Privacy Policy

This policy explains what personal data Tyashin collects, why we collect it, who we share it with and what rights you have. It covers tyashin.com, the Tyashin admin app at admin.tyashin.com, and the websites and stores we host for our customers. Our LinkedIn product at linkedin.tyashin.com has its own privacy policy.

1. Who we are

Tyashin is run by three companies in the same group. Which one you deal with depends on where you are. For a business account, that is the country of the business's billing address.

• India: Aapastech Private Limited (CIN U72900DL2022PTC395508; registered office 8/3, 2nd Floor, Roop Nagar, Delhi 110007, India). It is the data fiduciary for your personal data under Indian law.
• European Union and United Kingdom: Aapastech OÜ (registry code 16453146, VAT EE102489493, Tornimäe tn 3 // 5 // 7, 10145 Tallinn, Estonia). It is the controller of your personal data under the GDPR and the UK GDPR.
• Everywhere else: 14818032 Canada Inc. (Burlington, Ontario, Canada). It is the controller of your personal data.

The three companies share engineering, hosting and support, and each processes personal data for the others under a written intra-group agreement. In this document "Tyashin", "we" and "us" mean whichever of them you deal with.

For the personal data described in sections 2 and 3, the company you deal with decides why and how it is used. For personal data that our customers collect on their own sites, the customer decides and we process it on their behalf (see section 4).

2. What we collect and why

Your account. When you sign up we collect your name, email address and password, the name of your business, your country and your currency. We store your password only in hashed form. If you sign in with Google, Google shares your name, email address and profile photo with us. We use this data to create and run your account, sign you in, keep the account secure and contact you about it.

Billing. If you buy a plan or an add-on, we keep your billing details, the products you bought, your invoices and your payment records. You enter card or bank details with Razorpay or Stripe, not with us; they tell us whether a payment succeeded and give us a reference for it. We use this data to take payment, issue tax invoices and meet our accounting and tax duties.

How you use Tyashin. When you use the admin app we record the pages you open, links and downloads you click, errors and page speed, linked to your account ID, email address, name and role. Our servers also log your IP address, browser and device details and the time of each request, and we work out your approximate country from your IP address. We use this to run, secure, fix and improve Tyashin.

Your sites and content. We store what you and your team put into Tyashin: pages, products, images, blog posts, brand details, briefs for Website Studio and the information your chatbot answers from. This can include personal data, such as the names and photos of your staff. We use it to build, host and run your site and to provide the features you turn on, including AI features. Section 5 names the AI providers.

When you contact us. If you use our contact form we receive your name, email address, company, topic and message, your phone number if you give it, the page you wrote from and your country. If you sign up for product updates we keep your email address and where you signed up. If you chat with the assistant on tyashin.com, we keep the conversation. We also keep the emails and WhatsApp messages you send us. We use all of this to answer you, support you and send the updates you asked for.

Your sites' results. For each site you run on Tyashin we keep a record of results: the number of leads, orders and chat conversations, and the value of orders. It holds nothing about your visitors. If you run your business as an individual, these figures can relate to you, so we treat them as your personal data. We use them to run, bill, secure and improve Tyashin, and keep them while your account is open. Section 9 of our terms explains this and the YOM analytics account we open for your sites.

Visits to tyashin.com. When you browse tyashin.com we record the pages you view, the page you came from, your browser, screen size and language, and a random visitor ID. If a page shows an error, we receive the error message and the page address. We use this to count visits, see which pages are useful and fix problems.

3. Cookies and browser storage

tyashin.com does not use advertising cookies and does not load tracking scripts from other companies. The only cookie it may set is one that keeps you on the same version of the site while we test a new version; it records only which version you see. Our pages also keep a few items in your browser's storage:

• a random visitor ID (aapas_vid) that our analytics uses to tell new visits from return visits;
• the chat assistant's conversation and visitor IDs and a few display settings (items named aapas_chat_, aapas_visit_count and aapas_nav_count), so the assistant can pick up a conversation where you left it;
• a random session ID (__tyTelSid) attached to error reports, which your browser deletes when you close the tab.

In the admin app we keep your sign-in session in your browser's local storage (auth-storage) so you stay signed in. Our analytics, YOM, stores a random ID (yom_anon_id) and a session ID, and it records nothing if your browser sends a Do Not Track or Global Privacy Control signal.

Sites we host for our customers may use cookies or browser storage for sign-in, shopping carts, consent choices and their chat assistant. The business that runs each site decides this, and its own privacy policy should explain it.

You can clear or block cookies and browser storage in your browser settings. tyashin.com still works if you do, but the chat assistant will forget your conversation.

4. Data we process for our customers

Businesses that use Tyashin collect personal data from the people who visit and buy from their sites: contact form and lead details, orders and delivery addresses, newsletter sign-ups, shopper accounts, chat conversations, analytics, error reports, and visitors' IP addresses and device details. For this data the business is the data fiduciary (or controller) and we are its processor. We process the data only to run the site and the features the business has turned on, and only on its instructions. The Tyashin Data Processing Addendum sets out the terms.

If you visited or bought from a site hosted on Tyashin and want to use your rights, contact the business that runs the site. If you write to us instead, we will pass your request to that business and help it respond.

5. Who we share data with

We share personal data with the service providers below, which process it for us so we can run Tyashin. This is our sub-processors list. Where a provider runs a global network, your data can be processed in any country where it operates.

• Aapastech Private Limited (India), our group company. Builds and operates the platform, and processes personal data for Aapastech OÜ and 14818032 Canada Inc.
• 14818032 Canada Inc. (Canada), our group company. It is the controller for users outside India, the European Union and the United Kingdom. It operates YOM together with Aapastech Private Limited, bills its own customers, and processes personal data for Aapastech OÜ. The European Commission and the United Kingdom recognise Canada as giving adequate protection.
• Cloudflare, Inc. (United States; global network). Hosts and delivers tyashin.com, the admin app, our customers' sites and our API. Holds site data such as form submissions, chat conversations and analytics, stores uploaded files, protects against attacks, and runs the servers behind Website Studio.
• MongoDB, Inc. (MongoDB Atlas, hosted on Google Cloud in Mumbai, India). Our main database: accounts, teams, projects, billing records and store orders.
• Razorpay Software Private Limited (India). Takes payments in Indian rupees. The Razorpay account is held by Aapastech Private Limited.
• Stripe (United States and other countries where Stripe operates). Takes card payments from customers outside India, for Aapastech OÜ (European Union and United Kingdom) and 14818032 Canada Inc. (everywhere else).
• Resend (United States). Sends emails from Tyashin, such as sign-in links, receipts and notices, and the emails our customers' sites send to their own customers, such as order confirmations.
• Google LLC (Google Workspace; United States and other countries). Our company email, including contact@aapastech.com and hello@tyashin.com.
• OpenAI (United States). Writes the chat assistant's replies on sites that use our chatbot, including tyashin.com, creates images for blog posts and powers some SEO and writing features. It receives the chat messages and site content these features need.
• Anthropic (United States). Builds sites in Website Studio, writes blog posts, powers AI editing in the site editor and fixes failed site builds. It receives the briefs, site content and code these features need.
• GitHub, Inc. (United States). Stores the source code of the sites we build and host, and runs their build and deploy jobs.
• Slack Technologies (United States). Carries our internal alerts about errors, service health and account usage. An alert can include a business or site name, the page where an error happened and the error message.
• YOM (yom.aapastech.com; India and Canada, running on Cloudflare), operated by our group companies Aapastech Private Limited and 14818032 Canada Inc. Analytics for the admin app and for sites that use our analytics features.

Services you choose to connect. If you sign in with Google, or connect Google Analytics, Google Search Console, Bing Webmaster Tools, a GitHub repository or Thridify to your project, data passes between us and that service so the connection works, and the service handles it under its own terms. If you message us on WhatsApp, WhatsApp handles the message under its own terms.

Aggregated statistics. We may publish statistics built from data across many sites, such as benchmarks. They contain no personal data, and our terms set out the rules we follow.

When the law requires it. We disclose personal data to courts, government agencies and law enforcement when the law requires us to.

We do not sell personal data.

6. Your rights in India

You can ask us for a summary of the personal data we hold about you and what we do with it, ask us to correct, complete, update or delete it, withdraw any consent you gave (as easily as you gave it), and nominate someone to act for you if you die or become unable to act. Email contact@aapastech.com. We answer within one month, and never later than the law allows. We may ask you to confirm your identity, but only with information we already hold.

7. Your rights under the GDPR and the UK GDPR

If you are in the European Union or the United Kingdom. Aapastech OÜ is the controller. We process your account and billing data to perform our contract with you, tax records to meet legal obligations, and security logs, fraud checks and aggregate usage statistics on the basis of our legitimate interest in running a safe and reliable service; you can object to that last use at any time. We send marketing email only with your consent. You can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object or withdraw consent, by emailing contact@aapastech.com. You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), to the authority where you live, or in the United Kingdom to the Information Commissioner's Office (ico.org.uk). Our group companies operate the services for Aapastech OÜ: 14818032 Canada Inc. in Canada, which the European Commission and the United Kingdom recognise as giving adequate protection, and Aapastech Private Limited in India. Some of our service providers are in the United States. Transfers to India and the United States are covered by the European Commission's Standard Contractual Clauses with the UK Addendum, or by the EU-U.S. and UK-U.S. Data Privacy Framework where the provider is certified. You can ask us for a copy.

8. Your rights in Canada

If you are in Canada. 14818032 Canada Inc. is the controller. Under the Personal Information Protection and Electronic Documents Act (PIPEDA) you can ask for access to the personal information we hold about you and ask us to correct it. You can withdraw your consent at any time, subject to legal or contractual limits and reasonable notice, and we will tell you what that means for the service. You can also challenge how we comply with PIPEDA. Write to our Privacy Officer at contact@aapastech.com. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

If you are in Quebec. Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, gives you the same rights of access and correction. You can also ask us to stop disseminating your personal information, or to de-index a link attached to your name that gives access to it, where the law allows. You can ask to receive the computerized personal information we collected from you in a structured, commonly used technological format. If we make a decision about you based exclusively on automated processing of your personal information, we will tell you, and you can submit your observations to a member of our staff who can review the decision. You can reach the person in charge of the protection of personal information at contact@aapastech.com. You can complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

9. How long we keep data

We keep personal data while your account is active and as long as we need it for the purpose you gave it for, then delete it. Some records stay longer because the law requires it: invoices and tax records for 8 years, and security logs for 180 days under Indian cyber security rules (we are extending this to every system by 31 December 2026). From 13 May 2027 Indian law will also require us to keep personal data, related traffic data and processing logs for one year from processing. From then, when we delete your data from our systems we will keep a sealed copy for the rest of that year, which nobody uses except to meet that legal duty, and then destroy it.

10. Where data goes

We use service providers in other countries, listed on our sub-processors list. Transfers out of India follow section 16 of the Digital Personal Data Protection Act, 2023; we will not transfer data to any country the Government of India restricts.

11. Security

We keep a documented information security programme: encryption in transit, access limited to staff who need it, logging, and incident response. If a breach affects your personal data we will tell you and the authorities as the law requires.

12. Children

Tyashin is a service for businesses and is not for anyone under 18. Do not create an account or send us personal data if you are under 18. If you think a child has given us personal data, tell us at contact@aapastech.com and we will delete it.

13. Complaints and our Grievance Officer

Contact our Grievance Officer (see /grievance). If you are not satisfied, you can complain to the Data Protection Board of India once the relevant provisions apply. If you are in the European Union or the United Kingdom, section 7 explains how to complain to a data protection authority. If you are in Canada, the Grievance Officer page explains how to contact the Office of the Privacy Commissioner of Canada.

Grievance Officer: Shikha Gupta, Aapastech Private Limited, 8/3, 2nd Floor, Roop Nagar, Delhi 110007, India. Email contact@aapastech.com, phone +91 96677 47082. Shikha Gupta is also the privacy contact for Aapastech OÜ and our Privacy Officer for 14818032 Canada Inc. (+1 437 800 0190).

14. Changes to this policy

We may update this policy. When we do, we change the date at the top of this page, and if a change matters to you we tell you by email or in the product before it takes effect.

15. Contact us

Email contact@aapastech.com, or write to the company you deal with:

• Aapastech Private Limited, CIN U72900DL2022PTC395508. Registered office: 8/3, 2nd Floor, Roop Nagar, Delhi 110007, India.
• Aapastech OÜ, registry code 16453146, VAT EE102489493. Tornimäe tn 3 // 5 // 7, 10145 Tallinn, Estonia.
• 14818032 Canada Inc., Burlington, Ontario, Canada.

A Hindi version is available: हिन्दी में पढ़ें. Ask us at contact@aapastech.com if you need this policy in another language listed in the Eighth Schedule to the Constitution of India, and we will send it within 7 days.