RTOOS's MVP is built, and we're now onboarding a first group of merchants for pilots. This policy describes how we currently collect and use personal data. It will be updated as the product develops. If you're a merchant considering a pilot, the specific data-processing terms for your account are set out in your Pilot Agreement and Data Processing Agreement (DPA).
This Privacy Policy applies to RTOOS, a product operated by RIXSTO (proprietor: Ritchie Pulikottil), India. It covers:
Where a merchant uses RTOOS to process their customers' data, the merchant is generally the party responsible for collecting that data lawfully and for its relationship with its own customers. RTOOS acts to support the merchant's order-confirmation and delivery-recovery process, as described further below and in the applicable DPA.
From merchants and their staff:
Customer/order information (provided to us by merchants, or entered by their customers during a confirmation flow):
Technical and website data:
We do not currently operate automated or bulk WhatsApp messaging. Where WhatsApp is used, it is via operator-initiated, prefilled click-to-chat links, and RTOOS does not hold Meta/WhatsApp Business API credentials on a merchant's behalf at this stage.
In most cases, the merchant determines what customer data is shared with RTOOS and for what purpose (broadly analogous to a "Data Fiduciary" role under India's Digital Personal Data Protection Act, 2023), and RTOOS processes that data to provide the service (broadly analogous to a "Data Processor" role). This general description is not a determination of legal status for every situation — the actual allocation of responsibilities depends on the specific data flows and is set out precisely in that merchant's Pilot Agreement and DPA, which govern in the event of any inconsistency with this general description. Merchants are responsible for having a lawful basis to share their customers' data with us and for their own privacy disclosures to their customers.
We may use third-party infrastructure and service providers (for example, hosting, code repository, and website/form providers) to operate RTOOS and this website. We do not currently publish a fixed list of subprocessors on this page, as our infrastructure is still evolving during the pilot stage; a current subprocessor list will be provided to merchants as part of their DPA and kept up to date as our infrastructure is finalised.
Our default operational rule is: personal data is retained only for as long as necessary to provide the pilot/service and for the purposes described in this policy, and is deleted or returned in accordance with the applicable Pilot Agreement/DPA once a pilot ends or the data is no longer needed — subject to any legal, tax, or security-related retention requirements that require us to keep it longer. Because RTOOS is in an early pilot stage, specific retention periods and deletion timelines for a given merchant are confirmed in that merchant's Pilot Agreement/DPA. Merchants or customers who want data deleted can contact us using the details below, and we will act on reasonable requests in line with applicable law and any obligations to the relevant merchant.
The deployed RTOOS application implements password hashing, secure session handling (HttpOnly, Secure, SameSite cookies), CSRF protection, rate limiting, protections against account/user enumeration, signed and expiring links for sensitive actions, output escaping, and avoids writing secrets to logs. We also keep merchant data isolated from other merchants at the application level and maintain audit logs of key actions. These are the controls currently in place — RTOOS has not undergone independent security certification (e.g. SOC 2 or ISO 27001) at this stage, and we do not claim otherwise.
Our infrastructure providers may process or store data outside India depending on where they operate. We do not currently guarantee a specific data location, and this will be clarified as our production infrastructure is finalised and reflected in merchant DPAs. If this changes in a way that's material to how your data is handled, we will update this policy.
Depending on applicable law — including India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified 14 November 2025, with obligations phasing in over the following 18 months) — you may have rights to access, correct, or request deletion of your personal data, and to raise a grievance about how it's handled. We are aligning our practices with the DPDP Act and Rules as their provisions come into force, rather than claiming full compliance with obligations that are not yet in effect. To exercise these rights or raise a concern, contact us using the details in Section 11. Merchants' end customers should also check whether the merchant has its own process for these requests, since the merchant is often the first point of contact for its own customers.
We may update this policy as RTOOS develops, particularly as we move from pilot to production. We will update the "Last updated" date above when we do. Material changes affecting active merchants will also be communicated directly where appropriate.
RIXSTO (Proprietor: Ritchie Pulikottil)
602E, CeeDeeYes Chennai Pattinam Apartments, Ammapettai, OMR, Nellikuppam Road
Chennai, Tamil Nadu – 603108, India
Email: pulikottil.ritchie@gmail.com