Privacy Policy

How we collect, use, and protect your information

Last Updated: January 10, 2026

1. Information We Collect

1.1 Account Information

When you register for an account, we collect:

• Full name
• Email address
• Phone number (optional)
• Organization/Company name (optional)
• GSTIN (for invoice purposes, optional)
• Password (stored in encrypted form)

1.2 Evidence Files

When you upload files for certification:

• File content (processed for hash calculation, not stored permanently unless using vault feature)
• File metadata (name, size, type, creation date)
• EXIF data (for images: camera info, GPS coordinates, timestamps)
• Cryptographic hash (SHA-256)

1.3 Usage Data

We automatically collect:

• IP address
• Browser type and version
• Device information
• Pages visited and features used
• Date and time of access
• Certificate generation history

1.4 Payment Information

For paid services:

• UPI transaction references (UTR numbers)
• Payment amounts and dates
• Invoice details

Note: We do not store credit card numbers or bank account details. Payments are processed through secure UPI channels.

2. How We Use Your Information

Purpose	Data Used	Legal Basis
Account creation & authentication	Name, email, password	Contract performance
Certificate generation	File content, metadata, hash	Contract performance
Blockchain timestamping	File hash only	Contract performance
Invoice generation	Name, email, organization, GSTIN	Legal obligation (GST compliance)
Service improvement	Usage analytics	Legitimate interest
Security monitoring	IP, access logs	Legitimate interest
Customer support	Account info, usage history	Contract performance

3. Data Storage and Security

3.1 Storage Location

Your data is stored on secure servers located in India, in compliance with data localization requirements under the Information Technology Act, 2000 and related rules.

3.2 Security Measures

We implement robust security measures including:

• Encryption: All data transmitted using TLS 1.3 encryption
• Password Security: Passwords hashed using bcrypt algorithm
• Access Controls: Role-based access with audit logging
• Infrastructure Security: Firewalls, intrusion detection, regular security audits
• Backup Systems: Regular encrypted backups

3.3 Data Retention

Data Type	Retention Period
Account information	Until account deletion + 7 years (legal requirement)
Uploaded files (non-vault)	Deleted after certificate generation (within 24 hours)
Evidence vault files	Until user deletes or account termination
Certificate records	Permanently (for verification purposes)
Payment records	7 years (GST compliance requirement)
Access logs	90 days

4. Data Sharing

4.1 We Do NOT Share

We never sell, rent, or trade your personal information or evidence files to third parties for marketing purposes.

4.2 Limited Sharing

We may share data only in these circumstances:

• Service Providers: With trusted partners who assist in operating our service (hosting, analytics) under strict confidentiality agreements
• Legal Requirements: When required by law, court order, or government authority
• Blockchain Networks: File hashes (not content) are submitted to public blockchain for timestamping
• With Your Consent: When you explicitly authorize sharing

4.3 Blockchain Transparency

5. Your Rights

Under applicable Indian law and best practices, you have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and personal data (subject to legal retention requirements)
• Data Portability: Receive your data in a structured, machine-readable format
• Withdraw Consent: Withdraw consent for optional data processing
• Grievance Redressal: Lodge complaints regarding data handling

6. Cookies and Tracking

We use essential cookies for:

• Session management and authentication
• Security (CSRF protection)
• Remembering your preferences

We do not use third-party advertising cookies or invasive tracking technologies.

7. Children's Privacy

Evidence Custodian is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we discover that a child has provided us with personal information, we will delete it immediately.

8. International Users

If you access the Service from outside India, please be aware that your information will be transferred to, stored, and processed in India. By using the Service, you consent to this transfer.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Email notification to registered users
• Prominent notice on our website
• In-app notification

Continued use of the Service after changes constitutes acceptance of the updated policy.

10. Data Protection Officer

In compliance with data protection requirements, we have designated a Data Protection Officer who can be contacted for any privacy-related inquiries.