Privacy Policy

ScopeLatch is operated by MUCO LABS, a sole proprietorship owned by Srinivash Mahalingam, based in Erode, Tamil Nadu, India. In this policy, "we" and "us" mean MUCO LABS. You can reach us at mucolabs2026@gmail.com.

• Your account data (your name, email, business details): we decide why and how it is used, so we are the Data Fiduciary for it.
• Your clients' data that you enter (client names, phone numbers, emails, project details, messages): you decide why it is collected, so you are the Data Fiduciary and we process it only on your instructions to provide the service, as set out in our Terms. You are responsible for telling your clients that you use ScopeLatch and for having a lawful reason to store their details.

• Account: your name, email address and password. The password is stored only as a secure hash by our sign-in provider; we never see it. We also record the version of these terms you accepted and when.
• Business profile: business name, logo link, business email, phone, address, registration numbers (such as GSTIN) and payout details you add (UPI ID, bank account details) so they can appear on your invoices and on the payment step your clients see. Bank account details are sensitive personal data under the SPDI Rules; we encrypt bank account numbers in our database.
• Work data: clients, projects, scope items, change orders, messages you paste in, payment references you record, invoices and documents.
• Approval records: when your client approves, declines or accepts work through a link, we record the action, the name they type, the time, their IP address and browser, and a SHA-256 fingerprint of exactly what was shown to them, so the record can be relied on later.
• Technical data: request logs (IP address, browser type, time and page requested) kept by us and our hosting provider to keep the service secure and working.

We do not use advertising trackers or sell personal data. We do not knowingly collect data from anyone under 18.

• To create and secure your account and sign you in.
• To provide the service: show your workspace, generate approval links, approval records and invoices.
• To send service emails such as email verification and password reset. We do not send marketing emails without your permission.
• To process Pro plan payments you make to us and keep the records that tax and accounting law require.
• To prevent fraud and abuse, fix problems, and meet legal obligations.

We process your account data because you gave it to us to use the service and agreed to these terms. You can withdraw your consent at any time as easily as you gave it, by emailing us or deleting your account; this does not affect processing that already happened.

We use only the cookies needed to keep you signed in and secure. We do not use analytics or advertising cookies. If you block these cookies, you will not be able to sign in.

We share data only with service providers that help us run ScopeLatch, under their data-protection terms:

• Supabase — database and sign-in. Our database is hosted in Mumbai, India.
• Vercel — website hosting. Our application servers run in Mumbai, India; pages may be delivered through their global network, and request logs may be processed outside India.
• Resend — delivery of account emails (verification and password reset). Your email address may be processed outside India for this.

When you press a "Send on WhatsApp" button, the message is handed to WhatsApp (Meta) on your phone or computer and is then covered by WhatsApp's own terms. Your clients see only what you choose to send them through a link. We may disclose data if Indian law, a court or a government authority lawfully requires it.

Where data is processed outside India, it is only in countries the Government of India has not restricted, and with providers bound to protect it.

• Account and workspace data: while your account is active. If you ask us to delete your account, we delete it within 30 days.
• Our own payment and tax records (for Pro payments): for as long as Indian tax law requires, usually up to 8 years.
• Security and access logs: at least one year, as the DPDP Rules require, then deleted.
• Copies in backups are removed as those backups expire.

Approval records and invoices belong to your workspace. Download or print any you need to keep before you delete your account.

Data is sent over encrypted connections (HTTPS) and stored with a provider that encrypts data at rest. Each workspace can see only its own data, sign-in attempts are rate-limited, and sessions are kept in secure cookies. No system is perfectly secure.

If a breach affects personal data, we will tell the affected users without delay and the Data Protection Board of India within 72 hours, as the DPDP Rules require. If it affects data you hold about your clients, we will tell you within 48 hours so you can inform them.

Under the Digital Personal Data Protection Act, 2023 you can:

• get a summary of the personal data we hold about you and how we use it;
• correct, complete or update it (most of it you can edit yourself in Settings);
• ask us to erase it, or withdraw your consent;
• nominate another person to exercise these rights if you die or become unable to;
• raise a grievance with us, and if not resolved, with the Data Protection Board of India.

Email mucolabs2026@gmail.com from your account email address. We reply within 30 days. Clients of our customers should first contact the business that sent them the link, since that business controls their data; we will help that business respond.

Srinivash Mahalingam, Proprietor and Grievance Officer, MUCO LABS, Erode, Tamil Nadu, India. Email: mucolabs2026@gmail.com. We acknowledge grievances within 24 hours and resolve them within 15 days.

If we change this policy, we will update the date above and, for important changes, tell you by email or in the app before they apply.