Privacy policy
How Bildara collects, uses, shares and protects personal data in Prastavone.
Last updated 13 November 2026 · Version 2026-11-06
In short — a plain-English summary. It does not replace the full text below.
- We collect only what we need to run the Service, bill you and keep it secure.
- Your proposals and client details are encrypted in your browser before they are stored; the database holds only encrypted data.
- Free trial work never leaves your browser.
- We never sell data, never use it for advertising and never use it to train AI.
- Data is stored in India. You can access, correct, erase or export it.
1. Who we are and what this policy covers
Prastavone is a product of Bildara, owned and operated by Kinjal Jay Joshi, Ahmedabad, Gujarat, India. This policy explains how we process personal data when you visit prastavone.bildara.in, use the Prastavone app or a Proposal Room, contact us, or pay for a plan. It follows the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
By using the Service and ticking “I agree”, you give your consent to the processing described here where consent is the basis. You can withdraw consent at any time (section 10).
2. Our role: Data Fiduciary and Data Processor
- Bildara is the Data Fiduciary for: account and sign-in data, trial records, consent records, billing data, website enquiries, support messages and security logs.
- Your organisation is the Data Fiduciary for the content it puts into its Companies, including details of its clients and contacts and what clients write in a Proposal Room. Bildara processes that data as your organisation’s Data Processor, only to provide the Service (see section 13 of the Terms). If you are a client of one of our customers, please contact that business about your data; we will pass on any request we receive.
3. Personal data we collect
- Account data: name, Google email address, profile picture link, role, designation, the Companies you belong to and invitation details. We receive these from Google when you sign in; we never receive your Google password.
- Free trial record: your Google email, the date the trial started and your terms acceptance. Your trial work itself is not sent to us (section 4).
- Consent records: the version of the terms you accepted, the date and time, the items you ticked, whether you accepted for your organisation, and a short browser description.
- Company content: proposals, client and contact details, products, prices, pictures, attachments, notes and settings added by your team. This is encrypted in your browser before it is stored.
- Proposal Room data: what a client does in a Proposal Room — opening the proposal, comments, change requests, and the name, title and email typed when accepting — encrypted with the room’s key.
- Billing data: plan, Add-ons, invoices, billing name and address, GSTIN, payment amounts, dates and status, and payment references. Card, UPI and bank details are collected by our payment gateway, not by us.
- Enquiries and support: name, email, company, phone and message sent through our contact form (sealed so only our Admins can read them) or by email.
- Security and usage logs: sign-ins and sign-outs, invitations, role changes, deletions, backups, billing events and errors, with date, time and browser type, kept to protect the Service and investigate misuse.
- Notifications: the email address and preferences used to send you service, billing and security emails.
We do not ask for sensitive data such as passwords, health, biometric or financial account data. Please do not put such data into proposals unless your organisation is entitled to and has a lawful basis.
4. Free trial: your work stays in your browser
During the 30-day Free trial, your proposals, customers, products and settings are saved only in your browser on your device, separately for each Google account. They are not uploaded to us, we cannot read them, and we cannot recover them if your browser data is cleared. When you choose a paid plan, you decide whether to move your trial work into your Company online.
5. Why we use personal data and on what basis
- To create and secure your account, sign you in and manage invitations and roles — to provide the Service you asked for (consent and contract).
- To provide, operate, maintain and support the Service, including the Proposal Room and notifications — consent and contract.
- To process payments, issue GST invoices, keep accounts and meet tax and legal obligations — legal obligation (a legitimate use under section 7 of the DPDP Act).
- To send service, billing, renewal and security messages — contract and legal obligation. These are not marketing and cannot be switched off while you have an account.
- To prevent, detect and investigate fraud, abuse, security incidents and breaches of our terms — legitimate uses permitted by law.
- To reply to enquiries and, if you ask, send you product news — consent, which you can withdraw at any time.
- To comply with court orders and lawful requests of government authorities — legal obligation.
We do not sell personal data, do not use company content for advertising or profiling, and do not use it to train artificial-intelligence models.
6. Who we share it with
- Other members of your Company can see what your Admins share with them, according to their roles.
- Your clients see the proposals you share with them through a Proposal Room, and your name and company as shown in the proposal.
- Our service providers (sub-processors), under contract, only to run the Service — see section 7.
- Authorities and legal reasons: where required by law, court order or a lawful request of a government agency, or where necessary to protect the rights, safety and property of our users, the public, Bildara or Kinjal Jay Joshi.
- Business transfer: if Prastavone or the business is transferred to a successor (for example a company formed by Kinjal Jay Joshi), under terms at least as protective as this policy, with notice to you.
7. Service providers (sub-processors)
| Type of provider | What for | Where |
|---|---|---|
| Cloud hosting and database provider | Hosting the app and website, the database and sign-in | Data stored in India; sign-in and network services may run in other countries |
| Payment gateway (PCI DSS-compliant) | Payments and payment records | India |
| E-mail service provider | Service, billing and support e-mails | India and other countries |
We will update this list before adding a new sub-processor. More detail is on the Third-party services page.
8. Where data is stored and how it is protected
Our database and file storage are hosted with a leading cloud provider in India. Some data (for example Google sign-in, email delivery and content-delivery networks) may be processed outside India; we transfer personal data only to countries not restricted by the Government of India under the DPDP Act.
- HTTPS with HSTS for every connection.
- AES-256-GCM encryption of company content in your browser before it is stored, so the database and its backups hold only encrypted data.
- Proposal Room pages and events encrypted with a separate AES-256 key carried only in the link.
- Messages sent through our website are sealed so that only the intended team can read them.
- Access rules checked on the server for every request; invitation-only Google sign-in; automatic sign-out after inactivity.
- Password-protected backups and an append-only security log.
If a personal data breach occurs, we will inform the affected people and the Data Protection Board of India as the DPDP Act and its rules require (for the Board, within 72 hours of becoming aware, or such other period as the rules set), and, where we act as a Data Processor, the affected customer without undue delay.
9. How long we keep it
| Data | Kept for |
|---|---|
| Company content | While the account exists, including while read-only. Deleted within 30 days of a verified deletion request (plus up to 90 days in expiring encrypted backups), or after 24 months read-only without a plan, after 90 days’ notice. |
| Trial record (email, start date, consent) | As long as needed to prevent repeat trials and prove consent, up to 3 years after the trial ends. |
| Proposal Room data | While the proposal exists in the Company; accepted versions are kept with the proposal as a record. |
| Security and access logs | At least 1 year, as the law requires, and up to 2 years. |
| Website enquiries and support messages | Up to 24 months after the last contact. |
| Billing, invoice and tax records | As long as Indian tax and company law require (usually 8 years). |
| Consent records | As long as needed to prove consent, and at least as long as the related data is kept. |
10. Your rights
- Access: get a summary of your personal data we process, the processing activities, and the people we have shared it with.
- Correction and erasure: ask us to correct, complete, update or erase your personal data. Some data must be kept by law (for example invoices).
- Withdraw consent: at any time, as easily as you gave it. This does not affect processing before withdrawal; we may then be unable to provide the Service to you.
- Nominate another person to exercise your rights if you die or become incapable.
- Grievance redressal: complain to our Grievance Officer, and if you are not satisfied, to the Data Protection Board of India.
Send requests to jay.joshi@bildara.in or our contact form. We may need to verify your identity. We reply as soon as possible and within the time the law allows (we aim for 30 days). If your data is part of a customer’s Company (for example you are a client of one of our customers), we will forward your request to that customer, who decides on it.
Under the DPDP Act you also have duties: do not give false information, impersonate anyone, or file frivolous complaints.
11. Cookies and browser storage
We use only strictly necessary browser storage and no advertising or tracking cookies. See the Cookie policy.
12. Children
The Service is for businesses and is not meant for anyone under 18. We do not knowingly process children’s personal data. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to this policy
We will post changes here with a new version number and date. For material changes we will tell you by email or in the app and ask you to accept the new version before you continue to use the Service.
14. Contact and Grievance Officer
Kinjal Jay Joshi, Grievance Officer, Bildara, Ahmedabad, Gujarat, India. Contact: jay.joshi@bildara.in or our contact form. See Grievance redressal for how complaints are handled.