1. Roles
- You are the Data Principal — the owner of your personal data.
- Manudocs Private Limited (operator of Ximverse) is the Data Fiduciary — the custodian who processes your data on your behalf.
- We act on your data only as you direct us.
2. Lawful basis for processing
- Your consent — given at signup
- Legitimate use — operating the platform you signed up for
- Legal compliance — Customs Act, GST Act retention requirements
3. Consent
- At signup, you explicitly consent to data processing for platform features
- You can withdraw consent anytime via Account Settings → Delete Account or by emailing connect@ximverse.com
- Withdrawal does not affect processing already completed
- After withdrawal, personal identifiers are deleted within 30 days (subject to statutory retention)
4. Your DPDP rights
Right to access
View all your data in your dashboard, or request a complete export via connect@ximverse.com.
Right to correction
Edit your profile, shipments, and documents directly in the platform. For corrections to filed records, contact us.
Right to erasure
Open Account Settings → Delete Account, or email connect@ximverse.com. Personal data is deleted within 30 days. Filed customs records are retained for the statutory 7-year period.
Right to grievance redressal
Email connect@ximverse.com. Initial response within 7 working days. Resolution attempted within 30 days.
Right to nominate
You may nominate a successor who will receive access to your account data in case of your death or incapacity. Email connect@ximverse.com to set a nominee.
5. Categories of personal data processed
| Category | Examples |
|---|---|
| Identity | Name, email, phone, PAN |
| Business | IEC, GSTIN, AD code, LUT |
| Operational | Export shipments, import BoE, buyers, suppliers, products, generated documents, IRN / DRN |
| Logistics | Containers, freight rates, tracking events |
| Finance | RoDTEP / Drawback claims, eBRC, IGST refund |
| Technical | IP, login times, session data |
6. Data retention
- Active accounts: while the account exists
- Personal identifiers post-deletion: erased within 30 days
- Filed Shipping Bills, invoices: 7 years (Customs Act, GST Act)
- Technical logs: 90 days
7. Data security
- TLS 1.3 in transit
- AES-256 at rest
- Bcrypt password hashing
- Role-based access
- Tenant-isolated file storage
- Periodic security review
8. Cross-border transfers
Some processing happens outside India in limited cases:
- AI document parsing & notification enrichment — Google Vertex AI / Gemini (content not retained for training)
- Email delivery — transactional email provider
By using the platform you consent to this limited cross-border processing.
9. Data breach notification
If a notifiable breach affects your data, we will:
- Notify the Data Protection Board of India within 72 hours
- Notify you by email without undue delay
10. Grievance officer
Name: Sumit Singh Rahar
Role:CEO & Data Protection Contact
Email: connect@ximverse.com
Response time: 7 working days for acknowledgment, 30 days for resolution
If unresolved, you may file a complaint with the Data Protection Board of India at dpb.gov.in (once operational).
11. Children
Ximverse is built for businesses. We do not knowingly process data of anyone under 18.
12. Updates
This notice may be updated. Material changes will be notified by email at least 30 days in advance.
13. Contact
Questions or requests: connect@ximverse.com