Privacy Policy

This website is a marketing site for Thridify, our 3D and augmented-reality commerce platform and 3D modelling service. We collect the details you send through our contact form or our chat assistant so we can reply and set up a demo, the details you give us when you open a Thridify account, and basic information about how the site and its 3D demos are used. We do not run advertising trackers, and we do not sell your personal information. This policy explains, in plain terms, what we collect, why, how long we keep it, who we share it with, and the rights you have, including under the EU/UK GDPR, India’s Digital Personal Data Protection Act 2023 (DPDP Act) and Canada’s PIPEDA.

Thridify is run by three companies in the same group. Which one you deal with depends on where you are. For a business account, that is the country of the business’s billing address.

• India: Aapastech Private Limited (CIN U72900DL2022PTC395508; registered office 8/3, 2nd Floor, Roop Nagar, Delhi 110007, India). It is the data fiduciary for your personal data under Indian law.
• European Union and United Kingdom: Aapastech OÜ (registry code 16453146, VAT EE102489493, Tornimäe tn 3 // 5 // 7, 10145 Tallinn, Estonia). It is the controller of your personal data under the GDPR and the UK GDPR.
• Everywhere else: 14818032 Canada Inc. (Burlington, Ontario, Canada). It is the controller of your personal data.

The three companies share engineering, hosting and support, and each processes personal data for the others under a written intra-group agreement. In this document “Thridify”, “we” and “us” mean whichever of them you deal with.

This policy covers personal data we collect through this website and from people who hold a Thridify account. The Thridify app for Shopify has its own app privacy policy. When our customers use Thridify on their own stores and websites, we process their shoppers’ personal data for them, as their processor, under our Data Processing Addendum; the customer’s own privacy policy applies to that data.

You can reach us about any privacy matter at contact@aapastech.com.

We only collect what you choose to give us, plus basic technical data needed to serve the site securely.

• Contact-form details: your name, work email address, company name, the product category you sell, and any message you write.
• Thridify account details: if you open an account, your name, email address, company name, country and phone number, a hashed password (never the password itself) or the Google account you sign in with, and records of your plan, payments and invoices.
• Server and security logs: our hosting provider (Cloudflare) processes technical data such as IP address, browser type and request time to deliver the site, prevent abuse and keep it secure. This is standard for any website.
• Chat assistant: if you use the chat on this site, the messages you send and any file you attach, the page you were on, the page that referred you, your browser’s user agent, your country (as reported by Cloudflare) and random visitor, session and conversation IDs. If you type your email address, or leave a message for our team when no one is available, we may save it as an enquiry so we can reply.
• Site analytics: for each page you view, the page address and title, the page that referred you, your browser’s user agent, screen size and language, a session ID and a random visitor ID stored in your browser.
• 3D demos: the Thridify viewer in our demos records how they are used (the product and experience, the features used, the page address and referrer, and the device type). Without your consent it keeps its session ID only in memory.

We do not intentionally collect special-category or sensitive personal data through this site, and we do not buy or sell personal information.

We use the information above for these purposes:

• To respond to your enquiry and prepare a relevant demo of Thridify. Legal basis: your consent when you submit the form, and our legitimate interest (GDPR Art. 6(1)(f)) or steps taken at your request before entering a contract (Art. 6(1)(b)) in responding to a business enquiry you initiated. Under the DPDP Act we rely on your consent for the specified purpose; under PIPEDA, on your implied or express consent.
• To follow up about your interest in the platform. You can ask us to stop at any time.
• To run your Thridify account: to sign you in, provide the service, bill you and send you emails about your account. Legal basis: our contract with you (GDPR Art. 6(1)(b)); under the DPDP Act, the specified purpose for which you gave us the data; under PIPEDA, your consent.
• To answer questions through our chat assistant, and to pass the conversation to our team when you ask. Legal basis: your consent when you choose to start a chat (GDPR Art. 6(1)(a); under the DPDP Act, consent for that purpose; under PIPEDA, your express consent).
• To understand how the site and our demos are used and improve them (site analytics and demo events). Legal basis: legitimate interest in understanding how our website is used.
• To operate, secure and improve the site (server and security logs). Legal basis: legitimate interest in a safe, functioning website.

We do not use your submission for automated decision-making or profiling that produces legal or similarly significant effects.

We do not sell personal information and we share it only with service providers that process it on our behalf, under contract, for the purposes above:

• Cloudflare: website hosting, content delivery and security.
• The Tyashin platform (operated by Aapastech Private Limited): contact-form submissions are forwarded to, and stored in, our own lead-management system on this platform so our team can respond, and to the email inbox that receives new enquiries. The platform also runs our chat assistant and site analytics.
• OpenAI: generates the chat assistant’s replies, so the messages you send in the chat are passed to it.
• YOM (Your Own Metrics), our analytics service, operated by Aapastech Private Limited: processes site analytics and demo events. YOM does not store IP addresses.
• Google Cloud and MongoDB Atlas: hosting and database for the Thridify platform, including account data.
• Resend: sends account emails, such as sign-up verification and password resets.
• Razorpay: processes payments for plans and services you buy from us directly. If you use our Shopify app, Shopify bills you instead. Each company bills and collects payment from its own customers: Aapastech Private Limited in India, Aapastech OÜ in the European Union and the United Kingdom, and 14818032 Canada Inc. everywhere else.
• The other companies in our group (Aapastech Private Limited, Aapastech OÜ and 14818032 Canada Inc.): engineering, hosting and support, under a written intra-group agreement.

We may also disclose information where required by law, to protect our rights, or as part of a business reorganisation, in each case consistent with this policy.

We operate across India, North America (including Canada) and Europe, and our service providers may process data in countries other than your own. Where we transfer personal data internationally (for example between India, Canada and the EU/EEA), we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and our providers’ own transfer mechanisms, and we take steps consistent with the DPDP Act and PIPEDA to protect your information in transit and at rest.

We use service providers in other countries, listed in this policy. Transfers out of India follow section 16 of the Digital Personal Data Protection Act, 2023; we will not transfer data to any country the Government of India restricts.

We keep personal data while your account is active and as long as we need it for the purpose you gave it for, then delete it. Some records stay longer because the law requires it: invoices and tax records for 8 years, and security logs for 180 days under Indian cyber security rules (we are extending this to every system by 31 December 2026). From 13 May 2027 Indian law will also require us to keep personal data, related traffic data and processing logs for one year from processing. From then, when we delete your data from our systems we will keep a sealed copy for the rest of that year, which nobody uses except to meet that legal duty, and then destroy it.

Enquiries you send through our contact form are kept while we handle your request and any business relationship that follows, and for a reasonable period afterwards for our records, then deleted or anonymised. Chat conversations are deleted automatically after about 90 days. You can ask us to delete your details sooner at any time, subject to the legal duties above.

We keep a documented information security programme: encryption in transit, access limited to staff who need it, logging, and incident response. If a breach affects your personal data we will tell you and the authorities as the law requires. Our security page has more detail.

This site does not set advertising or cross-site tracking cookies. Cloudflare, which hosts the site, may set strictly necessary security cookies. Some features keep small items in your browser’s local storage or session storage instead of cookies:

• Chat assistant: a random visitor ID (aapas_chat_vid), your current conversation (aapas_chat_cid) and two items that decide when to show the chat button (aapas_chat_revealed, aapas_visit_count) in local storage; a session ID (aapas_chat_sid) and two display settings (aapas_chat_open, aapas_nav_count) in session storage. These let a conversation carry on from page to page.
• Site analytics: a random visitor ID (aapas_vid) in local storage.
• 3D demos: only if you give consent where the viewer asks for it, the Thridify viewer stores a session ID, a visitor ID and your choice (thridify_session, thridify_visitor, thridify_consent_v2) in local storage.

You can clear these items at any time in your browser settings. If we add advertising or other non-essential cookies, they will be off by default and loaded only after you consent, and we will list them here first.

Depending on where you live, you have some or all of the following rights over your personal information. We honour these requests regardless of your location, to the extent applicable law allows.

• Access: ask for a copy of the personal information we hold about you.
• Rectification or correction: ask us to correct inaccurate or incomplete details.
• Erasure: ask us to delete your details (also the DPDP Act right to erasure and the PIPEDA ability to withdraw consent).
• Restriction and objection: ask us to limit or stop certain processing, including direct follow-ups.
• Portability: receive the details you gave us in a portable, machine-readable format (GDPR).
• Withdraw consent: where we rely on consent, withdraw it at any time without affecting processing already carried out.
• Grievance and nomination (DPDP Act): raise a grievance with our Grievance Officer, Shikha Gupta (see Grievance Officer), and nominate another person to exercise your rights if you die or become unable to act.

To exercise any of these, email contact@aapastech.com and we will respond within the time required by applicable law. We may need to verify your identity first.

If you are in the European Union or the United Kingdom. Aapastech OÜ is the controller. We process your account and billing data to perform our contract with you, tax records to meet legal obligations, and security logs, fraud checks and aggregate usage statistics on the basis of our legitimate interest in running a safe and reliable service; you can object to that last use at any time. We send marketing email only with your consent. You can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object or withdraw consent, by emailing contact@aapastech.com. You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), to the authority where you live, or in the United Kingdom to the Information Commissioner’s Office (ico.org.uk). Our group companies operate the services for Aapastech OÜ: 14818032 Canada Inc. in Canada, which the European Commission and the United Kingdom recognise as giving adequate protection, and Aapastech Private Limited in India. Some of our service providers are in the United States. Transfers to India and the United States are covered by the European Commission’s Standard Contractual Clauses with the UK Addendum, or by the EU-U.S. and UK-U.S. Data Privacy Framework where the provider is certified. You can ask us for a copy.

You can ask us for a summary of the personal data we hold about you and what we do with it, ask us to correct, complete, update or delete it, withdraw any consent you gave (as easily as you gave it), and nominate someone to act for you if you die or become unable to act. Email contact@aapastech.com. We answer within one month, and never later than the law allows. We may ask you to confirm your identity, but only with information we already hold.

If you are in Canada. 14818032 Canada Inc. is the controller. Under the Personal Information Protection and Electronic Documents Act (PIPEDA) you can ask for access to the personal information we hold about you and ask us to correct it. You can withdraw your consent at any time, subject to legal or contractual limits and reasonable notice, and we will tell you what that means for the service. You can also challenge how we comply with PIPEDA. Write to our Privacy Officer at contact@aapastech.com. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

If you are in Quebec. Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, gives you the same rights of access and correction. You can also ask us to stop disseminating your personal information, or to de-index a link attached to your name that gives access to it, where the law allows. You can ask to receive the computerized personal information we collected from you in a structured, commonly used technological format. If we make a decision about you based exclusively on automated processing of your personal information, we will tell you, and you can submit your observations to a member of our staff who can review the decision. You can reach the person in charge of the protection of personal information at contact@aapastech.com. You can complain to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).

Shikha Gupta is our Grievance Officer for India, the Privacy Officer of 14818032 Canada Inc., the person in charge of the protection of personal information for Quebec, and the privacy contact for Aapastech OÜ. Email contact@aapastech.com, or call +91 96677 47082 (India) or +1 437 800 0190 (Canada). Our grievance page explains how to complain and how quickly we respond.

We would like the chance to resolve any concern directly, so please contact our Grievance Officer first at contact@aapastech.com. You also have the right to complain to a data-protection authority:

• India: the Data Protection Board of India, which was established on 13 November 2025. You can complain to it once the relevant provisions of the DPDP Act apply, after using our grievance process.
• EU / EEA / UK: the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), the authority where you live, or in the UK the Information Commissioner’s Office (see the GDPR section above).
• Canada: the Office of the Privacy Commissioner of Canada, or your provincial privacy commissioner. In Quebec, the Commission d’accès à l’information.

This is a business-to-business website and is not directed at children. We do not knowingly collect personal information from anyone under 16 (or the age of digital consent in your jurisdiction). If you believe a child has given us personal information, contact contact@aapastech.com and we will delete it.

We may update this policy from time to time; the effective date at the top shows when it was last revised. Material changes will be reflected here before they take effect.

Aapastech Private Limited (data fiduciary for India), CIN U72900DL2022PTC395508, registered office 8/3, 2nd Floor, Roop Nagar, Delhi 110007, India
Aapastech OÜ (data controller for the European Union and the United Kingdom), registry code 16453146, VAT EE102489493, Tornimäe tn 3 // 5 // 7, 10145 Tallinn, Estonia
14818032 Canada Inc. (data controller everywhere else), Burlington, Ontario, Canada
Email: contact@aapastech.com
Grievance Officer: Shikha Gupta (how to complain)