosing performance issues, and providing operational guidance.
• •
  Platform Security & Fraud Prevention: Detecting brute-force attacks, authenticating multi-factor sessions, auditing API access tokens, and preventing abusive behavior.
• •
  System Notifications: Transmitting transactional emails, security advisories, password resets, and critical policy or service updates via AWS Simple Email Service (SES).

Under the European Union General Data Protection Regulation (GDPR), United Kingdom GDPR, and the Digital Personal Data Protection Act (DPDP Act, India 2023), our lawful bases for collecting and processing personal information include:

BuffOps is architected around independent modularity. Each customer organization operates within an isolated tenant boundary:

• Cryptographic & Logical Segregation: Workspace data is segregated so that organizational data is inaccessible by other tenants.
• Decoupled Sub-Services: Modules (HRMS, CRM, Finance, PMS) interact strictly over authenticated internal APIs, allowing customers to use standalone modules without exposing unnecessary data surfaces.
• Role-Based Access Control (RBAC): Tenant administrators retain granular authority to define permission tiers (e.g., HR Managers, Department Heads, Finance Officers, Contractors) ensuring users access only their designated domain data.

We engage vetted third-party vendors to assist with infrastructure, transactional communication, and payment processing. All subprocessors are bound by data processing agreements (DPAs) requiring adherence to strict confidentiality and security standards:

We do not share your confidential customer or employee data with third-party generative AI models for training purposes.

We retain personal information only for the duration necessary to fulfill the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law:

We implement industry-standard physical, organizational, and technical safeguards engineered to safeguard your data against accidental loss, unauthorized access, alteration, or disclosure:

BuffOps utilizes minimal, privacy-respecting cookies and local storage tokens strictly required for platform operation:

• Strictly Essential Cookies: Secure session identifiers and CSRF prevention tokens necessary for user login and navigation. These cannot be disabled without breaking authentication.
• Functional Preferences: Storage of user UI preferences such as regional currency displays, collapsed sidebar states, and selected date ranges.
• Performance & Health Telemetry: Aggregated, anonymized performance metrics to measure API latency, page load times, and error exceptions.

We do not deploy third-party advertising cookies, behavioural cross-site tracking pixels, or data syndication beacons.

Depending on your jurisdiction (such as the European Economic Area, UK, California under CCPA/CPRA, or India under DPDP), you hold specific statutory rights regarding your personal data:

BufferBytes Technologies is based in India. If you access BuffOps from the European Union, the United Kingdom, North America, or other global territories, please note that information may be transferred to and processed on secure cloud infrastructure hosted in India and AWS global data centers.

Whenever we transfer personal data across international borders, we ensure adequate security safeguards are established through approved Standard Contractual Clauses (SCCs), robust Data Transfer Impact Assessments, and equivalent protective measures recognized under international data protection frameworks.

BuffOps is exclusively designed for professional commercial business operations and is not directed to individuals under the age of 18 (or the age of legal majority in your country). We do not knowingly solicit or collect personal information from minors.

If we learn that we have inadvertently collected personal data from a minor without verified parental consent, we will take immediate steps to permanently delete the information from our servers.

We may update this Privacy Policy periodically to reflect technological advancements, new product module releases, or legal developments. When material modifications occur, we will notify registered tenant administrators via email and update the “Last Updated” date at the top of this page.

Your continued use of BuffOps after the effective date of an amended policy represents your acceptance of the updated terms.

If you have questions, feedback, or grievance concerns regarding this Privacy Policy or our data handling practices, please contact our designated Data Protection Officer and Grievance Officer:

For users located within India, this notice satisfies the grievance officer disclosure mandates under Section 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Digital Personal Data Protection Act, 2023.