Privacy policy

Last updated 28 July 2026

This policy explains how Chetty Exports Private Limited ("we", "us", "CEPL"), operating Veloque ExportIQ, collects, uses, discloses, retains and protects personal data, in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011.

1. Who we are and this policy's scope

Chetty Exports Private Limited is the Data Fiduciary for personal data collected through veloque.in. This policy covers the Veloque ExportIQ web application, its account system, calculators and AI features. It does not cover third-party sites we link to.

2. What we collect

Account details you give us: name, email, company, phone, country, and password (stored only as a bcrypt hash, never in plain text). Business/registration details you enter in your company profile: IEC, GSTIN, PAN, AD code, Udyam number, registered address, bank name and SWIFT/IFSC — these are the fields we treat as most sensitive and encrypt at rest (see Section 6). Product descriptions and costing inputs you submit to the calculators and AI features. Billing details for your organisation (GSTIN, billing address, billing email) if you make a purchase. Technical data — IP address, browser user agent, and timestamps — collected automatically for security, fraud prevention and rate limiting. We do not knowingly collect data from anyone under 18; the service is intended for business use by adults acting for their company.

3. Why we process it (lawful basis)

We process your personal data on the basis of your consent (given when you register and accept these terms) and, where applicable, for the performance of the contract between you and us — running your account, metering your plan, generating documents and invoices, and responding to support requests. We do not use your data for any purpose incompatible with these.

4. Who we share it with

Google (Gemini API, USA) — product descriptions and the standing business context from your profile (company name, role, IEC, GSTIN, products, markets, certifications — never your address, bank details or password) are sent to Google's Gemini API to generate a classification or compliance result. This is a cross-border transfer of data to the United States, made under Google's API terms. Google's own data-handling terms govern this processing on their side. Do not paste confidential buyer names, contract pricing, or another individual's personal data into the classification or compliance boxes — treat them as you would any third-party AI tool.

The European Central Bank rate feed (via Frankfurter) is queried for exchange rates; no personal data is sent. Our infrastructure is hosted by Hostinger; data at rest sits on their servers under their hosting agreement. We do not sell personal data to anyone, and we do not share it with advertisers or data brokers.

5. Cookies

We set two cookies, both strictly necessary and neither used for advertising or cross-site tracking: a session cookie (vq_sess) that keeps you signed in, and a CSRF cookie (vq_csrf) that protects forms from cross-site forgery. Both are marked Secure, HttpOnly (session cookie) and SameSite=Lax, so they are only ever sent over HTTPS and cannot be read by page scripts or replayed from another site.

6. How we secure it

All traffic is encrypted in transit with TLS (HTTPS is enforced site-wide). Passwords are hashed with bcrypt and are never stored or logged in readable form. The fields listed in Section 2 as most sensitive — registration numbers, bank details, phone and address — are additionally encrypted at rest with AES-256-GCM before they ever reach the database, so a database-level compromise alone would not expose them in readable form. Sessions are server-side tokens that expire automatically and can be revoked at any time by signing out or changing your password (which signs out every other device). Login attempts are rate-limited to slow down credential-guessing. Administrative access is restricted to a single named account and is not discoverable by ordinary users.

7. Retention

Account, profile and quote data is kept while your account is active and for a reasonable period after closure to meet accounting, tax and dispute-resolution obligations under Indian law (GST records in particular are generally retained for the statutory period). Rate-limiting and security logs (IP address, timestamps) are kept for a short rolling window and then purged. When you ask us to delete your account, we remove personal data except what we are legally required to retain, and note that requirement to you.

8. Your rights

Under the DPDP Act you have the right to access a summary of the personal data we hold about you and the processing we carry out on it, to seek correction or completion of inaccurate or incomplete data, to seek erasure of data that is no longer necessary for the purpose it was collected, to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal), and to nominate another individual to exercise these rights on your behalf in the event of death or incapacity. To exercise any of these, write to the Grievance Officer below; we will respond within 30 days.

9. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the Grievance Officer for Veloque ExportIQ is:
Elavarasan Raja
Chetty Exports Private Limited, #1, Chendhur Plaza, Chendhur Garden, Soriyampatti, Harur 636902, Tamil Nadu, India
support@veloque.in

If you are not satisfied with our response, you may approach the Data Protection Board of India once it is operational, or the appropriate consumer forum.

10. Breach notification

If a personal data breach occurs that is likely to affect you, we will notify the Data Protection Board of India and affected users as required under the DPDP Act, describing the nature of the breach and the steps we are taking.

11. Changes to this policy

We may update this policy as the product or the law changes. Material changes will be reflected by the "Last updated" date above; continued use of the service after an update constitutes acceptance of the revised policy.

12. Contact

Chetty Exports Private Limited, #1, Chendhur Plaza, Chendhur Garden, Soriyampatti, Harur 636902, Tamil Nadu, India — support@veloque.in