1. Who we are
Psalm is operated from London("we", "us"). For the personal data you enter into your workspace about your own customers, employees and contacts, you are the controller of that data and we act as your processor, handling it on your instructions to provide the Service.
2. Information we collect
- Account information: your name, email address, company name, role and password (stored in hashed form).
- Business data you enter: the records you create in the Service, such as leads, contacts, quotations, invoices, payments, inventory and project details. This may include personal data about your own customers and staff.
- Usage and device data: log information such as actions taken in the app, timestamps, IP address and browser type, used for security and to operate the Service.
- Notifications: if you enable reminders, we store the technical subscription needed to deliver push notifications to your device.
3. How we use information
- To provide, maintain and secure the Service and your workspace.
- To authenticate users and enforce access permissions between and within companies.
- To send service-related communications (for example, email verification, password resets and reminders you have set up).
- To provide support and to diagnose and fix problems.
- To comply with legal obligations and enforce our Terms.
We do not sell your data, and we do not use your business data for advertising.
4. Legal basis and consent
We process personal data to perform our contract with you, to pursue our legitimate interest in operating and securing the Service, to comply with the law, and where required, on the basis of consent (which you may withdraw). Where you upload personal data about others, you are responsible for having a lawful basis to do so.
5. Service providers we share data with
We use a small number of trusted providers to run the Service. They process data only on our instructions and under confidentiality and data-protection obligations:
- Supabase — database, authentication and file storage.
- Vercel — application hosting and delivery.
- Resend — sending transactional email (such as confirmations and password resets).
- A payment processor — if and when you purchase a paid plan, to handle billing. We do not store your full card details.
We may also disclose information if required by law, to protect our rights or the safety of users, or in connection with a business transfer, subject to this policy.
6. Where your data is stored
Your data is hosted on secure cloud infrastructure located in the United Kingdom / European region. Because we and many of our users are in India, your data may be transferred to and stored on servers outside India. We take steps to ensure it is protected wherever it is processed.
7. Security
We protect data with measures including encryption in transit, hashed passwords, strict row-level access controls that keep each company's data isolated, role-based permissions, and regular backups. No system can be guaranteed perfectly secure, but we work to protect your information and to limit access to those who need it to operate the Service.
8. Data retention
We keep your information for as long as your workspace is active and as needed to provide the Service. After a workspace is closed, we retain data for a limited period to allow recovery and to meet legal or accounting obligations, after which it is deleted or anonymised. Operational logs are kept only for a limited time.
9. Your rights
Subject to applicable law (including India's Digital Personal Data Protection Act, 2023), you may request to access, correct, update or delete your personal data, and you may withdraw consent where processing is based on it. Much of your data can be viewed and edited directly in the app. To make a request or raise a concern, contact us using the details below. We may need to verify your identity before acting on a request.
10. Cookies
We use essential cookies and similar storage to keep you signed in and to remember preferences such as your theme. These are necessary for the Service to work; we do not use third-party advertising cookies.
11. Children
The Service is intended for businesses and is not directed to individuals under 18.
12. Changes to this policy
We may update this policy from time to time. We will post the updated version here with a new "last updated" date and, for material changes, take reasonable steps to notify you.
13. Contact and grievances
For any privacy question, request or grievance, contact Psalm, London, at info@solidsurface.co.in. We will respond within the timelines required by applicable law.