Grano is a product of KAIN Labs, Chennai, India ("we", "us"). This policy covers the Grano website, the Grano app at your mill's address, the buyer and supplier portal, and the tools our team uses to support mills. It is written for the Digital Personal Data Protection Act, 2023 and the rules made under it.
Two roles: your mill's data and our own
When a mill uses Grano, the mill decides what goes into its books – suppliers, farmers, buyers, staff, rates and payments. For that data the mill is the Data Fiduciary and we process it on the mill's behalf, only to run the service. For the people who sign up, request a demo or visit our website, we are the Data Fiduciary.
What we collect
- Account details: name, mobile number, language, role and, if you add one, email address.
- Sign-in data: one-time codes sent by SMS (kept only until they expire), the session cookie, and an authenticator secret if you turn on two-step sign-in.
- Mill data you enter: purchases, weighbridge readings, lots, milling runs, stock, sales, invoices, payments, vouchers, payroll and attendance, and the parties in them – farmers, brokers, suppliers, buyers and staff, with their phone numbers, addresses, GSTIN, PAN and bank details where you record them.
- Files you upload: weighbridge and invoice photos, Tally exports, CSV imports.
- Demo, signup and trial setup forms: what you type into them.
- Technical data: IP address, browser, pages requested and error reports, used to keep the service secure and working.
We do not sell personal data, show advertising inside the app, or use mill data to train AI models.
Why we use it
- To run the service: sign you in, store and calculate your books and stock, and produce invoices, statements, reports and exports.
- To send the messages you switch on: WhatsApp statements and alerts, SMS codes and alerts, and email.
- To bill the subscription and keep GST records of our own invoices.
- To support you, fix faults and protect accounts from misuse.
- To tell you about changes to Grano. You can opt out of anything that is not about your account.
Who processes data for us
We use these providers, each only for the part of the service named here:
- MongoDB Atlas – database hosting.
- Vercel – application hosting and logs.
- Meta (WhatsApp Cloud API) – WhatsApp messages the mill turns on.
- MSG91 – SMS sign-in codes and SMS alerts.
- Resend – email.
- Razorpay – subscription payments. We never see or store card numbers.
- Cloudinary – photo and file storage.
- Anthropic – only when a mill uses the AI features in the Analytics add-on (Ask Grano, photo-to-entry). The question or photo and the figures needed to answer it are sent for that request.
- A GST Suvidha Provider chosen by the mill – only if the mill turns on e-invoicing or e-way bills.
- Tally, Zoho or Shopify – only the connections a mill sets up itself.
Some of these providers store data outside India. We choose providers with contractual security commitments and send them only what their part of the service needs.
Cookies
Grano uses only the cookies it needs: the sign-in session, your language, light or dark theme, and the mill you last chose. There are no advertising or cross-site tracking cookies.
How long we keep it
- Mill books and documents are kept while the mill's account is active. Indian tax law expects accounts to be kept for several years, so entries are voided rather than deleted, and the history stays.
- After a mill closes its account we keep its data for 90 days so it can be exported, then delete it, except what we must keep by law.
- Sign-in codes expire within minutes. Server logs are kept for a short period for security.
- Demo and signup requests are kept for up to two years unless you ask us to delete them sooner.
Security
Data travels over HTTPS. Each mill's data is scoped to that mill in every query and tested for isolation before each release. Access inside a mill follows roles that the owner controls, and every change is written to an audit log. No system is perfectly secure; if a breach affects your personal data we will tell you and the Data Protection Board as the law requires.
Your rights
Under the DPDP Act you can ask for a summary of your personal data and how it is used, ask us to correct, complete or erase it, withdraw consent, and name someone to act for you. If you are a farmer, buyer or staff member of a mill, the mill controls that data – ask the mill first; we will help them answer. A mill owner can export its data at any time from Reports.
Children
Grano is a business tool and is not meant for anyone under 18.
Grievances and contact
Write to us through the contact form on the demo page or on WhatsApp at the support number shown in the app. We reply within 7 days and resolve grievances within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.
Changes
If we change this policy we will update the date above, and tell mill owners in the app before a change that affects them takes effect.