Privacy policy

Last updated: 26 October 2026

This portal is operated by NABHCLOUD on infrastructure supplied by BLAZING BULLET PRIVATE LIMITED. Both process your data as described below; NABHCLOUD is your first point of contact for privacy requests.

1. What we collect

Account data — name, email, phone, company details, addresses, GSTIN.
Identity verification (KYC) — for Indian individuals, name, masked Aadhaar number, date of birth, gender, address and photograph received from DigiLocker with your consent (we never see your full Aadhaar number); for businesses, GST registration details; for international customers, identity-document verification results from our KYC provider.
Billing data — orders, invoices, wallet ledger, and payment references from our payment gateway. We never store card numbers, UPI PINs or banking credentials.
Technical data — IP addresses, login and API activity, service allocation records, and resource-usage metering.
Support data — tickets and correspondence.

2. Why we process it

To provide, meter and bill the services you order (performance of contract).
To comply with Indian law — GST invoicing, the IT Act 2000, and CERT-In directions (which require identity verification of cloud customers, 180-day retention of system logs on Indian infrastructure, and reporting of cyber incidents within 6 hours).
To secure the platform: fraud prevention, abuse detection, login protection.
To send service messages — invoices, payment reminders, incident and maintenance notices. Marketing mail is sent only with consent and always with an opt-out.
To contact you about your account, orders, services and support by email, SMS, WhatsApp and phone calls, including automated and AI-assisted calls, as you consent to when creating an account (see the Terms of Service). Calls with our AI phone agent are recorded as a transcript and summary, which we keep with your support and sales records. You can opt out of calls, WhatsApp or SMS by writing to support@nabhcloud.com.

We do not sell personal data. It is shared only with processors needed to run the service:

Cashfree Payments (payment processing; GSTIN and Aadhaar/DigiLocker verification),
Didit (identity-document verification for international customers),
Cloudflare (bot protection on the login page, where enabled),
and with government agencies where Indian law compels disclosure.

Your account data, KYC records, logs and hosted content are stored on our own infrastructure located in India.

4. How long we keep it

System, access and API logs — 180 days (CERT-In direction).
Subscriber identity, KYC and service-allocation records — 5 years after account closure (CERT-In direction).
Invoices and financial ledgers — 8 years (GST and Companies Act requirements).
Terminated servers (accounts that have made at least one payment). We keep an encrypted copy of a terminated cloud server's disks for up to 90 days so that you can recover it, and to handle disputes and abuse investigations. Staff cannot browse its contents. You can ask for earlier deletion through a support ticket; we delete it within 7 days and confirm by email.
Everything else — deleted or anonymised when the account closes or on your valid request.

5. Your rights

Under the DPDP Act you may access a summary of your personal data, correct or update it (most of it directly in the panel), withdraw consent, nominate a person to exercise your rights, and request erasure — which we honour except for records we must keep under clause 4. Write to the grievance contact below; we respond within the statutory timelines. Unresolved complaints may be escalated to the Data Protection Board of India.

6. Security and breach notification

Access to personal data is role-restricted and audit-logged. KYC responses are stored encrypted; passwords are held by our identity provider using strong hashing; two-factor authentication is available on every account. Reportable cyber incidents are notified to CERT-In within 6 hours and affected users are informed without undue delay.

7. Cookies

The panel sets only functional cookies: a session cookie, a CSRF token, and (if you choose "remember me") a login cookie. No advertising or cross-site tracking cookies are used.

8. Grievance and contact

Grievance Officer, BLAZING BULLET PRIVATE LIMITED, D-62, Phase 2, Sector 80, Noida, Uttar Pradesh 201305 — support@nabhcloud.com, +91 99999 97462. This policy may be updated with notice per the Terms of Service.