Privacy policy

DRAFT — NOT LEGAL ADVICE — for review by a qualified Indian lawyer before publication

Prepared by the Upkiva product team from the product as built (October 2026) and reviewed against the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), the Information Technology Act, 2000 and the CERT-In directions of April 2022 (review: REVIEW-2026-10.md). Most DPDP duties apply from 13 May 2027; we follow them now. A qualified Indian lawyer must check every statement and the items marked [CONFIRM] before this is published as final.

Upkiva Privacy Policy

Effective date: [●] · Version: 0.2 (draft, October 2026)

Upkiva ("Upkiva", "we") is a cloud service that businesses providing AMC and field service (for example air-conditioner servicing) use to run their work: complaints, technician visits, parts, invoices, payments and customer messages. This policy explains what personal data is processed through Upkiva, why, for how long, with whom it is shared, where it is stored, and how you can use your rights.

1. Who is responsible for your data

Upkiva is used by many independent businesses ("Businesses", each a "tenant"; for example TV Palace, Surat). Who decides how your data is used depends on who you are:

When a Business is the data fiduciary, its own privacy notice applies, and requests about your data should go to that Business first (its contact details are on your invoice and messages). We help the Business answer them. A template notice that Businesses can adopt is in Part B.

Part A: Upkiva as data fiduciary

A1. Data we collect

• Account data: name, mobile number, email, role, the business you belong to, password (stored only as a one-way hash), one-time codes (stored hashed, short-lived), sign-in history, device and browser information, and IP address.
• Business onboarding data ("Request access" / sign-up): business name, city, owner's name, mobile, email, number of technicians, GSTIN and address.
• Support data: messages and call notes with our team. When a Business allows it, a time-limited support session in which our staff view the Business's workspace. Each session is logged.
• Security and service logs: web-server and API request logs (with IP address, time, the page or address called, but never passwords, codes or search text), error reports, and audit logs of administrative actions.
• Website data: pages visited and basic analytics [CONFIRM: analytics tool and cookies used; if none beyond what is needed to sign in, say so].

A2. Purposes and legal basis

Under the DPDP Act, personal data may be processed with your consent (s.6) or for a legitimate use listed in s.7. "Contract" and "legitimate interest" are not separate grounds in Indian law.

We do not sell personal data. We do not use customer or technician data processed for a Business for our own marketing, or to train general-purpose AI models.

A3. Retention (Upkiva as fiduciary)

• Account data: while the account is active, and 12 months after it is closed [CONFIRM].
• Sign-up requests that are not approved: 6 months [CONFIRM].
• Web-server and API logs: 180 days (CERT-In directions).
• Audit logs and records of processing: at least 1 year (DPDP Rule 8(3), from 13 May 2027).
• Our own invoices to Businesses: as tax law requires (see the retention schedule).

Full schedule: data-retention-and-deletion.md.

Part B: Data we process for Businesses (template notice for Businesses)

Businesses using Upkiva should publish this part, adapted, under their own name as data fiduciary. Text in [brackets] is filled in by the Business. The notice must be available in English and, on request, in any language of the Eighth Schedule to the Constitution (DPDP s.5(3)); Upkiva provides Gujarati and Hindi.

[Business name], [address], GSTIN [●] ("we") uses the Upkiva platform to provide AC and appliance service, AMC contracts, installation and repairs.

B1. Customers

Basis. We use this data because you asked us for the service and gave it to us for that purpose (DPDP s.7(a)), and with your consent where we ask for it (for example renewal offers). Your technician's live location is shown to you only for your active job while the technician is on the way.

B2. Technicians and staff

Covered by the separate notice consent-technician-location.md (in Gujarati, Hindi and English, shown in the Upkiva Tech app before the first check-in and after every change): attendance selfie and location, location while checked in, journey and kilometres, device checks (fake-location detection, phone clock, app version), job proofs, cash collected and settled, incentives and penalties, ID documents (stored encrypted; only the owner / admin can view the numbers). For employees the basis is mainly the employment legitimate use (DPDP s.7(i)); for freelance or agency technicians it is consent [CONFIRM].

B3. Who we share with

• Upkiva (platform provider, our data processor).
• Upkiva's sub-processors, listed in section C.
• Brand manufacturers, only for warranty registration or warranty claims on your appliance (name, phone, address, model, serial, fault, and photos of the replaced part) [only if the Business is a brand-authorised service centre].
• Our accountant / tax authorities (invoices), payment gateway (payments), courts or authorities when required by law.

B4. Your rights

You may ask us to: access a summary of your data and of whom it was shared with, correct, complete or update it, erase it (except what the law requires us to keep, such as GST invoices), withdraw consent, nominate someone to act for you if you die or become unable to act, and raise a grievance. Customers can ask for a copy or deletion in the customer portal (My [Business] home page → Your personal data) or at our office. Contact our Grievance Officer: [name, email, phone]. We reply within 30 days, and never later than 90 days (DPDP Rules, Rule 14(3)). You must first use our grievance process; if you are not satisfied, you may complain to the Data Protection Board of India through its online platform [CONFIRM: Board's complaint URL]. How we handle requests: data-principal-rights-procedure.md.

B5. Withdrawing consent and stopping messages

You can withdraw consent as easily as you gave it: reply STOP to our WhatsApp messages, or tell our office. After STOP we send you no WhatsApp messages except one-time codes you need for a visit; messages about your open jobs then come by SMS. Reply START to receive WhatsApp messages again. To stop AMC renewal reminders and offers on every channel, tell our office [product: a STOP today stops WhatsApp only; see REVIEW-2026-10 item P3]. Withdrawal does not affect processing done before it, or data we must keep by law. SMS messages use templates registered on the DLT platform under TRAI rules; promotional SMS is sent only with your consent.

C. Sub-processors (both parts)

D. Where your data is stored (transfers outside India)

Upkiva's servers are in Germany (Hetzner), and our media files and encrypted backups are kept with Cloudflare R2; some sub-processors in section C work globally. Indian law (DPDP Act s.16) allows personal data to be transferred outside India except to a country or territory that the Government of India restricts by notification. As of October 2026 no country has been restricted. We will stop or move any transfer if Germany or another country we use is restricted, and we will follow any requirement the Government sets under DPDP Rule 15. Stricter sector rules continue to apply (s.16(2)): for example, payment-card data is handled only by our Indian payment gateway under RBI rules, and we do not store it.

E. Security

Encryption in transit (TLS) and of backups; passwords and one-time codes stored as one-way hashes; ID-document numbers stored encrypted; role-based access (technicians never see other customers or real customer phone numbers); audit logs of approvals, overrides, discounts, refunds, data exports and erasures; time-limited signed links for photos and call recordings; daily encrypted backups; server logs kept 180 days to investigate incidents; staff access to production limited and logged.

F. Personal data breaches

If a breach affects your data, the data fiduciary (the Business, or Upkiva for Part A data) will tell you without delay: what happened, when, the likely consequences, what is being done, what you can do to protect yourself, and who to contact. It will also inform the Data Protection Board without delay and send a detailed report within 72 hours (DPDP Rules, Rule 7). Upkiva reports cyber incidents to CERT-In within 6 hours of noticing them, and as processor informs the affected Business within 6 hours (initial notice) and with full details within 24 hours.

G. Children

Upkiva is not meant for children. Customer accounts belong to adults (the person booking the service). Technicians and staff must be at least 18. We do not knowingly process a child's data without verifiable consent of a parent or lawful guardian (DPDP s.9; Rule 10). If we learn that we hold such data, we delete it. We do not track, monitor the behaviour of, or target advertising at children. Technicians are told to photograph only the appliance and the work area, not people.

H. Changes

We will post changes here with a new effective date and version, and tell Businesses at least 30 days before a material change. When the technician notice changes, the app asks technicians to read and accept it again.

I. Contact

Upkiva · [legal entity name, CIN, registered address] [CONFIRM] Contact for data protection questions (DPDP s.8(9); Upkiva is not a Significant Data Fiduciary, so a formal Data Protection Officer is not required): [name, email, phone] [CONFIRM]. Grievance Officer: [name, email, phone] [CONFIRM] (may be the same person).