Legal

Privacy Policy

Effective 15 October 2026. This version replaces all earlier privacy statements published on maximpro.ai.

MaximPro is a retail management platform made by Proeffico Solutions Pvt Ltd, a company registered in India (CIN U72900UP2020PTC137508) at Office B:23, 3rd Floor, Sector-67, Noida, Uttar Pradesh 201301, India. In this policy, "we", "us" and "Proeffico" mean Proeffico Solutions Pvt Ltd. "MaximPro" means the product: the website at maximpro.ai, the MaximPro Cloud Portal, the MaximOps and MaximPro Shopper Android apps, and the MaximPro Retail Desktop application for Windows.

We wrote this policy to be read, not skimmed. It covers two different situations, and we are a different kind of party in each. Part A is about you as a visitor to this website. Part B is about data that stores enter into MaximPro while running their business, where the store is in charge and we act on its instructions.

How to reach us

Questions about this policy, requests about your data, and complaints go to our Data Protection Officer at dpo@proeffico.ai. Sales and general questions go to sales@maximpro.ai. You can also call +91 96677 96006 (India) or +968 9425 0505 (Oman), or write to us at the postal address above.

Part A — Visitors to maximpro.ai

For the website itself, Proeffico decides why and how personal data is used, so we are the data controller (or "data fiduciary" in the language of India's DPDP Act).

Forms you fill in

The website has two forms: Book a Demo and Contact. Both ask for your name, work email, phone number and company name, and let you add an industry, your country and a free-text message. We use this information for one purpose: to respond to your enquiry, arrange the demo or pilot you asked for, and follow up on it. We do not sell it or add you to third-party marketing lists.

Submissions are stored in Proeffico's customer relationship management system (ZIVUX, which is operated by Proeffico) so that the sales team in India and our founding partner in Oman, Kays International LLC, can respond to you. We keep enquiry records for as long as the conversation is live and for up to three years afterwards, unless you ask us to delete them sooner or you become a customer, in which case the record becomes part of your account.

The legal basis for this is your consent, given when you submit the form, and, where you are enquiring on behalf of a business, our legitimate interest in responding to a commercial enquiry. You can withdraw consent at any time by emailing dpo@proeffico.ai.

Cookies and analytics

maximpro.ai does not load any third-party analytics, advertising or tracking scripts, and sets no advertising or analytics cookies. We do not use Google Analytics, Meta Pixel, Hotjar or similar tools on this website. If that changes, we will update this policy and, where the law requires it, ask for your consent first.

The site uses browser session storage for one thing: if we suggest the India or Oman page based on your browser's time-zone setting and you dismiss the suggestion, we remember the dismissal for the rest of your browser session so we do not show it again. No lookup of your IP address or location is made for this, and nothing is sent to a third party.

Fonts are loaded from Google Fonts. When your browser fetches them, Google receives your IP address and standard request headers, as it would for any web resource. Google's handling of that request is described in Google's own privacy policy.

Server logs

Like every web server, ours records the IP address, requested page, time, referring page and browser type for each request. We use these logs to keep the site running, to detect abuse, and to rate-limit automated traffic. Log entries are kept for up to 90 days and then deleted, unless a specific entry is needed to investigate a security incident.

Email you send us

If you email any maximpro.ai or proeffico.ai address, we keep the correspondence for as long as it is relevant to the matter you raised and to our ordinary business records.

Part B — Data inside the MaximPro platform

When a retailer (our customer) uses MaximPro, the retailer decides what data goes in and what it is used for. The retailer is the data controller for that data. Proeffico processes it only to provide the service the retailer has subscribed to, and only on the retailer's instructions, which makes Proeffico a data processor. The subscription or licence agreement between Proeffico and the retailer, not this policy, is the document that governs that processing in detail.

If you are a shopper, employee or supplier of a store that runs MaximPro and you have a question about your data, the store is the right first contact. We will help the store answer you, and if you contact us directly we will pass your request to the store and, where we are able to, act on it with the store's instruction.

What the platform holds

Depending on which modules a retailer has switched on, MaximPro can hold the following categories of data on the retailer's behalf:

• Item master, stock, pricing, purchasing and warehouse documents, which are business data and normally contain no personal data.
• Customer records the store creates: name, phone, email, delivery address, loyalty and reward-point balances, purchase history and credit balances.
• Invoices, receipts and returns, which may carry a customer's name, phone number and, where tax law requires it, a tax registration number.
• Supplier records and contact details.
• Employee and user accounts: names, roles, login credentials, cashier or sales-person attribution on documents, and activity logs.
• For the Shopper app: the shopper's email address used for OTP sign-in, delivery addresses, the device's location when the shopper chooses a nearest store or places a delivery address on the map (see Location data below), order history, wishlist and cart, and a push-notification token for order updates. Guest carts and wishlists stay on the shopper's phone until they sign in.
• For pharmacies: prescription images a shopper uploads with an order, where the store has enabled this.
• Where a store has connected VIZO361 video analytics: footfall counts and alerts derived from the store's own CCTV. VIZO361 is a separate Proeffico product with its own documentation; MaximPro receives the counts and alerts, not the video.

Location data

Shopper app. The Shopper app asks for permission to use your device's location (precise or approximate, as you choose in your phone's settings) for two purposes only: to find the store nearest to you so that the catalogue, prices and delivery options shown are the right ones, and to place a pin on the map when you add or edit a delivery address. Location is read only while the app is open and only at the moment you use one of these features; the app does not track your location in the background and does not keep a history of where you have been. What is stored is the result — the store you selected and the delivery addresses you save to your address book — not a stream of coordinates. If you sign in, that store choice and your addresses are saved to your account with the retailer; as a guest, they stay on your phone. Granting location permission is optional: you can type or pick an address instead, and you can withdraw the permission at any time in your phone's settings, after which the app keeps working with the addresses you enter by hand. Location data is never used for advertising, never sold, and is not shared with anyone other than the retailer whose store you are ordering from and the hosting providers listed under sub-processors.

MaximOps app and PDT. The operations app does not request or use device location. Where the app refers to a "location", it means a stock location inside the store or warehouse (a shelf, a back store, a damage area), not a geographic position. The app does record which device created a document, using a device identifier the retailer assigns.

Retail Desktop and Cloud Portal. Neither collects device location. The Cloud Portal shows the store addresses the retailer has entered for its own branches and warehouses.

This website. maximpro.ai does not ask for or read your device location. The India/Oman page suggestion described above uses only your browser's time-zone setting. Our server logs record IP addresses, which can indicate a rough region, for the security purposes and retention period described in Part A.

Where the data lives

Cloud customers' data is hosted on cloud infrastructure that Proeffico operates and administers. For customers in India, data is hosted in India. For customers in Oman and the wider Gulf, and for Enterprise customers anywhere, we offer hosting in-region, on the customer's own premises, or in a private cloud, as agreed in the subscription. Ask us at sales@maximpro.ai if you need a specific hosting location.

The MaximPro Retail Desktop application, including the perpetual-licence edition, runs on the store's own Windows PC with a local SQL Server database. Data in that database stays on the store's hardware and never reaches Proeffico unless the store adds a cloud tier, at which point the documents the store chooses to sync are copied to the cloud account under the terms above. Backups of a desktop-only installation are the store's responsibility.

Who else touches the data

We use a small number of sub-processors, each only for the function named here, and each bound by a contract that requires them to protect the data at least as well as we do:

• Cloud hosting and backup providers, for running the Cloud Portal and storing customer databases and backups.
• Email delivery providers, for sending transactional email such as sign-in OTPs, invoices and order updates on the retailer's behalf.
• Meta's WhatsApp Business API, only where a retailer has enabled WhatsApp ordering or WhatsApp notifications. Messages exchanged on WhatsApp are also subject to WhatsApp's own terms and privacy policy.
• Google, for distributing the Android apps through Google Play and for the Android push-notification service that delivers order updates.
• Kays International LLC (Muscat, Oman), our founding partner, which provides implementation, training and first-line support to customers in Oman and the Gulf and therefore may access a customer's account for support purposes.

We will give a customer a current list of the specific providers behind each category on request and will tell customers before we add a new one that would handle their data.

Retention

Platform data is kept for as long as the customer's subscription is active. When a subscription ends, the customer can export its data for 30 days. After that we delete the account data from live systems, and from backups as those backups roll over, within 90 days. Invoices and tax records that Proeffico itself must keep as the supplier of the service are retained for the period Indian and Omani tax law requires, which is currently up to eight years.

Security

Proeffico's information-security management system is certified to ISO 27001:2022 (certificate 27001-7724). In general terms that means: data is encrypted in transit between your browser or app and our servers; cloud databases are backed up on a schedule; access to production systems is limited to staff who need it, uses individual credentials, and is logged; customer accounts are kept separate from one another; the Cloud Portal enforces role-based access and keeps user activity logs so a store can see who did what; and our vulnerability-management and incident-response procedures are reviewed as part of the certification audits.

No system is perfectly secure. If we become aware of a breach affecting personal data we will notify the affected customer without undue delay, and we will notify the Data Protection Board of India, the relevant EU supervisory authority, or Oman's Ministry of Transport, Communications and Information Technology as the applicable law requires.

Which laws apply

Proeffico is an Indian company and the Digital Personal Data Protection Act, 2023 applies to all personal data we handle. Where a customer or a data subject is in the European Union or the United Kingdom, the GDPR or UK GDPR also applies, and we will sign standard contractual clauses with customers who need them for transfers to India. Where a customer is in Oman, the Personal Data Protection Law issued by Royal Decree 6/2022 and its executive regulations apply, and we support customers in meeting their obligations under it, including obtaining permits for transfers outside Oman where that law requires them.

We align our practices to these three frameworks. We do not claim compliance with the data-protection laws of other Gulf states beyond what the general principles above cover; if you are a customer in the UAE, Saudi Arabia or Qatar, ask us and we will tell you exactly what we can and cannot commit to.

Your rights

Whichever law applies to you, you can ask us to tell you what personal data we hold about you, to correct it, to delete it, to give you a copy in a usable format, and to stop or limit a particular use of it. Where our processing relies on consent, you can withdraw that consent at any time, which will not affect anything done before you withdrew it. Under the DPDP Act you may also nominate another person to exercise these rights for you if you are unable to.

To exercise any of these rights, email dpo@proeffico.ai from the address we have on file, or write to the postal address above. We may ask you to confirm your identity. We respond within 30 days, and sooner where the law sets a shorter period. If your data is held in a retailer's MaximPro account rather than by us as controller, we will forward the request to that retailer and support them in answering it.

If you are not satisfied with our answer you can complain to the Data Protection Board of India, to your local EU or UK supervisory authority, or to the competent authority in Oman.

Grievance Officer

As required by India's DPDP Act, we have appointed a Grievance Officer who is responsible for handling complaints about how we process personal data. The Grievance Officer can be reached at dpo@proeffico.ai or at the postal address above, and will acknowledge a complaint within 48 hours and resolve it, or explain why it cannot be resolved, within 30 days.

Children

maximpro.ai and the MaximPro products are built for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children through this website. Retailers who use the Shopper app are responsible for deciding whether their own customers must be adults and for obtaining verifiable parental consent where their local law requires it. If you believe a child has given us personal data, tell us at dpo@proeffico.ai and we will delete it.

Changes to this policy

When we change this policy we will update the effective date at the top of the page. If a change materially affects how we use personal data already in our hands, we will tell existing customers by email before it takes effect. Earlier versions are available from dpo@proeffico.ai on request.

Proeffico Solutions Pvt Ltd · CIN U72900UP2020PTC137508 · Office B:23, 3rd Floor, Sector-67, Noida, Uttar Pradesh 201301, India