Privacy Policy

1. Who We Are

Mathurs24 is a digital services company operating from New Delhi, Delhi, India, providing web design, development, SEO, hosting, and related digital services primarily to businesses in India. We also operate PostStage (trypoststage.com), a social media content scheduling and publishing tool.

Website: https://mathurs24.com
Contact: info@mathurs24.com

2. Scope & Applicability

This Policy applies to all visitors, users, and clients who access our website or engage our services — including PostStage users regardless of location. Our core agency services are primarily intended for businesses located within India. PostStage may be used globally; international users' rights are addressed in Section 12.

3. Information We Collect

3.1 Information You Provide Directly

• Full name and business name
• Email address
• City / location (for service delivery purposes)
• Details of services requested and project requirements
• Communications sent to us via contact forms or email

3.2 Automatically Collected Information

• IP address and approximate geographic location
• Browser type, version, and operating system
• Pages visited, time spent, and navigation path
• Referral URL (the page that directed you to our site)
• Device type (desktop, mobile, tablet)

3.3 Sensitive Personal Data or Information (SPDI)

We do not intentionally collect Sensitive Personal Data or Information as defined under the IT (SPDI) Rules, 2011, including passwords, financial information, biometric data, health information, or sexual orientation. If any such data is inadvertently submitted, it will be deleted immediately upon discovery.

4. Social Media Platform Data (PostStage)

PostStage integrates with third-party social media platforms — including Facebook, Instagram (Meta), Google, LinkedIn, and X (Twitter) — via their official APIs. This section explains exactly how we handle that data.

4.1 What Data We Access

When you connect a social media account, we receive an OAuth access token and the minimum profile or page data required to publish content on your behalf — typically a page name, page ID, and profile identifier. We do not access personal messages, friend lists, follower data, or any information unrelated to the scheduling and publishing function.

4.2 Why We Access It

Solely to enable you to schedule and publish content to your connected social media accounts. We do not use this data for advertising, audience profiling, resale, or any purpose beyond operating the scheduled publishing service.

4.3 OAuth Token Storage & Retention

Access tokens received from social media platforms are stored securely using AES-256 encryption at rest and TLS in transit. Tokens are retained for the duration of your PostStage account, or until you disconnect the account — whichever occurs first. We do not store your social media account passwords under any circumstances.

4.4 Token Revocation

When you disconnect a social media account within PostStage, or revoke access directly through that platform's own settings (e.g., Facebook Settings > Apps and Websites), the associated OAuth token is immediately and permanently deleted from our systems.

4.5 No Data Selling

We do not sell, rent, share, or transfer your social media data, OAuth tokens, connected account information, or any data obtained through platform APIs to any third party for advertising, analytics, or commercial purposes.

4.6 Platform Policy Compliance

Our collection and use of data through social media platform APIs complies with the developer policies of each respective platform, including the Meta Platform Terms, Google API Services User Data Policy, LinkedIn API Terms of Use, and the X Developer Agreement & Policy.

4.7 Google API Services — Limited Use Disclosure

PostStage's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, PostStage uses Google API data solely to provide and improve the scheduling and publishing features of the PostStage service. We do not use Google user data for serving advertisements, for data broking, to determine creditworthiness, or for any other purpose unrelated to providing PostStage functionality to you.

4.8 Permissions We Request

PostStage requests only the minimum permissions necessary to schedule and publish content on your behalf. The specific permissions requested from each platform are:

• Facebook / Meta: pages_manage_posts, pages_read_engagement, instagram_basic, instagram_content_publish
• Instagram: instagram_content_publish, instagram_basic
• LinkedIn: w_member_social, r_basicprofile, r_emailaddress
• Google / YouTube:
  • https://www.googleapis.com/auth/youtube.readonly — used once at account connection to read your YouTube channel name, handle, and profile picture so PostStage can display which channel you have connected. No other channel data is accessed.
  • https://www.googleapis.com/auth/youtube.upload — used at publish time to upload videos to your YouTube channel on your behalf, at the exact date and time you scheduled. PostStage never modifies, deletes, or accesses videos you did not create through PostStage.
  • https://www.googleapis.com/auth/business.manage — used to publish and manage posts on your Google Business Profile location (where applicable).
• X (Twitter): Read and Write access — used solely to post content and read basic profile details on your behalf

We do not request permissions beyond what is required for these functions. You can review and revoke these permissions at any time through your connected platform's app settings — see our Data Deletion page for per-platform revocation instructions.

5. How We Use Your Information

We use collected data for the following purposes only:

• To respond to your enquiries and provide requested services
• To prepare project proposals, quotations, and service agreements
• To deliver, manage, and support ongoing projects
• To operate PostStage and publish scheduled content on your behalf
• To send service-related communications (not marketing, unless consented)
• To issue GST-compliant invoices and process payments
• To improve our website and service quality through analytics
• To comply with applicable Indian law or legal process

We do not sell, rent, or trade your personal data to third parties for commercial purposes.

6. Legal Basis for Processing

Under the DPDP Act 2023 (and GDPR for EEA/UK users), we process your personal data on the following lawful grounds:

• Consent — when you submit a contact form, connect a social media account, or sign up for PostStage
• Contractual necessity — to perform services under a client agreement or PostStage subscription
• Legitimate interest — analytics and service improvement that do not override your rights
• Legal obligation — to comply with Indian tax, accounting, and regulatory requirements

7. Data Sharing & Disclosure

We may share your information only in the following limited circumstances:

• Service providers — trusted third-party tools such as Google Analytics, email platforms, and payment processors operating under contractual confidentiality obligations
• Social media platforms — when you use PostStage, your scheduled content is transmitted to the platform you have connected, solely for publication purposes
• Legal compliance — when required by a court order, government authority, or applicable Indian law
• Business transfer — in the event of a merger, acquisition, or sale of business assets, with prior notice to you

We do not transfer personal data to any entity outside India except where necessary for service delivery (e.g., cloud hosting, API calls to social media platforms) and only with appropriate safeguards in place.

8. Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your experience, analyse traffic, and improve performance. Types of cookies used:

• Essential cookies — necessary for the website to function correctly
• Analytics cookies — Google Analytics (anonymised) to understand usage patterns
• Preference cookies — to remember your settings and preferences

You may disable cookies in your browser settings. Disabling essential cookies may affect website functionality. By continuing to use our website, you consent to our use of cookies as described above.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by Indian law:

• Enquiry / contact form data: up to 2 years from last contact
• Client project data: up to 7 years (as required under Indian tax and accounting law)
• Analytics data: as per Google Analytics retention settings (maximum 26 months)
• PostStage OAuth access tokens: until account disconnection or account deletion, then immediately deleted
• PostStage scheduled post drafts: deleted within 30 days of publication or cancellation

After the retention period, data is securely deleted or anonymised.

10. Security of Your Data

We implement reasonable security practices as required under the IT (Reasonable Security Practices and Procedures) Rules, 2011, including:

• SSL/TLS encryption for all data in transit
• AES-256 encryption for stored OAuth tokens and sensitive credentials
• Secure, access-controlled storage systems
• Restricted access to personal data on a need-to-know basis
• Regular security reviews and updates

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10.1 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Notification will be sent to the email address associated with your account and will include:

• The nature of the breach and categories of data affected
• The likely consequences of the breach
• The steps we are taking or have taken to address it
• Contact details for further queries

Where Indian law (DPDP Act 2023) or GDPR requires notification to a supervisory authority, we will comply accordingly. If the breach involves Google API data or social media platform data, we will additionally notify the relevant platform in accordance with their developer breach reporting requirements.

11. Your Rights Under Indian Law

As a data principal under the DPDP Act 2023 and applicable Indian law, you have the right to:

• Access — request a summary of personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Erasure — request deletion of your data (subject to legal retention requirements)
• Withdraw consent — withdraw previously given consent at any time
• Grievance redressal — raise a complaint with our Grievance Officer

To exercise any right, write to: info@mathurs24.com. We will respond within 30 days.

12. International Users & GDPR Rights

If you are located in the European Economic Area (EEA), United Kingdom, California (under CCPA), or any other jurisdiction with enhanced data protection law, you have the following additional rights in respect of your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to restriction — request that we limit how we process your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — where processing is consent-based, withdraw at any time without affecting prior processing

To exercise any of these rights, contact us at info@mathurs24.com. We will respond within 30 days. If you believe your rights have been violated, you may lodge a complaint with the supervisory authority in your jurisdiction (e.g., the ICO in the UK, or your national DPA in the EEA).

Where we process data of EEA/UK individuals, our legal bases under GDPR are: consent (for PostStage account creation and social media connections), contract performance (for service delivery), and legitimate interest (for analytics and security). We do not rely on legitimate interest where your fundamental rights override that interest.

13. Data Deletion Instructions

You may request the deletion of all personal data we hold about you at any time. We will complete verified deletion requests within 30 days.

How to Request Deletion

1. Email info@mathurs24.com with the subject line "Data Deletion Request"
2. Include your name, email address, and the specific data or service account you wish to have deleted
3. We will confirm receipt within 5 working days and complete deletion within 30 days

PostStage Account & Data Deletion

To delete your PostStage account and all associated data email info@mathurs24.com with "PostStage Data Deletion Request" in the subject line. All scheduled post drafts, connected account OAuth tokens, and profile data will be permanently deleted within 30 days.

You may also visit our dedicated data deletion page: mathurs24.com/data-deletion

Revoking Social Media Access

If you disconnect PostStage from your social media account through that platform's own settings (e.g., Facebook Settings > Apps and Websites > Remove), your OAuth access token is immediately revoked and deleted from our systems — no further action is required from us.

Retention Exceptions

Some data may be retained beyond a deletion request where required by Indian law (e.g., GST invoice records, financial transactions) or where data is needed to resolve a pending dispute or legal claim. We will inform you of any such exception.

14. Grievance Officer

As required under Rule 5(9) of the IT (SPDI) Rules, 2011 and the DPDP Act 2023, we have designated a Grievance Officer:

15. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policies of any third-party sites you visit.

16. Children's Privacy

PostStage and all Mathurs24 services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided personal data without verifiable parental consent, we will delete it promptly. If you believe a minor has created an account, please contact us at info@mathurs24.com.

17. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of the Republic of India, including the Information Technology Act, 2000, the IT (Amendment) Act, 2008, the Digital Personal Data Protection Act, 2023, and applicable rules thereunder.

Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts in New Delhi, India.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated policy will be published on this page with a revised "Last Updated" date. Continued use of our website or PostStage after such changes constitutes your acceptance of the revised policy.