How Sugarcoat handles personal data

Last updated: 31 October 2026 · Suggarcoat Private Limited (CIN U62013GJ2026PTC184718)

1. Who we are

Sugarcoat is a business operating system made by Suggarcoat Private Limited, registered office Rajula, Amreli, Gujarat 365560, India. Contact: [email protected], +91 73796 90166.

2. Two roles

Our own data. For people who use this website, ask for a demo or trial, or hold a Sugarcoat login, we decide why and how the data is used.

Our customers' data. When a business, school or hospital puts its records into Sugarcoat (leads, employees, students, parents, patients and so on), that organization decides why the data is used. We process it only on its instructions, to run the service. Questions about those records go to that organization first.

3. What we collect

Demo and trial requests: name, company, work email, phone, industry, team size and your message.
Logins: name, email, role, organization, sign-in times, and failed sign-in counts (to lock out password guessing).
Technical data: IP address, browser type and server logs, kept for security.
Android app: the app shows sugarcoat.tech and collects nothing more than the website. It reads no contacts, location, photos, microphone or device IDs. With Google sign-in, the app opens Google in your phone's browser and receives a one-time sign-in code that works once, for a few minutes.
Payments to Sugarcoat: invoices to your organization and the 12-digit UPI reference (UTR) you send after paying. You pay through your own bank's UPI app: we never see your UPI PIN, card or bank login. We keep invoices and payment references as long as tax law requires.
Customer records: whatever the customer organization enters, as described in section 2.

4. Why we use it

To answer demo and trial requests, and to set up and run accounts.
To send service emails: invitations, password resets and trial reminders.
To keep the service secure, find faults, and meet legal duties (for example tax records).

We do not sell personal data. We do not use advertising or analytics cookies.

5. Cookies and browser storage

We use only the cookies the service needs: a sign-in session cookie and a security (CSRF) cookie. The Sugarcoat Android app also sets a cookie that only says the page is open in the app, so the website can adapt (for example, how Google sign-in works). The Pricing page remembers the currency you pick in your own browser. Nothing is used to follow you across other websites.

6. Who else handles data

Our hosting provider, which runs the servers the service is on.
Our email provider, which delivers service emails.
Razorpay, if you choose "Pay online" for a Sugarcoat invoice: it handles the card, netbanking or UPI payment. We receive only the payment ID and status, never your card or bank details.
Google Drive, where encrypted-in-transit copies of our backups are kept.
Google, if you choose "Sign in with Google", or if your organization connects its own Google mailboxes for Bulk Email.

Each of them handles data only to provide its service to us. We share data with authorities only when Indian law requires it.

7. How long we keep it

Demo and trial requests: up to 2 years after our last contact with you.
Free trial organizations that do not buy: deleted 30 days after the trial ends.
Customer organizations: kept while the subscription runs. When it ends, the customer can take an Excel export, and we delete the data within 30 days.
Backups: deleted automatically after a fixed number of days.
Security logs: at least one year, as Indian law requires.

8. Children and patients

School OS and Hospital OS hold data about students, parents and patients for the school or hospital that uses them. That school or hospital is responsible for collecting it lawfully, including a parent's consent for a child's data. We do not use this data for any purpose of our own.

9. Security

Each organization's data is kept apart, and our automated tests check that one organization cannot open another's records or files. Connections are encrypted (HTTPS), passwords are stored hashed, and repeated wrong passwords lock the sign-in. We back up the database regularly and keep a copy off the server.

If a breach affects your personal data, we will tell you and the authorities as Indian law requires.

10. Your rights

You can ask to see, correct or delete the personal data we hold about you, withdraw consent, or name someone to act for you. Email [email protected] from the address we know you by. To delete a Sugarcoat login or a whole organization, use the account deletion page. We reply within 30 days. For records that a customer organization holds about you, we pass your request to that organization.

11. Grievance officer

Harshit Chauhan, Director, Suggarcoat Private Limited, Rajula, Amreli, Gujarat 365560. Email [email protected]. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

12. Changes

When this policy changes, we update the date at the top. If a change matters for how we use your data, we tell account owners by email first.