1.Who this notice covers
In short: It covers visitors, account holders, team members and the people named in documents. It does not cover the practices of the businesses that use Hectile.
This notice applies to the hectile.com website, the Hectile web application and communications from Hectile. It covers three groups of people:
- Visitors who browse hectile.com without an account.
- Account holders and team members — people who sign in to Hectile and belong to one or more Organizations as an Admin or Member.
- Customers and recipients — people whose details appear in an Organization’s customer records, Invoices, Estimates and emails, and who open a document link or email that an Organization sent through Hectile.
Hectile is operated by Zealsync Private Limited, 11/131, Elanthoor, Pathanamthitta – 689643, Kerala, India. This notice does not describe how the businesses that use Hectile handle your information; each Organization is responsible for its own customers and its own privacy commitments.
2.Our role: administering your account versus processing for an Organization
In short: For account and billing data we decide how and why it is processed. For the business documents an Organization creates, we act on that Organization’s instructions.
Hectile processes personal information in two different roles, and the same information can fall under both depending on context.
- Zealsync as the responsible party
- Information we need to run the service for you: creating and securing accounts, administering Organization membership, subscription billing records, support conversations, service communications, and protecting the service from abuse. We determine the purposes and means of this processing.
- Zealsync acting for an Organization
- The business content an Organization enters or generates — customer records, Items, Invoices, Estimates, payment records, recipient addresses, document links and the email deliveries the Organization triggers. We process this content to provide the service to that Organization and on its instructions. The Organization decides why it collects this information and who it sends documents to. The Data Processing Addendum sets out the terms for this role.
Where a law that applies to a particular Organization uses the terms controller and processor (or equivalents), the Organization is the controller of its customer and document content and we act as its processor. For account, billing and support data we are the controller.
3.Information provided by account holders
When you create an account or are invited to an Organization we process:
- Your name and email address, the sign-in codes and sessions used to authenticate you and any second-factor or passkey enrolment you set up (see Subprocessors).
- Your role in each Organization (Admin or Member) and the Organizations you belong to.
- Billing contact details and billing country for an Organization’s subscription, where you are the person who activates it. Card and payment details are collected by our subscription-billing provider; Hectile stores a reference to the subscription and its status, not the payment instrument.
- Preferences you set in the application, such as your default currency or the Organization you were last working in.
You can update your name and profile details in the application. Requests to change the email address on an account are handled through support (see Account & Security).
4.Organization, Brand and customer-document information
An Organization represents one legal business. Inside it, Admins and Members create Brands and business documents. This content typically includes:
- Organization legal details and tax identifiers, and each Brand’s trading name, logo and contact details.
- Customer records: business or personal names, addresses, email addresses, tax identifiers and a preferred currency.
- Invoices and Estimates: line items, amounts, taxes, notes, payment instructions and the details of the customer they are addressed to. Issued documents keep a snapshot of these details as they were when the document was finalized.
- Payment records the Organization enters by hand when it receives money from its customer (Hectile does not collect these payments).
- Recurring invoice templates and payment reminder rules the Organization sets up — the customer, document lines, schedule and message — which Hectile uses to create and send documents and reminders on the Organization’s schedule.
- Sending records: who a document was emailed to and when — including invoices and payment reminders sent automatically under settings the Organization chose, and optional payment receipts where the Organization has turned them on — and delivery events reported by our email provider; public document links and whether they were opened; and, where the issuing Organization offers it, an accept or decline response given from an Estimate’s link, with the time it was recorded.
Customer and recipient information is provided to us by the Organization, not by you directly. If you are a customer of a business that uses Hectile and want to correct or remove your details, contact that business first; it controls the record. We assist the Organization with such requests as described in the Data Processing Addendum.
5.Support and legal communications
If you contact us through the contact form — including its Billing, Security report and Legal reasons — we process your name, email address, the reason you chose, your message and the Organization, Brand or document you refer to. We use these details to answer you, to keep a record of the conversation and to improve our help content. Messages are received in our internal mailbox and support tooling and are kept for as long as the matter, and any follow-up it may reasonably require, remains open (see section 11).
6.Technical and usage information
Our servers record technical information when you use hectile.com or the application, such as IP address, browser type, requested pages, timestamps and error details. We use these records to keep the service running, to secure it and to diagnose problems. Operational logs are designed to exclude document content, tax identifiers, raw document-link tokens and the text of AI requests.
Cookies and similar browser storage are described in the Cookie Policy. Hectile does not use cookies or similar technologies for advertising; any optional technology in use is listed in the Cookie Policy.
7.Why we process information
We do not use the content of an Organization’s documents to advertise to anyone, and we do not sell personal information.
8.Legal bases
Zealsync Private Limited is established in India and processes personal information in accordance with the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023 as and when its provisions are brought into force. Where the law of another country also applies to you, we rely on: performing our contract with you (running your account and the service); our legitimate interests in securing and improving the service and responding to enquiries; your consent where we ask for it (for example, for optional cookies); and compliance with legal obligations. Processing carried out for an Organization is governed by that Organization’s instructions and the Data Processing Addendum.
9.Service providers and other disclosures
We rely on a small number of providers to run Hectile — for application hosting and sign-in abuse protection, database and file storage (including account and sign-in records), authentication and document email, subscription billing and, for AI features, AI request routing and model execution. Sign-in itself is a function of the Hectile application, not a separate identity service. Each provider processes only what its function requires. The Subprocessors page names them, states their role and explains which of them process Organization content on our behalf and which act independently (for example, our billing provider when it processes payments as merchant of record).
We may also disclose information: to an Organization’s Admins, who can see the members and content of their Organization; when you ask us to, or direct a document to a recipient; to comply with law, a court order or a lawful request from a public authority; to protect the rights, safety or property of Zealsync, our users or others; and, if Zealsync is involved in a merger, acquisition or asset sale, to the parties to that transaction, subject to this notice.
10.International processing and transfers
Zealsync is based in India and our providers operate infrastructure in more than one country, so your information may be stored and processed outside the country you live in. Where a law that applies to us restricts a transfer, we rely on the data-protection terms that apply between Zealsync and the provider for that transfer, including any transfer terms that law requires. Hectile does not offer a choice of data-residency region.
11.Retention and deletion
In short: We keep information for as long as the purpose it was collected for requires, and business records for as long as the law requires. What happens next depends on whether a subscription ended, an account was closed, or a verified deletion request was made.
We do not apply a single fixed retention period to everything. Instead we keep each kind of information for as long as the following criteria require:
- Organization content (customers, documents, payment records) — for as long as the Organization keeps its account. Issued documents are business records of that Organization and remain available to it, including in read-only access after a subscription ends.
- Account details — for as long as you hold an account or belong to an Organization.
- Billing and transaction records — for the period required by Indian tax and company law after the transaction.
- Support and legal communications — for as long as the matter, and any follow-up it may reasonably require, remains open.
- Technical logs — for a limited period sufficient to secure and troubleshoot the service, after which they are rotated out.
- Subscription cancellation or trial expiry
- The Organization moves to read-only access. Nothing is deleted: members can still sign in, view and download issued documents, and an Admin can revoke document links.
- Account closure
- When a member is removed or leaves, they lose access to the Organization; documents they created remain with the Organization. Closing your own account removes your profile from Hectile once you no longer belong to any Organization, subject to the record-keeping periods above.
- Verified deletion request
- An Organization Admin can ask us to delete the Organization and its content, and an account holder can ask us to delete their account, using Contact Legal. After verifying the request we delete the data from the live service, except where we must keep specific records by law. Copies in routine backups are removed as those backups expire in the ordinary rotation cycle.
Deleting an entire Organization is not currently available as a self-service control in the product; it is handled as a verified request, which can be made at any time — there is no deadline after a subscription ends.
12.Security
We design Hectile so that each Organization’s data is isolated from every other Organization, that access is checked on the server for every request, and that information moves between your browser and our servers over HTTPS/TLS. Issued documents cannot be silently edited, and public document links can be revoked by an Organization Admin. Provider credentials are held server-side and never exposed to the browser. More detail is on the Security & Trust page.
No online service can guarantee absolute security. If we become aware of a security incident affecting your personal information, we will inform affected Organizations and act as required by the laws that apply to us.
13.Your privacy rights and how to make a request
Depending on where you live, you may have rights to access the personal information we hold about you, to correct it, to have it deleted, to receive a copy, to object to or restrict certain processing, to withdraw consent you have given, and to have a grievance heard. You may also have the right to complain to a supervisory authority in your country.
To make a request about your Hectile account, use Contact Legal. We will confirm receipt, may ask you to verify that you are the account holder, and will respond within the time that applicable law allows — and in any case without undue delay. To make a request about your details in a business’s documents, contact that business; it controls the record and we will support it in responding.
Grievances about how we handle personal information may be addressed to the Grievance Officer at Zealsync Private Limited, 11/131, Elanthoor, Pathanamthitta – 689643, Kerala, India, or through Contact Legal.
14.AI-assisted features
AI features let an account holder describe a document in plain language and receive a proposed Draft (AI Quick Create), or ask for a suggested line description, note or terms text. Each request goes from Hectile through Vercel’s AI Gateway (Vercel Inc.) to Anthropic (Anthropic, PBC), whose model generates the response; the Gateway passes requests only to Anthropic. Only what the action needs is sent: for AI Quick Create, the text of the request (up to 2,000 characters), the document type and the names of the Organization’s tax profiles; for a suggested line description, the text of that line; and for a suggested note or terms text, the document type, the brief given and the current note or terms text. Customer, Item and Brand records are not sent — Hectile matches the customer and Items you name itself. The providers’ role is limited to routing the request and generating the response. A suggestion is used only if a person chooses to use it. Nothing is finalized, sent or recorded as paid by AI; a person reviews and confirms every Draft.
Zealsync does not train any model of its own on your content. The AI providers, their roles and the data they receive are listed on the Subprocessors page; their retention and use of request content are governed by their published terms. Hectile keeps no copy of a request or of the model’s response: it counts AI actions for the monthly allowance and records, for each action, the feature used, token counts and the outcome. AI features are optional and are not required to use Hectile.
15.Changes to this notice
We will update this notice when our practices or the law change. The effective date at the top of this page shows the version in force. Where a change materially affects you, we will tell account holders through the application or by email before it takes effect.
16.Contact
Privacy questions, rights requests and grievances: Contact Legal. Postal address: Zealsync Private Limited, 11/131, Elanthoor, Pathanamthitta – 689643, Kerala, India.