Privacy Policy

Effective Date: June 12, 2026
Last Updated: June 26, 2026

1. Introduction

Welcome to QuantaRoute ("we", "us", "our", or "Platform"). QuantaRoute is a SaaS product operated by SEQUENS LLP ("Company", "Data Fiduciary"). SEQUENS LLP provides the developer portal and API services available at https://developers.quantaroute.com and https://www.quantaroute.com (collectively, the "Platform" or "Services").

This Privacy Policy explains how we collect, use, process, store, share, and protect your personal data when you use our Services, in accordance with:

• The Digital Personal Data Protection Act, 2023 (DPDP Act)
• The Information Technology Act, 2000 and IT Rules, 2011
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011

By accessing or using our Platform, you ("User", "Data Principal", or "you") consent to the collection and use of information in accordance with this Privacy Policy.

1.1 Consent Mechanism

We obtain your consent through:

• Account registration: Creating an Account and accepting this Privacy Policy and our Terms
• Explicit opt-in: Separate consent checkboxes or confirmations for marketing communications and optional features
• Transactional use: Processing necessary to deliver Services you request (subject to lawful bases under the DPDP Act)

You may withdraw consent at any time by updating account settings, using unsubscribe links in emails, or contacting quantaroute@gmail.com. Withdrawal does not affect processing already carried out before withdrawal or processing based on another lawful basis under the DPDP Act.

2. Data Fiduciary and Contact Information

SEQUENS LLP is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) for personal data collected through the QuantaRoute Platform.

Grievance Officer (for privacy complaints and Data Principal rights requests under the DPDP Act):

• Email: quantaroute@gmail.com
• Subject Line: "Privacy Grievance — [Your Name]"

For general privacy-related queries, data deletion requests, or exercising your rights under this policy, you may contact quantaroute@gmail.com or hello@quantaroute.com.

3. Scope and Applicability

This Privacy Policy applies to:

1. Personal data collected digitally through our website, developer portal, APIs, and related services
2. Data collected offline and subsequently digitized for processing
3. Users located in India or anywhere in the world accessing our Services
4. API consumers, developers, businesses, and other users of QuantaRoute Services

4. Information We Collect

4.1 Personal Data

We collect the following categories of personal data:

Account Registration Data:

• Full name
• Email address
• Mobile number
• Company/Organization name
• Designation/Role
• Billing address
• GSTIN (for business users)

API Usage Data:

• API keys and credentials
• API request logs (timestamps, endpoints, request/response data)
• Usage metrics (number of API calls, data volume)
• IP addresses
• Device information (browser type, operating system)

Payment and Financial Data:

• Payment method details (collected and processed by Razorpay)
• Transaction history
• Billing and invoice information
• Bank account details (for refunds, if applicable)

Communication Data:

• Support tickets and correspondence
• Feedback and survey responses
• Marketing communication preferences

4.2 Sensitive Personal Data (as per IT Rules, 2011)

We may collect the following sensitive personal data only with explicit consent:

• Financial information (payment details - processed securely through Razorpay)
• Passwords (stored in encrypted/hashed format)

We do NOT collect:

• Sexual orientation
• Medical records or health information
• Biometric data
• Caste, religion, or political affiliation

4.3 Technical and Automatically Collected Data

• Cookies and similar tracking technologies
• Log files (IP address, browser type, pages visited, time spent)
• Device identifiers
• Location data (approximate, based on IP)

4.4 Data Collected via APIs

When you use QuantaRoute's Geocoding/DigiPin APIs, we may process:

• Input addresses, pincodes, and location coordinates
• Geocoded results (latitude, longitude, DigiPin codes)
• Administrative data (locality, district, state)

Note: We act as a Data Processor for data you send through our APIs. You remain the Data Fiduciary for your end-users' data.

4.5 Checkout & Buyer Data (QuantaRoute Checkout)

When merchants embed QuantaRoute Checkout on their storefronts, we process buyer personal data on behalf of the merchant. In this context:

• The merchant is the Data Fiduciary for buyer data
• QuantaRoute (SEQUENS LLP) is the Data Processor, acting only on the merchant's instructions via the Checkout product

Categories of buyer data we may process:

Purposes: OTP authentication (phone/email), address capture and DigiPin geocoding, saved-address retrieval, checkout funnel analytics, webhook delivery to merchant systems, fraud prevention (login attempt logging), and CRM event routing when merchants configure MoEngage, CleverTap, or WebEngage.

Merchants must accept our Checkout Data Processing Addendum before onboarding. Buyers should receive privacy information from the merchant (Data Fiduciary), not only from QuantaRoute.

4.6 QuantaRoute Search Library Enhancement

QuantaRoute operates a search library (the QuantaRoute Search geocoding and address-autocomplete engine) to improve forward geocoding, reverse geocoding, prefix autocompletion, and address normalization across India. Residential and delivery address data submitted through our APIs or QuantaRoute Checkout may contribute to this library only after de-identification and only where valid consent exists.

Purpose: To improve search relevance, geocoding accuracy, administrative boundary alignment (pincode, locality, district, state), street-context matching, and normalized address tokens for all QuantaRoute customers.

Consent model:

Merchants warrant that they have obtained all necessary consents and provided appropriate notices to end users. QuantaRoute is not responsible for a Merchant's failure to obtain consent.

What IS included in the search library (de-identified address and location components only):

• Geographic coordinates (latitude, longitude, DigiPin codes)
• Administrative anchors: pincode, locality, district, state, country
• Street context: street name, derived or normalized road names, building or premises name where provided as part of the address structure (not personal names)
• Normalized address tokens and formatted address strings after removal of excluded fields below
• Place or site identifiers where applicable to public points of interest (e.g., business or landmark names from open data or user corrections — not an individual's personal name)
• Source metadata (e.g., provider type, verification flags) and non-identifying popularity or quality signals

What is explicitly EXCLUDED from the search library (never indexed, stored, or used for library enhancement):

• Email address
• Mobile or phone number
• Personal name (recipient name, account holder name, or contact name)
• Flat number or unit number
• Floor number
• Address label (e.g., "Home", "Office", custom saved-address labels)
• Any other field that directly identifies an individual rather than a location

This exclusion list applies at ingestion: excluded attributes are stripped or never written to the search index (Amazon OpenSearch) or master spatial store used for library enhancement. Merchant checkout and API payloads may still contain excluded fields for transactional delivery purposes; those fields are processed only to fulfil the Merchant's request and are not replicated into the de-identified search library.

Lawful basis (DPDP Act): We rely on consent (obtained by the Merchant on our behalf for end-user data), contractual necessity (providing geocoding and search Services), and legitimate uses limited to improving location intelligence where consent or another lawful basis applies. <!-- [VERIFY] whether "legitimate use" for product improvement without consent is available for fully de-identified non-personal location data under final DPDP rules -->

Data Principal rights: End users should submit access, correction, erasure, and withdrawal requests to their Merchant (Data Fiduciary). Merchants may use QuantaRoute erasure tools or contact quantaroute@gmail.com to request removal of a contributed address from the search library. We will process verified requests within 30 days where technically feasible.

Opt-out: Merchants may opt out of contributing end-user address data to the search library by contacting hello@quantaroute.com. Opt-out applies prospectively and does not require deletion of lawfully processed historical de-identified index entries unless erasure is requested and feasible. <!-- [VERIFY] opt-out mechanics and retention of previously indexed de-identified data with counsel -->

5. Legal Basis and Purpose of Data Processing

We process your personal data on the following lawful grounds:

5.1 Consent (Primary Basis)

Your explicit, free, informed, and specific consent for:

• Creating and managing your account
• Processing API requests and providing Services
• Sending marketing communications (opt-in basis)

5.2 Contractual Necessity

To perform our contract with you:

• Providing access to APIs and developer tools
• Processing payments and generating invoices
• Customer support and service delivery

5.3 Legitimate Interests

For our legitimate business interests:

• Fraud prevention and security monitoring
• Platform analytics and performance optimization
• Compliance with legal obligations

5.4 Compliance with Law

To comply with applicable laws and regulations, including:

• GST and tax compliance
• KYC and anti-money laundering requirements
• Response to lawful government requests

5.5 Deemed Consent and Legitimate Uses

In addition to express consent, we may process personal data where permitted under the DPDP Act as deemed consent or for legitimate uses, including:

• Voluntary provision: Where you voluntarily provide personal data for a specified purpose and it is reasonably expected that you provide such data (for example, submitting a support ticket or completing account registration fields).
• Employment and safeguarding: Not applicable to QuantaRoute's consumer SaaS services; we do not process children's data for employment purposes.
• Medical or health emergencies: Not applicable to our standard API and checkout services; we do not collect health data through the Platform.
• Public interest and legal compliance: Compliance with any judgment, decree, or order under applicable law, or processing necessary for a lawful purpose related to a security, sovereignty, or public order interest as notified by the Government of India.
• Employment of the State: Processing for purposes related to employment by the State or provision of services by the State.

Where we rely on deemed consent or a legitimate use, we will process data only to the extent necessary for that purpose and in accordance with the DPDP Act.

6. Purpose Limitation

We collect and process your personal data only for the following specified purposes:

1. Service Delivery: Providing access to QuantaRoute APIs, processing geocoding requests, and delivering results
2. Account Management: Creating, maintaining, and securing user accounts
3. Billing and Payments: Processing subscriptions, invoicing, and financial transactions
4. Customer Support: Responding to queries, troubleshooting, and technical assistance
5. Platform Improvement: Analytics, performance monitoring, and feature development
6. Security and Fraud Prevention: Detecting and preventing unauthorized access, abuse, or malicious activities
7. Legal Compliance: Meeting regulatory, tax, and legal obligations
8. Marketing Communications: Sending promotional content (only with explicit consent, opt-out available)
9. Search Library Enhancement: Improving QuantaRoute Search geocoding, autocompletion, and address normalization using de-identified residential and delivery address components (see Section 4.6), subject to Merchant and end-user consent

7. Data Minimization and Accuracy

• We collect only the minimum personal data necessary for the specified purposes
• We take reasonable efforts to ensure data accuracy and keep it up-to-date
• You may update or correct your personal data through your account settings or by contacting us at hello@quantaroute.com

8. Data Retention and Storage Limitation

8.1 Retention Period

We retain your personal data only for as long as necessary for the purposes outlined in this policy:

8.2 Data Deletion

Upon expiry of the retention period or upon your request, we will:

• Permanently delete your personal data from active systems
• Anonymize or archive data in a secure, encrypted form if required for legal compliance

You may request early deletion by contacting hello@quantaroute.com (see Section 10).

9. Data Sharing and Disclosure

9.1 We Do NOT Sell Your Data

QuantaRoute does not sell, rent, or trade your personal data to third parties for marketing purposes.

9.2 Third-Party Service Providers (Data Processors)

We may share your data with trusted service providers who assist in operating our Platform:

We may engage additional sub-processors from time to time. Material changes to sub-processors will be reflected in an updated version of this policy or notified to you where required by law.

All Data Processors and sub-processors are contractually bound to:

• Process personal data only on our documented instructions
• Implement reasonable security safeguards
• Assist us in meeting our obligations under the DPDP Act and applicable data protection laws
• Not retain personal data longer than necessary for the instructed purpose

9.3 Legal and Regulatory Disclosures

We may disclose your personal data to:

• Government authorities in response to lawful requests or court orders
• Law enforcement agencies for fraud prevention, security, or criminal investigations
• Tax authorities for GST and income tax compliance

9.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections.

10. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the following rights:

10.1 Right to Access

You may request access to your personal data and obtain information about how it is processed.

10.2 Right to Correction

You may request correction of inaccurate or incomplete personal data.

10.3 Right to Erasure (Right to be Forgotten)

You may request deletion of your personal data, subject to:

• Legal and regulatory retention requirements
• Ongoing contractual obligations

To request deletion, email us at: hello@quantaroute.com

We will respond within 30 days and provide at least 48 hours' notice before erasure.

10.4 Right to Data Portability

You may request a copy of your personal data in a structured, commonly used, and machine-readable format.

10.5 Right to Withdraw Consent

You may withdraw your consent at any time by:

• Updating your account settings
• Opting out of marketing emails (unsubscribe link)
• Contacting us at hello@quantaroute.com

Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

10.6 Right to Grievance Redressal

You may file a complaint regarding our processing of your personal data by contacting our Grievance Officer at quantaroute@gmail.com. We will acknowledge your grievance and endeavour to resolve it within 30 days of receipt, in accordance with the DPDP Act.

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India (as established under the DPDP Act). <!-- Filing procedures should be confirmed with counsel when the Board's rules are published. -->

10.7 Right to Nominate

You have the right to nominate another individual who, in the event of your death or incapacity, may exercise your rights as a Data Principal under the DPDP Act in respect of your personal data held by us. To nominate a person, email quantaroute@gmail.com with the subject line "Nomination Request — [Your Name]" and include the nominee's name and contact details. We may require reasonable verification before accepting a nomination.

11. Data Security Measures

QuantaRoute implements reasonable technical and organizational security safeguards to protect your personal data:

11.1 Technical Measures

• Encryption: Data encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: Role-based access and multi-factor authentication (MFA)
• Secure APIs: API keys, rate limiting, and authentication mechanisms
• Regular Security Audits: Vulnerability assessments and penetration testing
• Firewalls and Intrusion Detection: Network-level protection

11.2 Organizational Measures

• Data Protection Policies: Internal policies and procedures for data handling
• Employee Training: Regular training on data privacy and security
• Incident Response Plan: Procedures for detecting and responding to data breaches
• Vendor Management: Due diligence and contractual safeguards with service providers

11.3 Data Breach Notification

In the event of a personal data breach that is likely to affect Data Principals, we will:

• Take reasonable steps to contain and remediate the breach
• Notify the Data Protection Board of India in the manner and timeframe prescribed under the DPDP Act and applicable rules (<!-- counsel should confirm exact timelines when notified by the Government -->)
• Notify affected Data Principals in the manner prescribed under the DPDP Act, including information about the nature of the breach and steps they may take to protect themselves
• Maintain records of breaches and our response actions as required by law

12. Children's Data

QuantaRoute's Services are not intended for children under 18 years of age.

We do not knowingly collect personal data from children without verifiable parental consent. If we become aware that we have collected data from a child without proper consent, we will take steps to delete such data immediately.

Parents/guardians may contact hello@quantaroute.com to request deletion of a child's data.

13. Cross-Border Data Transfers

13.1 Data Storage Location

Your personal data is primarily stored and processed in India using cloud infrastructure located in Indian data centers.

13.2 International Transfers

Personal data may be transferred or made accessible outside India where our Data Processors (including Supabase and Vercel) operate infrastructure in foreign jurisdictions, including the United States and other countries where their cloud regions are located.

All cross-border transfers are carried out in compliance with the DPDP Act, 2023, including:

• Transfers only to countries or territories permitted under applicable rules and notifications issued by the Government of India
• Contractual safeguards with Data Processors (data processing agreements, security obligations, and restrictions on further disclosure)
• Standard contractual clauses or other mechanisms as required when transferring to jurisdictions outside India under the DPDP Act and rules notified by the Government of India

We do not transfer personal data to countries restricted or blacklisted for data transfers under applicable Indian law.

14. Cookies and Tracking Technologies

14.1 Types of Cookies We Use

QuantaRoute's developer portal does not currently deploy third-party analytics or advertising cookies (e.g. Google Analytics, Meta Pixel). Cookies and similar technologies in use are limited to:

Merchant storefronts embedding QuantaRoute Checkout may set additional cookies or local storage for session continuity; those are governed by the merchant's privacy notice.

14.2 No analytics cookies on this portal

We do not load analytics or marketing tracking scripts in the developer portal layout unless explicitly noted in an updated version of this policy.

14.3 Managing Cookies

You may control cookies through your browser settings. Note that disabling certain cookies may affect Platform functionality.

For more details, see our Cookie Policy (if separate) or manage preferences in your account settings.

15. Marketing and Communications

15.1 Opt-In Consent

We will send marketing communications (newsletters, product updates, promotional offers) only with your explicit consent.

15.2 Opt-Out

You may opt out at any time by:

• Clicking the "Unsubscribe" link in emails
• Updating communication preferences in your account
• Emailing hello@quantaroute.com

15.3 Transactional Communications

You cannot opt out of essential transactional communications (account notifications, invoices, security alerts) required for service delivery.

16. Third-Party Links

Our Platform may contain links to third-party websites, services, or APIs. We are not responsible for the privacy practices of such third parties. We encourage you to review their privacy policies before providing any personal data.

17. Data Processor Obligations (For API and Checkout Users)

If you use QuantaRoute APIs or QuantaRoute Checkout to process personal data of your end-users or buyers, you acknowledge that:

1. You are the Data Fiduciary for your end-users' or buyers' data
2. QuantaRoute acts as your Data Processor for data processed through our infrastructure
3. You must:
   • Obtain proper consent from your end-users or buyers (or establish another lawful basis under the DPDP Act)
   • Provide appropriate privacy notices on your website or app
   • Honour erasure and other Data Principal rights
   • Ensure compliance with the DPDP Act and applicable laws
4. You indemnify QuantaRoute against any claims arising from your non-compliance

Checkout merchants must accept the Checkout Data Processing Addendum during onboarding. Enterprise API customers may request a separate Data Processing Agreement by contacting hello@quantaroute.com.

18. Compliance and Audit

QuantaRoute is committed to compliance with:

• Digital Personal Data Protection Act, 2023
• Information Technology Act, 2000
• IT Rules, 2011
• GST and tax regulations

We conduct periodic internal audits and may engage third-party auditors to assess compliance.

19. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in legal or regulatory requirements
• Updates to our data processing practices
• Introduction of new features or services

Notice of Updates:

• Updated version will be posted on our website with a revised "Last Updated" date
• Material changes will be notified via email or prominent notice on the Platform
• Continued use of Services after updates constitutes acceptance of the revised policy

20. Grievance Redressal Mechanism

20.1 Grievance Officer

SEQUENS LLP has appointed a Grievance Officer to address complaints and requests relating to the processing of personal data under the DPDP Act:

20.2 Response Timeline

• Acknowledgment: Within 48 hours of receipt where practicable
• Resolution: Within 30 days of receipt of the grievance, or such extended period as permitted under the DPDP Act
• If we cannot honour your request, we will provide a written explanation of the reasons

20.3 Escalation to the Data Protection Board

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India established under the DPDP Act. Details of filing procedures will be published by the Board; <!-- counsel should update this section when operational rules are issued. -->

21. Accountability and Compliance

SEQUENS LLP is responsible for ensuring that personal data processed through QuantaRoute is handled in accordance with this Privacy Policy and the DPDP Act.

For privacy-related inquiries or to exercise your rights as a Data Principal:

• Grievance Officer: quantaroute@gmail.com
• General inquiries: hello@quantaroute.com
• Address: SEQUENS LLP, West Bengal, 721632, India
• GST Number: 19AFWFS7839G1ZY

22. Definitions

• Data Principal: An individual (you) whose personal data is processed
• Data Fiduciary: An entity (SEQUENS LLP, operator of QuantaRoute) that determines the purpose and means of processing personal data
• Data Processor: An entity that processes personal data on behalf of a Data Fiduciary
• Personal Data: Any data relating to an identifiable individual
• Sensitive Personal Data: Financial information, passwords, biometric data (as per IT Rules, 2011)
• Processing: Any operation performed on personal data (collection, storage, use, disclosure, deletion)

23. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of India.

Any disputes arising out of this policy shall be subject to the exclusive jurisdiction of courts in West Bengal, India.

24. Language

This Privacy Policy is provided in English. In case of any translation, the English version shall prevail.

25. Consent

By using QuantaRoute's Services, you acknowledge that you have read, understood, and agree to this Privacy Policy.

For Data Deletion Requests:
Email: quantaroute@gmail.com or hello@quantaroute.com
Subject: "Request for Data Deletion — [Your Name/Email]"

QuantaRoute — a SaaS product of SEQUENS LLP
GST: 19AFWFS7839G1ZY | West Bengal, 721632, India
Empowering Precision in Location Intelligence

For privacy grievances: quantaroute@gmail.com | General inquiries: hello@quantaroute.com