1. Who we are
Serial Letterhead is developed and operated by M PRO 9 Pvt. Ltd., ("M PRO 9", "we", "us"). This policy explains how we handle personal data when you visit our website, request a demo, or use the Service. We follow the Digital Personal Data Protection Act, 2023 and other applicable Indian laws.
2. Our role
For the letters and records an organisation creates in Serial Letterhead, the organisation (our Customer) decides why and how the data is used, and we process it on its behalf to provide the Service. Questions about a specific letter or about an employer's use of the Service should go first to that organisation's admin. For our website, demo requests and customer accounts, we decide how the data is used.
3. Data we collect
- Organisation sign-up: organisation name, address, GST number (GSTIN), email address and mobile number, the admin's name and password (stored only as a secure one-way hash), and a one-time email code (stored only as a secure hash and deleted after use).
- Demo and contact requests: name, organisation, phone, email, team size, chosen plan and your message.
- User accounts: name, username, role, password (stored only as a secure one-way hash), and the profile the admin enters: position, branch, branch address, taluk, district, state and country.
- Letters and content: letterheads, letter text, recipients, subjects, templates and their filled-in details, images, signatures and stamps, reference numbers and generated PDFs.
- Activity records: sign-ins, previews, issues, downloads, prints, views, QR scans, edits, cancellations and deletion requests, each with the date and time, the device and browser type, and the network (IP) address.
- Location: if the organisation turns on location tracking and the user allows it in the browser, the approximate location (latitude and longitude) of these actions, which may be converted into a place name.
- AI assistant: if used, the description typed by the user and the draft text.
4. How we use it
- to provide the Service: issuing, numbering, verifying and storing letters, and showing records to the organisation's admins;
- to keep the Service secure: preventing misuse, detecting fake letters, and investigating problems;
- to provide support, send service notices and invoices;
- to answer demo and contact requests (we use these details only for that purpose);
- to comply with legal obligations.
We do not sell personal data, and we do not use letter content to advertise to anyone.
5. Sharing
We share personal data only as needed to run the Service, with:
- Hosting and infrastructure providers that store and run the Service for us;
- OpenStreetMap (Nominatim), which turns recorded coordinates into place names — only when the organisation has location tracking and place names switched on;
- AI providers chosen by the organisation for the AI writing assistant, such as Ollama (Ollama Cloud) or Anthropic — only when the assistant is switched on and used. These providers may process data outside India;
- Authorities, when required by law or to protect rights and safety.
When an organisation runs Serial Letterhead on its own server, its data stays on that server and is not shared with us, except what the organisation chooses to send us for support.
6. Cookies
The portal uses one essential cookie to keep you signed in. It is not used for advertising or tracking across websites. Your browser may also store small preferences (such as the typing language and unsent drafts) on your own device.
7. Storage and security
We use encrypted connections (HTTPS), hashed passwords, role-based access for admins and staff, sign-in protection against repeated failed attempts, and records of every important action. Only an organisation's admin can access its original letterhead file. No method of storage or transmission is completely secure, but we work to protect your data and will inform affected Customers about a personal data breach as required by law.
8. Retention
Letters and their records are kept for as long as the organisation's account is active, because a reliable register of issued letters is the purpose of the Service. After an account ends, the organisation can request an export within 30 days; after that we delete the data from the hosted Service unless the law requires us to keep it. Demo requests are kept for up to 24 months unless you ask us to delete them earlier.
9. Your rights
Under the DPDP Act, 2023 you can ask to access a summary of your personal data, correct or update it, have it erased where it is no longer needed, withdraw consent where processing is based on consent, raise a grievance, and nominate a person to exercise your rights. For data inside an organisation's account, we will pass your request to that organisation and help it respond. Note that a letter issued in an organisation's name is part of its official record and may need to be kept.
10. Children
The Service is meant for organisations and their staff. It is not directed at children, and we do not knowingly collect children's data except where an organisation (for example a school) includes it in its own letters, in which case the organisation is responsible for obtaining any required consent.
11. Changes to this policy
We may update this policy. The date of the latest version is shown at the top of this page, and significant changes will be communicated to Customers.
12. Grievance Officer and contact
For any questions, requests or complaints about personal data, contact our Grievance Officer:
Grievance Officer, M PRO 9 Pvt. Ltd.
Email: (subject: "Grievance") · Phone:
We aim to acknowledge grievances within 48 hours and resolve them within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India.