Privacy Policy
Last updated: October 22, 2026 • Compliant with Digital Personal Data Protection Act, 2023 (India)
At Sagasoft, privacy is not an afterthought or a marketing catchphrase—it is the foundation of sovereign identity. Your emails, files, and communications belong to you alone. We do not mine your inbox, train AI on your messages, or sell your records.
1. Overview & Privacy Principles
This Privacy Policy explains how Sagasoft Technologies Private Limited (“Sagasoft”, “we”, “us”, or “our”) collects, processes, stores, and protects personal data when you use SagaMail, SagaDomain, and associated services.
Our architecture is built on three unbreakable privacy principles:
Servers located strictly in India. No extraterritorial data rerouting.
We never read, analyze, or train neural networks on your emails or files.
Export or delete your data anytime with one-click IMAP portability.
2. Zero AI Training Covenant
Our Pledge Regarding Machine Learning & AI Models
Unlike conventional cloud email providers that scan your inbox to build behavioral advertising profiles or train commercial artificial intelligence models, Sagasoft guarantees that:
- Your email body contents, subject lines, and sender logs are never ingested into AI training datasets.
- We do not build advertising personas or sell data to third-party ad networks or brokers.
- Any automated parsing performed by our mail servers is strictly functional (e.g. DKIM signature verification, Bayesian spam scoring, virus attachment scanning, and SPF/DMARC checks).
3. Indian Data Sovereignty & Residency
In compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) and national data sovereignty best practices:
- Physical Data Centers: Primary and disaster-recovery server infrastructure is hosted exclusively within Tier-IV data facilities located in Mumbai and Bengaluru, India.
- Sovereign Cloud Isolation: Mailbox storage clusters (powered by Stalwart / NVMe storage) operate within private, isolated VPCs with zero unauthorized cross-border replication.
- Indian Legal Jurisdiction: Data requests from foreign law enforcement authorities are not entertained unless routed through formal Mutual Legal Assistance Treaty (MLAT) channels and authorized by Indian courts.
4. Information We Collect
We collect only the minimum personal data required to provision and secure your services:
Name, work email address, phone number (for mandatory OTP verification), company name, billing address, and GSTIN (if applicable).
ICANN and registry-mandated registrant, technical, and administrative contact details. On supported TLDs, this information is automatically shielded by our WHOIS Privacy masking service.
Mail server delivery logs (connecting IP address, timestamp, recipient, message ID, transmission status), session tokens, and audit logs. Delivery logs are purged automatically after 30 days.
Processed directly by RBI-authorized payment aggregators (Razorpay). We receive only payment status, transaction IDs, and tokenized mandates. Raw credit/debit card numbers never touch our servers.
5. How We Use Your Data
Your personal data is processed strictly for the following lawful purposes:
- Provisioning domain registrations and authoritative Anycast DNS records.
- Delivering and storing incoming and outgoing mail via IMAP, POP3, and SMTP protocols.
- Managing your Unified Organization Pool storage and mailbox allocations.
- Authenticating logins and defending against brute-force attacks via rate limiting.
- Invoicing in Indian Rupees (INR) and generating GST-compliant tax invoices.
- Sending critical account notices (e.g. domain renewal notices, security alerts, and system status).
6. Data Sharing & Third-Party Processors
Sagasoft does not sell or lease user information. We disclose data solely to vetted infrastructure providers necessary to execute your requested services:
- Domain Registries (Openprovider): Required by ICANN / ccTLD registry rules to assign domain ownership.
- Payment Gateway (Razorpay): Authorized by the Reserve Bank of India to process payments and e-Mandates securely.
- Legal & Regulatory Compliance: Only when compelled by valid judicial court orders issued under Indian jurisdiction.
7. Security & Encryption Standards
We deploy defense-in-depth security measures to protect your sovereign communications:
8. Data Retention & Erasure
- Mail Data: Stored for as long as your tenancy is active. You may delete individual emails or entire mailboxes at any time from your control panel.
- Account Termination: Upon account closure, all associated mailboxes and stored messages are permanently purged within 30 days after the end of any billing grace period.
- Tax & Financial Records: Retained for 8 years as required by the Indian Companies Act, 2013 and Goods and Services Tax (GST) laws.
9. Your Rights (DPDPA 2023 & GDPR)
As a data principal, you have the following fundamental rights regarding your personal data:
Review the personal data we hold about you and your processing summary.
Update or correct inaccurate contact, billing, or domain registrant details.
Export your complete mailbox data at any time using standard IMAP tools or CSV exports.
Request the permanent deletion of your personal data and account upon termination.
11. Grievance Officer & Contact
If you have questions, wish to exercise your data principal rights, or have a privacy grievance, please contact our designated Grievance Officer: