Compliance & data protection.
Glacro is built around India’s Digital Personal Data Protection Act, 2023, with general GDPR practice where it applies. Your data stays in Mumbai. This page describes what we actually do — and, just as importantly, what we do not claim.
How your data is held.
Six controls that apply to every account on the platform, free and paid alike.
One region, and only one
Every account record, project, build artifact and deployed site lives in AWS ap-south-1 (Mumbai). We do not replicate your data to another region, and there is no edge tier holding copies elsewhere.
Encrypted at rest and in transit
Build output and platform records are stored with AES-256 server-side encryption. Public access is blocked on our storage buckets at all four AWS settings. Traffic to and from the platform is served over HTTPS.
Point-in-time recovery
Continuous backups are enabled on the databases holding your account, project and billing records, so a table can be restored to any second within the retention window.
Isolated builds, least-privilege credentials
Each build runs in its own container. The build role can write published output and nothing else — it holds no read access to other customers' output, no database access and no access to our secrets store.
Signature-verified sessions
Sessions are Amazon Cognito tokens whose signature, audience and application client are verified on every authenticated request. There is no fallback path that trusts an unverified token.
Card details never reach us
Payment credentials are entered directly into Razorpay or Stripe. We receive the outcome of a payment — never a card number, UPI handle or CVV — so there is no cardholder data on our systems to protect.
Where we sit under Indian data protection law.
The DPDP Act treats us as a Data Fiduciary and you as a Data Principal. In plain terms: you decide, we are accountable.
Your rights
- Ask what personal data we hold about you, and get a copy of it
- Have inaccurate details corrected
- Have your account and its data deleted
- Withdraw a consent you previously gave
- Nominate someone to exercise these rights if you cannot
- Raise a grievance with our named Grievance Officer
Exercise any of these by emailing rajan.kumar@glacro.com from the address on your account.
Grievance Officer
The DPDP Act and the IT Act, 2000 both require a named, contactable officer. Ours is not a role-based alias that forwards into a queue — it is the person who runs the platform.
- Name
- Rajan Kumar
- Address
- Door 2, Block A, Sri Sai Complex, 147 Thadagam Road, Coimbatore, Tamil Nadu 641025, India
Everyone your data touches.
The complete list. If we add one, this table and the Privacy Policy change together.
| Recipient | Processed in | Why they receive it |
|---|---|---|
| Amazon Web Services | Mumbai (ap-south-1) | Hosting, authentication, database, storage, email and builds |
| Anthropic, via Amazon Bedrock | Mumbai (ap-south-1) | Generates in-product assistant replies. Not used to train any model |
| Razorpay | India | Takes payments from customers in India |
| Stripe | International | Takes payments from customers outside India |
| GitHub | International | Reads the repositories you ask us to deploy |
| International | Sign-in, if you choose Google | |
| Google reCAPTCHA | International | Separates real users from automated abuse at sign-up and login |
We may also disclose data where Indian law, a court order or a lawful government request requires it, and we will tell you when that happens unless we are legally barred from doing so.
What we do not claim.
A trust page that only lists strengths is a sales page. These are the questions a procurement review would ask, answered honestly.
No SOC 2, ISO 27001 or third-party audit
We hold no security certification and have not been audited by an external assessor. Anyone telling you otherwise about Glacro is wrong. The controls described on this page are ones you can verify by using the product and reading our Terms — not ones an auditor has signed off.
No uptime SLA
Our Terms state plainly that no plan carries a guaranteed uptime commitment, and our marketing is not permitted to contradict that. The status page publishes live checks rather than an uptime percentage, because we do not yet record availability history worth quoting.
A sole operator, not a company
Your contract is with Rajan Kumar, an individual operating as Glacro from Coimbatore, Tamil Nadu. We are not incorporated, and we do not describe ourselves as a private limited company anywhere.
Reviewing us for your organisation?
Send the questionnaire. We will answer it against what the platform actually does, tell you where the answer is “no”, and we will not fill a control in as satisfied because it nearly is.