Does TeamOnTime sell agency or merchant data?

No. We never sell, monetize, or rent user data, agency client lists, or merchant information under any circumstances.

How is our data protected under the Indian DPDP Act, 2023?

TeamOnTime operates under strict purpose limitation, data minimization, and encryption standards aligned with the Digital Personal Data Protection Act 2023 and Information Technology Act 2000.

How are production credentials and API keys stored?

All API tokens, SSH keys, and staging credentials are stored in AES-256 encrypted vaults (such as 1Password or HashiCorp Vault) accessible only by assigned engineering pod leads.

What is TeamOnTime's credential purge policy after project completion?

30 days post-project handoff, all temporary developer credentials, access tokens, and staging database dumps are automatically purged from our internal systems.

DATA PRIVACY & COMPLIANCE STANDARD

Enterprise Privacy Protocol.

How TeamOnTime OS protects agency data, merchant credentials, and partner intellectual property. Aligned with a global GDPR mindset and the Indian Digital Personal Data Protection (DPDP) Act, 2023.

Schedule Privacy Audit → View NDA Standard

100% Bilateral NDA Standard

GDPR & DPDP Act 2023 Aligned

Zero Data Sales Guarantee

AES-256 Vault Encryption

OUR CORE PRIVACY COMMITMENT

We never sell user data. We collect only the minimum information required to securely deliver software engineering services, manage agency developer pods, and maintain robust infrastructure security.

01 • DATA GOVERNANCE PHILOSOPHY

Built for Invisible Agency Security.

Operating as an invisible software engineering operating system requires strict adherence to privacy-first engineering standards.

Purpose Limitation

Data collected is strictly restricted to fulfilling engineering Statements of Work (SOW), executing Git pull requests, and maintaining real-time developer communication inside agency Slack workspaces.

Data Minimization

We request only essential developer tokens, API endpoints, and staging credentials. Production keys are stored in encrypted vaults and purged immediately post-handoff.

Storage Limitation & Purge

All temporary staging credentials, developer logs, and project database dumps are automatically queued for deletion 30 days after sprint handoff verification.

02 • WHITE-LABEL ISOLATION PROTOCOLS

Complete Brand Anonymity.

Your clients never see TeamOnTime's brand, domain, or developer footprints.

Git Commit Masking

All developer commits executed inside your agency's GitHub, GitLab, or Bitbucket repositories map strictly to your agency email domain. Zero TeamOnTime public footprints.

Zero Direct Client Contact

Our engineers operate silently behind your agency buffer. We never contact, email, or solicit your end-merchants under any circumstances, backed by a strict non-solicitation covenant.

Isolated Staging Sandboxes

Development preview builds are deployed on password-protected staging containers with `noindex, nofollow` headers to prevent search indexing or public leakage.

03 • CREDENTIAL LIFECYCLE TIMELINE

How Credentials Move Safely.

A deterministic 4-step workflow ensuring zero persistent access vulnerability.

01 / INTAKE

Encrypted Vault Ingestion

Agency shares API keys via 1Password / HashiCorp Vault. Restricted to assigned lead developer.

02 / EXECUTION

Masked Git Sprints

Commits logged inside agency Git org under agency email aliases with sub-15m Slack updates.

03 / HANDOFF

QA & Revocation Prompt

Final code merged to production branch; prompt sent to agency to rotate temporary staging keys.

04 / PURGE

30-Day Automated Delete

All local logs, temporary tokens, and staging dumps permanently purged from TeamOnTime vaults.

04 • LEGAL COMPLIANCE & RIGHTS

Your Rights & Grievance Redressal.

Compliant with the Information Technology Act, 2000 and Digital Personal Data Protection (DPDP) Act, 2023.

DATA PRINCIPAL RIGHTS & GRIEVANCE DESK

Under Indian DPDP Act guidelines and global GDPR principles, agency partners reserve full rights to request: (1) Access to a summary of personal & technical data processed; (2) Instant correction or updating of inaccurate account records; (3) Complete erasure of non-essential project telemetry; and (4) Nomination of a representative for data management. To exercise these rights, contact our Data Protection Officer (DPO) at privacy@teamontime.com.

05 • FREQUENTLY ASKED QUESTIONS

Privacy & Security Governance FAQ.

Does TeamOnTime sell or share agency client lists?

Never. We operate under bilateral NDA. We do not sell, rent, monetize, or disclose your agency identity, client roster, or merchant revenue numbers under any circumstances.

How are API keys and database credentials protected?

All credentials shared during onboarding are encrypted using AES-256 via enterprise password vault integrations (1Password / HashiCorp). Access is strictly restricted to assigned pod engineers.

What is your cookie policy for agency visitors?

We utilize strictly essential session cookies necessary for website performance and security monitoring. We do not use intrusive cross-site tracking scripts or ad retargeting networks.

How does TeamOnTime handle data deletion upon retainer termination?

Upon account termination or completion of an SOW build, all temporary staging instances and stored credentials enter a 30-day deletion queue, after which a Certificate of Data Erasure can be issued.

CONFIDENTIAL & SECURE

Questions About Our Privacy Protocol?

Our Data Protection Officer and engineering leads are available to review custom privacy requirements or security questionnaires.

Schedule Privacy Consultation → Review Standard NDA