Privacy Policy

Surety Seven Technology Private Limited operates suretyseven.com and the associated Platform. The Platform is business software that helps insurers, intermediaries, contractors (principals), beneficiaries and their teams manage the surety bond lifecycle: onboarding, underwriting, approvals, issuance, amendments, claims and reporting.

We are a technology company. We are not an insurer or insurance intermediary and do not solicit insurance. For personal data that our business customers upload or manage on the Platform, we generally act as their data processor; for account, usage and website data we act as the data fiduciary (controller).

Information you provide

• Account details: name, email address, phone number, organization, designation and role. Passwords are stored only as salted one-way hashes.
• Business information: company profile, registration identifiers (such as CIN, GSTIN and PAN), financial statements, bank and payment details, tender and contract details, bond, claim and invocation records, and documents you upload.
• Information about other people: details of directors, promoters, authorized signatories and contacts that you provide in the course of an application. You are responsible for having the right to share this information with us.
• Communications: messages, remarks, support requests, and emails you send through the Platform.

Information collected automatically

IP address, browser and device type, pages visited, timestamps, error logs and audit logs of actions taken in the Platform. If you enable browser notifications, we store the push subscription your browser provides.

Information from third parties

With the authorization of the relevant business customer, we obtain company, credit and financial information from the providers listed in Section 7 and from public registries. If you connect a Google account, we receive the information described in Section 4.

• To create and manage accounts and authenticate users, including one-time passwords.
• To provide Platform features: underwriting workflows, approvals, document generation, e-signing, reports, ratings and notifications.
• To share application and bond information with the insurers, beneficiaries, reinsurers and intermediaries involved in a transaction, as directed by our customers.
• To send service, security and transactional communications.
• To secure the Platform, prevent fraud and abuse, maintain audit trails and troubleshoot problems.
• To comply with legal and regulatory obligations and enforce our terms.
• To understand aggregate usage and improve the Platform.

Connecting a Google account is optional. Users can connect a Gmail account from their profile so that emails they send from the Platform (for example approval requests, bond documents and follow-ups) are delivered from their own email address rather than a generic system address.

4.1 What Google user data we access

When you connect a Google account, we request these permissions:

• Your Google account email address (userinfo.email), to identify which Google account you connected.
• Permission to send email through your Gmail account (https://mail.google.com/), which Google requires for authenticated sending through Gmail’s SMTP service.

We receive and store your Google account email address and an OAuth refresh token issued by Google. We do not read, scan, index, download or store the contents of your mailbox, existing emails, attachments, labels, drafts or contacts.

4.2 How we use it

We use this access only to send transactional emails on your behalf, such as approval requests, bond documents, notifications and follow-ups that you (or a workflow you start) initiate in the Platform. These emails are sent from your Gmail address. We do not use Google user data for any other purpose.

4.3 How we store and protect it

• Your Google account email address and OAuth refresh token are stored on our servers in our access-restricted production database. The refresh token is used only by our server-side code to obtain short-lived access tokens when an email you initiated needs to be sent. It is never sent to or exposed in your browser.
• The short-lived access token is held in a secure, HTTP-only cookie, which scripts running in your browser cannot read.
• The Platform is served over HTTPS, so data sent between your browser and our servers is encrypted in transit.
• Access to the Platform and its data is protected by role- and attribute-based access controls and restricted administrative access.
• Refresh tokens are deleted when you disconnect your Google account (see Section 4.5).

4.4 Who we share it with

We do not sell Google user data, and we do not share it with anyone except:

• Google, as necessary to send the emails you initiate;
• our infrastructure providers that host the Platform and store the data on our behalf (Section 7), under confidentiality and data protection obligations;
• the recipients of the emails you send (they receive the email itself, as with any email you send);
• authorities, where we are required to do so by applicable law; and
• a successor, in a merger, acquisition or sale of assets, with prior notice to you.

We do not share Google user data with advertising platforms or data brokers, and we never send it to AI providers or use it to develop, improve or train generalized AI or machine learning models. Our personnel do not read Google user data unless you give explicit consent, it is necessary for security purposes, or it is required to comply with law.

4.5 How to revoke access and request deletion

• Disconnect in the Platform. Go to your profile and remove your connected Google account. This immediately and permanently deletes the stored refresh token and the connection record from our database, and we can no longer send email from your account.
• Revoke at Google. You can remove our access at any time at myaccount.google.com/permissions. Revoking here invalidates the tokens we hold.
• Request deletion. To request deletion of any Google user data we hold about you, email support@suretyseven.com from the account email address. We will delete it promptly, subject to any records we must retain by law.

4.6 Limited Use disclosure

Surety Seven’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We process personal data on the basis of your consent, for the performance of our agreement with you or your organization, for legitimate uses permitted by the Digital Personal Data Protection Act, 2023, and to comply with law. Where processing relies on consent, you may withdraw it at any time by contacting us; this does not affect processing that took place before withdrawal, but may limit your ability to use parts of the Platform.

We do not sell personal information. We share it only:

• with counterparties to a surety transaction (such as insurers, beneficiaries, reinsurers and intermediaries), as directed by our customers;
• with service providers that process data on our behalf (Section 7);
• when required by law, regulation, court order or a lawful request by a government authority;
• to protect the rights, property or safety of our users, the public or us;
• in connection with a merger, acquisition or sale of assets, subject to this Privacy Policy.

We use the following categories of providers. Each is permitted to use personal information only to perform services for us and is bound by confidentiality and data protection obligations.

Some providers store or process data outside India. Where this happens, we take steps to ensure the data receives a level of protection consistent with this policy and applicable law.

We use strictly necessary cookies to keep you signed in, maintain your session and selected organization, and for security. We use privacy-friendly analytics to understand aggregate page usage. We do not use cookies for third-party advertising or to track you across other websites. You can block cookies in your browser, but the Platform will not work without the necessary ones.

We keep personal information for as long as your account is active or as needed to provide the Platform, and afterwards for as long as required to meet legal, regulatory, audit, tax and dispute-resolution obligations. Bond and claim records in particular may need to be kept for the life of the bond and the applicable limitation period. Google OAuth tokens are deleted as soon as you disconnect your Google account. When data is no longer needed, we delete or anonymize it.

We protect information using HTTPS for connections to the Platform, hashed passwords, role- and attribute-based access controls and restricted administrative access. No system is completely secure; if we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

Subject to applicable law, you have the right to:

• obtain a summary of the personal data we process about you;
• correct, complete or update inaccurate personal data;
• request erasure of personal data that is no longer needed;
• withdraw consent;
• nominate another person to exercise your rights on your behalf; and
• raise a grievance with us, and thereafter with the Data Protection Board of India.

If your data was provided to us by your organization, we may refer your request to them. To exercise any right, email support@suretyseven.com. We may need to verify your identity before acting on a request.

The Platform is intended for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new effective date and, for material changes, notify you by email or in the Platform before the changes take effect.

For questions, requests or complaints about this policy or our data practices, contact our Grievance Officer:

We will respond to requests within a reasonable time. See also our Terms of Service.