Privacy policy

Blacrex is operated by Debasish Panda, sole proprietor, trading as Blacrex, Flat 3A, 2nd Floor, AE-203, Kestopur, Kolkata, West Bengal 700101, India. Questions about this policy or about data we hold go to privacy@blacrex.com.

Four kinds of information:

• Sign-in details. An email address, held by our authentication provider. Signing in is done with a code emailed to that address; a password exists only if you choose to set one, and we never see it — only a hash of it, which cannot be reversed.
• People records. The employees your organisation adds so equipment can be assigned to someone: name, employee number, department, work email, and which office they sit in. These people do not need accounts and usually have none.
• Asset records. Equipment, what it cost, where it is, who holds it, and the history of who held it before.
• Operational records. What your organisation writes around those assets as it uses the modules: fault tickets, service visits and maintenance contracts, vendor details, purchase requests and orders, software licences and their seat allocations, and physical-count results.

We do not collect payment card details, government identifiers, biometrics, location data from devices, or anything about your employees beyond what you enter.

Assignment history is append-only by design. Reassigning equipment closes the previous record and opens a new one rather than overwriting it, so the system can always show who held an item on a given date.

That is the entire point of the product — an asset register you cannot reconstruct is not evidence — but it does mean a person’s name persists in the record of equipment they once held, after they have left. If you need that removed, see Deletion below.

Each organisation’s data is isolated at the database level by row-level security policies, not by application code. A signed-in user issues queries that the database itself constrains to their own organisation, so application defects alone cannot expose another organisation’s records. A small number of administrative jobs — sending an invitation email, the renewal reminder emails — run with elevated database access, and are kept deliberately narrow for exactly that reason.

Within an organisation, access follows the role you assign: viewers read, editors record equipment and movements, administrators additionally manage settings and membership.

We do not sell data, share it with advertisers, or use it to train anything. The database and authentication run on Supabase, in a data centre in Singapore; the application itself runs on Railway. Encrypted weekly backup copies of the database and of the files you upload are kept on GitHub for 60 days. If you use the optional photo import, the photographed pages are sent to Anthropic to be transcribed. We do not store them — in our systems they exist only for the duration of that request — and Anthropic handles them under its own API data policy, which does not use them for training.

For as long as your organisation has an account with us, because an asset register is useful precisely in proportion to how far back it goes.

If you close your account we delete your organisation’s data within 60 days, except where we are required to keep something longer by law. Copies in routine backups rotate out within 90 days after that.

You can correct any record from within the application. For deletion of a specific person’s details from historical records — for example after an employee leaves and asks to be removed — contact privacy@blacrex.com and we will action it within 30 days.

Note that equipment records are never hard-deleted through the interface. Retiring, disposing of or marking an item lost changes its status and the record remains retrievable, which is deliberate.

Data is encrypted in transit. Passwords are hashed by our authentication provider and are not recoverable by us or by you — only resettable. Access between organisations is prevented by database policy rather than by application logic, and that isolation is covered by an automated test suite that runs on every change.

No system is perfectly secure. If you believe you have found a vulnerability, please tell us at security@blacrex.com before disclosing it publicly.

If this policy changes materially we will tell account administrators before the change takes effect. The date at the top always reflects the current version.