Privacy Policy

This policy applies to personal data we process about the dealers, distributors, repair shops and their staff who hold accounts with us (our “Customers”), and to the limited personal data our Customers enter into the Service about their own end-customers.

For account holders and Service users, we act as a Data Fiduciary (controller) under the DPDP Act. For the records a Customer uploads about that Customer's own end-customers (for example, a buyer's name or KYC reference attached to a transaction), the Customer is the Data Fiduciary and we act as a Data Processor on the Customer's documented instructions.

Account and contact data: your name, business name, email address, mobile number, role and login credentials.

Business and KYC data: GSTIN, business address, and identity or address references you provide to verify your business for onboarding and statutory compliance.

Device and transaction records: IMEI numbers, device grade, purchase and sale entries, invoices, and counterparty details that you enter so the Service can function for your shop.

Payment data: billing contact and subscription records. Card and bank credentials are handled by our payment processor and are not stored on our servers.

Usage and technical data: log data, device/browser information, IP address and cookies (see the Cookies section).

We collect personal data of children only where strictly necessary and, where the DPDP Act requires, after verifiable parental consent. The Service is intended for business use and is not directed at children.

To provide, operate and support the Service, including running IMEI and device checks you request.

To process subscriptions, billing and trials, and to send service and transactional communications.

To secure the platform, prevent fraud and abuse, and maintain audit trails.

To meet legal, regulatory and statutory obligations, and to respond to lawful requests from law-enforcement or government authorities.

To improve the Service using aggregated or de-identified data. We do not sell your personal data, and we do not use it for advertising profiling.

We process personal data on the basis of your consent and, where applicable, the “certain legitimate uses” permitted under the DPDP Act (such as compliance with law or a function under law).

Where we rely on consent, we ask for it through a clear notice and you may withdraw it at any time; withdrawal does not affect processing already carried out and may limit features that depend on that data.

We share personal data with vetted service providers (Data Processors) who host, support, and operate the Service under contractual confidentiality and security obligations, and with payment partners to process subscriptions.

We use Sentry, an error-monitoring service, as a service provider (Data Processor). When our website and dealer app or our operator console hits an error, an error report — and, for some page loads, page-performance timings — is sent to Sentry. We set these reports up so that they carry no user identity, cookies, request headers, request bodies or query strings, and we mask long numbers (such as mobile numbers and IMEIs) and email addresses. Sentry may add an approximate location (city and country) that it works out from the network address a report comes from; the address itself is not stored with the report. Sentry stores these reports on its servers in the United States (see section 6).

We may disclose personal data to courts, regulators or law-enforcement where required by law, or to protect rights, safety and the integrity of the Service. We do not sell personal data to third parties.

We aim to host and process personal data within India. Where any processing or sub-processor is located outside India, we will do so only in a manner permitted under the DPDP Act and any restrictions notified by the Central Government, with appropriate safeguards in place.

Error reports sent to Sentry are stored on Sentry's servers in the United States; section 5 describes what those reports leave out or mask.

We keep statutory records — for example, invoice and GST records — for as long as the law requires. Under section 36 of the Central Goods and Services Tax Act, 2017, that is 72 months from the due date of the annual return for the year the records relate to (about eight years) or, where an appeal, other proceeding or investigation concerning them is pending, one year after it is finally decided, whichever is later. Security logs of our systems are kept for a rolling period of 180 days, as the CERT-In directions of 28 April 2022 require, and, once the relevant provisions of the Digital Personal Data Protection Rules, 2025 come into force, personal data, traffic data and logs of processing are kept for at least one year from the date of processing, as those Rules require. All other personal data is erased or anonymised when the purpose for which it was collected ends.

When personal data is no longer required, we delete, anonymise or de-identify it, subject to legal holds.

We apply reasonable technical and organisational safeguards, including encryption in transit, role-based access control, tenant isolation, and audit logging, to protect personal data against unauthorised access, alteration, disclosure or loss.

If a personal data breach occurs, we will take remedial steps and notify the Data Protection Board and affected Data Principals as required by the DPDP Act.

Subject to legal limits, you may request access to a summary of your personal data, correction or updating of inaccurate data, completion of incomplete data, and erasure of personal data that is no longer needed.

You may withdraw consent, nominate another individual to exercise your rights in the event of death or incapacity, and use our grievance-redressal process described below.

To exercise any right, contact us using the details in the Grievance and contact section. We may need to verify your identity before acting on a request.

We use only strictly necessary cookies. We do not use analytics or advertising cookies. A visitor who is not signed in receives no cookies, and nothing is saved in the browser's local or session storage.

When you sign in, we set three strictly necessary cookies. All three are httpOnly (page scripts cannot read them) and SameSite=Lax: safeguard_session — your current sign-in, 30 minutes; safeguard_refresh — renews your sign-in, 30 days, sent only to our sign-in service; sg_session — holds no personal data and only tells our pages that you may still be signed in, 30 days. Signing out deletes them.

A few other cookies are set only when you use a feature that needs them: NEXT_LOCALE remembers the language you choose (1 year); sg_store remembers which of your shops you selected (1 year); and short-lived sign-in cookies (safeguard_pending, sg_pending, safeguard_stepup) last up to 15 minutes while you finish signing up or confirm your identity again before a sensitive action.

Error reports and page-performance timings sent to Sentry (see section 5) do not set any cookie. You can delete cookies through your browser settings, but deleting the sign-in cookies will sign you out.

We may update this policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice where required.