What personal data Courierly collects, why, who it is shared with (including Razorpay for payments and NACH / e-mandate), and your rights under the DPDP Act, 2023.
YRS Technologies Pvt Ltd operates Courierly, a courier management service for shops and franchises in India. For the personal data of shop owners and their staff (account, billing and usage data), we are the data fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). For the personal data of a shop's own customers (senders and receivers on bookings), the shop is the data fiduciary and we process it on the shop's behalf. This policy applies together with our Terms & Conditions and Refund & Cancellation Policy.
| Category | What | Source |
|---|---|---|
| Account & business | Shop name, owner name, email, phone, address, GST number (if given), password (stored only as a one-way bcrypt hash), two-factor secret (stored encrypted), staff names, emails and roles, branch details | You, at registration and in settings |
| Sign-in with Google | Name and email from your Google account. If you choose to let us send notifications from your Gmail, a token limited to Gmail's "send" permission — we do not read your mailbox. | Google, with your consent |
| Consent record | Time, IP address and version of the Terms you accepted | Generated at registration |
| Business operations | Bookings, AWB numbers, shipment details, COD and ledger entries, rate cards, invoices, returns, templates, notification history (sent / delivered status only) | You and your staff |
| Billing | Plan, amount, status, dates, coupon used, and Razorpay payment, payment-link and mandate reference IDs (see section 3) | You, Razorpay |
| Technical & security | IP address, browser / device type, login events, audit logs of changes, rate-limit and threat-detection records, error logs | Automatically |
| Integrations you enable | API credentials for courier or messaging services you connect, and API tokens you create | You |
| Support | Messages and feedback you send us | You |
We do not collect sensitive personal data such as health, biometric or caste data, and we do not knowingly ask for Aadhaar or PAN.
We do not sell your personal data and do not use it for third-party advertising.
The names, phone numbers, emails and addresses of the people you ship for are entered by you and stay under your control. You must have a lawful basis, and any needed consent, to enter and use them (see Terms section 10). We process this data only to provide the Service to you and do not use it for our own purposes. An individual who contacts us about their data in your account will be referred to you as the data fiduciary, and we will help you respond.
We use a session cookie (HttpOnly and secure) to keep you logged in, and a CSRF token to protect forms. The app may store booking drafts and preferences in your browser's local storage / IndexedDB so it works offline. We do not use advertising or cross-site tracking cookies. Google reCAPTCHA, if enabled on the login page, sets its own cookies under Google's policy.
No system is perfectly secure. If a personal-data breach affects you, we will tell you and the Data Protection Board as required by law.
| Data | Kept for |
|---|---|
| Account and business data while your account is active | As long as your account exists |
| Account and business data after you stop (lapsed or cancelled) | Up to 2 years, so you can return; then deleted |
| Payment, invoice and refund records | 7 years, as required by tax and accounting law |
| Booking / shipment records | While the account is active; up to 3 years after closure for disputes and audits |
| Audit trail of account and billing changes | Kept to show what happened, e.g. that an account was deleted |
| Server and security logs | About 90 days |
Deleting your account. You can delete your account yourself from the Subscription page in the app (type DELETE to confirm), or write to us. This permanently removes your shop's bookings, customers, invoices, staff, templates and settings. We keep payment records and the audit trail for the periods above because the law requires it, and delete everything else. Deletion cannot be undone, so export what you need first. Deleting the account also ends the Service and any auto-debit mandate — cancel the mandate too so that your bank stops presenting debits.
Under the DPDP Act, 2023 you may:
To exercise a right, email admin@yrsinfotech.com from your registered address. We respond within 30 days, and may need to verify your identity first. Most account details can also be edited yourself in the app.
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data of children. If you think a child has given us data, tell us and we will delete it.
We may update this policy as the Service or the law changes. We will change the date and version above and, for material changes, email your registered address.
Grievance Officer / Data Protection contact: Courierly Support, YRS Technologies Pvt Ltd
Email: admin@yrsinfotech.com
Phone: +91 98400 46168
Response: acknowledgement within 48 hours; resolution within 30 days.