ShallyStart Free Trial

GDPR & Data Protection

How Shally protects your data rights

Last updated: 19 July 2026

Shally, operated by Sumvaik Management Consulting Private Limited, is committed to protecting personal data and builds its practices around the principles of the GDPR (EU) 2016/679 and applicable Indian data protection laws.

Certifications in progress: Shally follows GDPR as a set of design principles today. Our standard Data Processing Addendum applies to all customers. Formal third-party audits (e.g. SOC 2, ISO 27001) are on our roadmap and are not yet certified. This page describes how we approach data protection, not a certified compliance attestation.

1. Data Controller

Sumvaik Management Consulting Private Limited
C-41 Basement, Nangal Dewat, Vasant Kunj, New Delhi, 110070, India
Email: hello@shally.io | Phone: +91 95407 00075

2. Data We Collect

  • Account Data: Name, email, phone, company name, business address
  • Usage Data: Login timestamps, feature usage, browser type, IP address
  • Business Data: Leads, contacts, projects, invoices entered by you
  • Payment Data: Billing address and plan details (card details processed by Razorpay/Stripe, not stored by us)
  • Communication Data: Support tickets, chat messages, email correspondence

3. Legal Basis for Processing

  • Contract Performance: Providing the Shally service
  • Legitimate Interest: Analytics, security, service improvement
  • Consent: Marketing communications, optional analytics
  • Legal Obligation: Tax records, Indian IT Act compliance

4. Your Rights Under GDPR

  • Access: Request a copy of all personal data we hold about you
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion (“right to be forgotten”)
  • Restrict Processing: Request limitation of data usage
  • Data Portability: Receive data in structured, machine-readable format
  • Object: Object to processing for marketing or legitimate interests
  • Withdraw Consent: Withdraw at any time

To exercise any right: delete your account from Settings → Security in the app, export your data self-serve from Settings, submit a verifiable request via our privacy request portal, use the unsubscribe link in any marketing email, or contact hello@shally.io. We respond within 30 days.

5. Data Retention

  • Account and business data deleted or irreversibly anonymised within 90 days of account termination (typically sooner)
  • Backups purged within 90 days
  • Financial records retained 7 years per Indian tax law

6. International Transfers

Data primarily stored in AWS Mumbai. International transfers use Standard Contractual Clauses (SCCs).

7. Sub-Processors

In summary: AWS (cloud hosting, storage and email delivery, Mumbai), Sentry (error monitoring), OpenAI (AI features), Razorpay (Indian payments), Stripe (international payments) and Resend (fallback email delivery), plus integration-gated providers. The canonical, always-current list — with each provider’s purpose, data location and transfer mechanism — is published at /sub-processors.

8. Breach Notification

We notify the supervisory authority within 72 hours and affected individuals without undue delay.

9. Contact DPO

Data Protection Officer
Sumvaik Management Consulting Private Limited
C-41 Basement, Nangal Dewat, Vasant Kunj, New Delhi, 110070
Email: hello@shally.io | Phone: +91 95407 00075