Privacy policy

MuDex holds sensitive business information — including KYC documents of businesses and the people behind them. This policy explains, in plain words, what we collect, why, how we protect it, who can see it, and what you can ask us to do with it.

1. Who we are

MuDex is a sole proprietorship owned by Dhruv Rajesh Hundia, with its principal place of business at 1st Floor, Samruddhi Residency, Opp. Sarovar Complex, Nr. Girish Cold Drink Cross Road, Off C.G. Road, Ahmedabad, Gujarat 380009, India (“MuDex”, “we”, “us”).

This policy covers our website mudex.in and our application at app.mudex.in (together, the “Service”).

2. What we collect

About you and your business

• Account details: your name, email address, mobile number and a protected (hashed) form of your password. If you sign in with Google, we receive your name and email address from Google — nothing else.
• Business details: business name, GSTIN, address, the companies you add, and the people you invite to your team with their roles and access.
• Your KYC with MuDex: the documents and details you submit to be verified by MuDex — for example PAN, GST certificate, bank details, Aadhaar, photographs and signatures of authorised persons, and the forms you fill in.

That you enter in the Service

• Trading: the paper trades, alerts and costing sheets you record. These are records for tracking only; no orders are placed.
• Inventory: stock, purchases, sales and the customers and suppliers you add.
• Your parties’ KYC: documents and details of your customers and suppliers that you upload, or that they fill in through a KYC link you send them.

When you use the Service

• Sign-in and security: session records, the browser you use and the time of sign-in.
• When you report a problem: what you write, the page you were on, your browser and screen size, and any screenshot you choose to attach.
• Billing: what you are charged and the payments you make (amount, date, method and reference).

We do not use advertising trackers and we do not sell personal data.

3. Why we use it

• To provide the Service: your account, your companies and team, live rates, trades, stock and KYC.
• To check new registrations before they go live, so businesses on MuDex are real.
• To verify your KYC when you ask to be “Verified by MuDex”, and to share it with other businesses only when you approve.
• To send you emails you need: welcome and verification, password resets, invitations, approvals, KYC requests and replies to problems you report.
• To bill you for your subscription and keep records of payments.
• To help you when you report a problem, and to keep the Service secure.
• To meet our obligations under law.

We process your personal data on the basis of your consent, given when you register and when you submit information, and for the legitimate uses permitted by the Digital Personal Data Protection Act, 2023. You can withdraw consent at any time (see section 9); this does not affect what was done before you withdrew, and some features will stop working without the data they need.

4. Your parties’ KYC: who is responsible

When you collect KYC from your customers or suppliers on MuDex, you decide what to collect and why. For that data, your business is responsible for having a lawful reason and, where needed, the party’s consent; MuDex processes it on your behalf, only to provide the Service to you. A party who fills in a KYC link gives their information to the business that sent the link.

5. Who can see your data

• Your team — each person sees only the companies the owner has given them.
• Other businesses on MuDex — only your company’s KYC, only after you approve their request, and you can withdraw it.
• MuDex staff — only to approve registrations, verify KYC, and help you when you ask us to. Every time staff open a company’s KYC or change an account, it is recorded in an access log.
• Service providers who help us run MuDex, under contract and only for that purpose: email delivery (Resend), sign-in with Google (Google), and our cloud hosting provider. Some of them may process data outside India; where they do, we use providers with appropriate safeguards and transfer data only as the law allows.
• Authorities — when the law requires it, for example a valid order from a court or regulator.

6. How we protect it

• KYC documents, form answers, document numbers and PANs are encrypted before they are stored, with a separate key for each company.
• All connections to MuDex use HTTPS. Passwords are never stored, only a protected (hashed) form of them.
• Each company’s data is kept apart from other companies’, even within the same account.
• Staff access is limited and logged.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.

7. How long we keep it

We keep your data while your account is active. If you close your account, we delete or anonymise your data within 90 days, except what we must keep longer by law (for example tax and billing records) — that is kept only for as long as the law requires, and then deleted.

8. Cookies and storage

We use one essential cookie to keep you signed in, and your browser’s storage for preferences such as your theme or the company you last viewed. We do not use cookies for advertising or tracking across other websites.

9. Your rights

Under the Digital Personal Data Protection Act, 2023 you can ask us to:

• tell you what personal data we hold about you and how we use it, and who we have shared it with;
• correct, complete or update it;
• erase it, where we no longer need it or you withdraw consent (unless the law requires us to keep it);
• withdraw your consent;
• nominate someone to exercise these rights for you in case of death or incapacity.

Much of your data you can see and change yourself in the app. For anything else, write to us at support@mudex.in. We may need to confirm your identity first. We will respond within 30 days.

10. Children

MuDex is for businesses. It is not meant for anyone under 18, and we do not knowingly collect their data.

11. Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect. The date at the top shows when it was last updated.

12. Grievance officer and contact

For any question or complaint about your personal data, contact our grievance officer:

[Name], Grievance Officer
MuDex, 1st Floor, Samruddhi Residency, Opp. Sarovar Complex, Nr. Girish Cold Drink Cross Road, Off C.G. Road, Ahmedabad, Gujarat 380009
Email: [grievance email] · Phone: [phone]

We will acknowledge your complaint within 48 hours and try to resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.