Privacy Policy

Last updated: 25 September 2026 · Effective from the same date.

1. Who this is about

PrintOk is operated by Mohd Ayan Nasruddin Ansari, an individual trading as BitWise, based in Chembur, Mumbai, Maharashtra, India. In this policy "we", "us" and "PrintOk" mean that person.

Mohd Ayan Nasruddin Ansari (trading as BitWise) is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") for the personal data described below, and the controller under the EU/UK General Data Protection Regulation ("GDPR") where that law applies to you.

BitWise is a trading name, not a separate company, so there is no legal entity between you and the operator. The operator is personally accountable for how this data is handled, and acts as the Grievance Officer named in §11. There is no separate compliance team, and this policy does not pretend otherwise.

A print shop listed on PrintOk decides what it prints and for whom. For the documents a customer sends to that shop, the shop is a separate controller of its own.

2. What we collect, and why

2.1 If you are printing a document

You do not create an account, and we do not ask who you are. For each print job we hold:

• The document you upload, until the job reaches a final state (see §4).
• Its file name, size, page count and a checksum — the page count is verified on our servers so you are charged for what is actually there.
• Your print settings: copies, colour, single or double sided, paper size, page range.
• The price and a payment reference returned by our payment gateway.
• The token number you collect the printout with, and job timestamps.
• Your name and mobile number — only if the shop asks for them. Each shop decides whether its order page requests either, and whether it insists. Where a field is not shown, nothing is collected and the order record holds nothing for it. Where it is shown, the shop uses it to contact you about that order: an uncollected printout, or one that came out wrong.

We never ask for your email address or postal address, and no shop can ask for them through PrintOk. If you pay by card or UPI, your contact and payment details are collected by Razorpay, our payment gateway, under their own privacy policy — they do not reach us. We never see or store your card number, CVV, UPI PIN or bank credentials.

Where a shop does collect your name or number, it is kept with that order's record, is visible only to that shop and to us, and is never sold, shared with other shops, or used to market anything to you. You can ask us to erase it — see §7.

Lawful basis: performance of the contract to print your document (GDPR Art. 6(1)(b)); under the DPDP Act, the legitimate use of fulfilling the purpose for which you voluntarily provided the document.

2.2 If you run a print shop

• Account details: your email address, and optionally your name and phone number.
• Your password, stored only as a salted cryptographic hash. We cannot read it or recover it for you.
• Shop details: shop name, owner email, contact phone, registered address, GSTIN if you give one, and the payout details you enter — UPI ID and/or bank account number and IFSC.
• What customers see about your shop. Because your shop is the one providing the printing and receiving the customer's payment, customers are shown your shop's name and its city and state on the order page, at checkout and on their confirmation. Your street address, phone number, GSTIN and payout details are never shown to customers.
• Your Razorpay linked-account identifier, its onboarding status and anything Razorpay asks for, where you have enabled direct settlement. To set it up we send Razorpay your shop's legal and trading name, email, phone, registered address, GSTIN, business type, the owner's name and the bank account you registered for payouts.
• Your acceptance of the Terms: when you accepted them and which edition.
• Operational records: your rate card, job history, sign-in times, and the connection status and telemetry of the PC running the print agent.

Lawful basis: performance of our contract with you, and our legitimate interest in operating and securing the service.

2.3 If you contact us

The enquiry form stores your name, email address, message, and optionally your phone number and shop name, so we can reply and keep a record of the conversation.

2.4 What we do not do

We do not use advertising trackers, we do not build advertising profiles, we do not sell personal data, and we do not read the contents of your documents except as strictly needed to count pages and send the file to the printer you chose.

3. Who we share it with

We share personal data only with the processors we need to run the service:

We may also disclose data where we are legally required to — a court order, or a lawful request from a government agency under the Information Technology Act, 2000 or the Code of Criminal Procedure.

4. How long we keep it

• Your document is deleted automatically once the job reaches a state where it is no longer needed — printed, completed, cancelled or failed. It is not kept as a backup copy and the deletion is recorded against the job. A job that still needs the shop to act on it keeps the file until that is resolved, because otherwise the job could never be completed.
• The job record — settings, price, payment reference, timestamps, but not the file — is retained for accounting and dispute resolution, and to meet record-keeping obligations under Indian tax law (currently up to 8 years).
• A name or mobile number a shop asked for is held with that job record. Ask us and we will erase it from past orders without affecting the financial record — see §7.
• Shop accounts are kept for as long as the shop is on the platform, and afterwards only as long as needed for settlement, tax and legal obligations.
• Contact enquiries are kept until resolved and then archived.

5. Where your data goes

Our servers are hosted in Singapore (application) and our database and document storage in the Asia-Pacific region. Personal data may therefore be processed outside India. For transfers from the EU/UK, we rely on the European Commission's Standard Contractual Clauses with our processors. Under the DPDP Act we do not transfer personal data to any territory restricted by the Central Government.

6. How we protect it

• All traffic to the service is encrypted with TLS.
• Passwords are stored as salted hashes, never in a readable form.
• Sessions are signed tokens; shop data is reachable only with a valid session for that shop, and one shop cannot read another's.
• Each connected shop PC holds its own key, which can be revoked individually.
• Payment confirmations are verified cryptographically, so a payment cannot be faked.
• Administrative actions are written to an audit log.

No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as required by the DPDP Act, and the relevant supervisory authority within 72 hours where the GDPR applies.

7. Your rights

Under the DPDP Act, if you are in India, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed.
• Have inaccurate or incomplete data corrected, completed or updated.
• Have your data erased, where we no longer need it for the purpose or by law.
• Nominate someone to exercise these rights if you die or become incapacitated.
• Raise a grievance with us, and escalate to the Data Protection Board of India.
• Withdraw consent at any time, where processing rests on consent.

Under the GDPR, if you are in the EU or UK, you additionally have the right to:

• Receive your data in a portable, machine-readable form.
• Object to processing based on our legitimate interests.
• Restrict processing while a dispute about accuracy is resolved.
• Lodge a complaint with your local supervisory authority.

To exercise any of these, write to the Grievance Officer below. We will respond within 30 days. Because a print job holds nothing that identifies you, we may be unable to link a document to you after the fact — in that case there is nothing for us to return, and the document has already been deleted.

8. Children

PrintOk is not directed at children. Under the DPDP Act we do not knowingly process the personal data of a child under 18 without verifiable consent from a parent or guardian, and we do not track, profile or advertise to children.

9. Cookies and local storage

We use no advertising or analytics cookies. The site stores a small amount of data in your browser purely to make it work: your sign-in session if you are a shop owner, which shop your dashboard belongs to, and your light or dark theme choice. None of it is shared with anyone or used to track you across other websites.

10. Changes

If we change this policy we will update the date at the top, and for a significant change we will tell shop owners by email before it takes effect.

11. Grievance Officer

As required by the Information Technology Act, 2000 and the rules made under it, and by the DPDP Act, 2023:

You can also reach the Grievance Officer through the contact form, which is monitored.

We acknowledge complaints within 24 hours and resolve them within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.