Privacy Policy

1. Who we are

Presstropic Solutions provides Presstropic, software that printing presses use to manage paper, plates, jobs, stock, production and dispatch. In this policy “we” means Presstropic Solutions and “you” means the press that subscribes to the service, together with the people it gives access to.

For the accounts and sign-in information described here, we decide how that information is used. For the business records your press enters — including details of your own customers and staff — your press decides what goes in and why, and we process it on your behalf to run the service.

2. What we collect

Information you give us

• Enquiries from this website — name, company, phone number, email, the number of machines you run and any message you write. These go straight to our own server.
• Your company account — company name, the company sign-in email and password, and your company's time zone.
• User accounts you create — each person's name, username, role, permissions and password.
• Two-step verification, if you turn it on — the authenticator secret linked to your company and a set of single-use backup codes.
• Device names — the name you give a computer or phone the first time it signs in (for example “Front office PC”).
• Your operational records — parties, jobs, paper, plates, materials, machines, challans, rates and the documents built from them. These can include your customers' and operators' names, addresses, phone and WhatsApp numbers, job images you upload, and the PINs operators use on the shop-floor screen (stored encrypted — see section 8).

Information collected automatically

• Sign-in and device information — described in full in the next section.
• An activity log of what is done inside your account: which user, from which named device and network (IP) address, did what, on which screen, and when — including sign-ins, page views, exports, and creating, changing or deleting a record.

3. Sign-in and security data

Signing in to Presstropic has two steps — first the company, then the individual user — and we record a small amount of information at each step so that only the right people get in and your owner can see who is signed in. This is what we record, and why:

What	Why	How long
Signed-in devices: network (IP) address, browser and operating system, the device name you gave it, which user last signed in from it, first-seen and last-seen times, and whether it has been signed out or blocked.	Lets your owner see every device signed in to the company, sign one out, or block it.	While your company account is active, unless your owner removes the device sooner.
Failed sign-in counters: the company email, username or network address that was tried, how many attempts failed, and until when sign-in is paused.	Stops password guessing. After repeated failures, sign-in for that account or address is paused for a while, longer each time it recurs.	Reset as soon as a sign-in succeeds. Counters never contain passwords.
Security events: successful and failed sign-ins, lockouts and password changes, with the time, network address and username.	To investigate suspicious access and keep the service secure.	Kept in the server's system log, which is rotated automatically.
New-device alerts: when your company signs in from a device it has not used before, your owner receives an in-app notification with the device type, network address and time.	So an unexpected sign-in is noticed quickly.	Until the owner clears the notification.
Two-step verification: your authenticator secret, backup codes (stored only in scrambled, one-way hashed form) and the time of the last code accepted.	To check each code, and to make sure a code cannot be used twice.	Until two-step verification is turned off or the account ends.

We do not work out your physical location from your network address, and we do not use any of this information for marketing.

4. Why we use it

• To provide the service and keep your records available to you.
• To secure your account — two-step sign-in, two-step verification, device management, sign-in limits, automatic sign-out after inactivity, and the activity log.
• To support you when you ask for help, and to investigate a problem you report.
• To respond to a demo request or enquiry you send us.
• To meet a legal obligation where one applies.

5. Your business data belongs to you

The records you enter are yours. We hold them to run the service for you, and for no other purpose. Specifically, we do not use your production data, your customer names or your rates to train models, to build benchmarks, or to inform anything we sell to anyone else.

Each press's data is kept separate from every other press's, and access inside your account is governed by the permissions you set for each user. Because your records can contain details of your own customers and staff, your press is responsible for having a proper basis to record them and for answering their requests; we will help you do that.

You can export your data from the app at any time, and you can ask us for a full copy of your database.

6. Who we share it with

We share data only with the service providers needed to run Presstropic, and only to the extent needed:

• DigitalOcean, which hosts our servers in India — the app, its database, this website, and the enquiries you send through it.
• Cloudflare, which provides our domain name service, content delivery and network protection for both the app and this website, and so handles connection details such as network addresses.

Everything your browser loads from the app and from this website — pages, fonts, scripts and images — is served by us through these two providers. No other company, font service, advertising network or analytics service sees your visit. If we add another provider, such as for account emails or WhatsApp notifications, we will list it here before we start using it.

We may disclose data where the law requires it. If we ever receive such a demand and are permitted to tell you, we will.

7. How long we keep it

• Your operational records — for as long as your subscription is active.
• Records of changes to data (who created, edited or deleted a document, and what changed) — eight years, because these are accounting records and an auditor may need them years later.
• Sign-in and browsing activity in the activity log — 90 days.
• Sign-in and security data — as set out in section 3.
• Enquiries from this website — up to two years, unless you ask us to delete them sooner.

If your subscription ends, we will make your data available for export for 30 days, and delete it after 90 days unless you ask us to keep it longer or to delete it sooner.

8. How we protect it

• All traffic is encrypted in transit over HTTPS.
• Passwords and backup codes are stored only in one-way hashed form, never in a readable form.
• Shop-floor PINs are stored encrypted, with a key kept separately from the database, so a copy of the database on its own does not reveal them. Your owner can still look a PIN up in the app.
• The shop-floor screen works only on a device signed in to your company, and pauses after repeated wrong PINs.
• Signing in takes two steps — company, then user — and two-step verification with an authenticator app is available for the company sign-in.
• Repeated failed sign-ins pause further attempts, and responses do not reveal whether an account exists.
• Each device is recorded and named; your owner can sign out or block any device, and is told when a new device signs in.
• You are signed out after a period of inactivity, and in any case after 12 hours.
• “Remember this company” works only on the browser where it was set, and stops working if the company password changes.
• Access inside your account is limited by per-screen and per-action permissions you control.
• Backups are taken regularly.

No system is perfectly secure. If a breach ever affects your data, we will tell you what happened, what it affected and what we are doing about it, without delay.

9. Your rights

You may ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete data we no longer have a reason to keep;
• stop sending you marketing messages, at any time.

If you are a user of a press's account, some requests — for example about the activity log — are decided by that press, and we will pass them on. Write to [email protected] and we will respond within 30 days. This address is also where to send any grievance about how your data is handled.

10. Cookies and browser storage

Presstropic uses only what it needs to keep you signed in and secure. None of it is used for advertising or tracking.

Name	Purpose	Lasts
Session cookie	Keeps you signed in and protects sign-in forms against forgery.	Ends after 30 minutes of inactivity, and at most 12 hours after you sign in.
pt_device	A random identifier that recognises this browser as a device your company has already named, so it is not asked again after each sign-out.	2 years
pt_company	Only if you tick “Keep this device signed in to the company”: remembers the company on this browser so step one can be skipped.	30 days, or until you leave the company or its password changes
Browser storage	Your light/dark theme choice, and unsaved form entries so a reload does not lose your typing.	The theme stays until you clear it; form entries end when the tab is closed.

This website itself sets no cookies of its own and uses no tracking.

11. Changes and contact

If we change this policy in a way that materially affects you, we will tell you before it takes effect. The date at the top of this page always reflects the current version.

Questions about this policy: [email protected]