Privacy Policy

1. Statutory Compliance Framework

This Privacy Policy is published in strict compliance with:

• The Digital Personal Data Protection Act (DPDPA), 2023 (Act No. 22 of 2023) enacted by the Parliament of India.
• Section 43A of the Information Technology Act, 2000.
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules).
• The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

2. Data Collection & Processing

We believe in radical data minimization:

• For Households: We do NOT collect names, phone numbers, home addresses, or Aadhaar details. The household app computes proximity client-side on your device against moving vendor coordinates. Your real location is never uploaded to any centralized profile.
• For Street Vendors: When a vendor explicitly taps "GO LIVE", temporary geographic coordinates (latitude and longitude) and produce categories (e.g., Vegetables, Fruits) are transmitted to nearby devices within a 500-meter radius. Broadcasting ceases immediately when the vendor taps "STOP LIVE" or closes the app.
• For Kirana Stores, Retail Shops, Cafes & Food Outlets (Kirana Shop POS Application): Store name, private Shop Code, Owner PIN, inventory items, and sales transaction logs are stored locally on your mobile device and encrypted in Google Firebase Cloud Database for multi-phone live synchronization. Customer names and phone numbers voluntarily entered by store owners for Udhar Khata credit ledger tracking and WhatsApp digital receipt sharing are processed strictly for receipt generation and customer statements, and are never sold, rented, or shared with third-party advertisers.
• For Advertisers / Local Businesses: Business name, shop contact phone number, address, GSTIN (if applicable), and ad campaign parameters are stored solely for invoice generation and targeted neighborhood delivery.

3. Purpose of Processing (Lawful Basis under DPDPA)

Data processing is conducted strictly for specified lawful purposes:

1. Facilitating hyperlocal proximity alerts between mobile street pushcarts and local residents.
2. Enabling residents to transmit one-time "Call Cart" requests to a vendor on their immediate street without revealing personal identities.
3. Delivering verified hyperlocal commercial announcements from registered neighborhood stores.
4. Fulfilling legal obligations under statutory directives issued by Government authorities or law enforcement under applicable Indian laws.

4. Prohibition of Sale or Unauthorized Sharing

PushCartSiren strictly does NOT sell, rent, trade, or monetize any personal data or geolocation telemetry to third-party data brokers, marketing networks, or profiling agencies.

5. Rights of Data Principals under DPDPA 2023

In accordance with Section 11, 12, and 13 of the Digital Personal Data Protection Act, 2023, you enjoy the following rights:

• Right to Access Information: Request a summary of personal data processed by us.
• Right to Correction & Erasure: Request the rectification of inaccurate data or deletion of account records via our Account & Data Deletion Portal →
• Right of Grievance Redressal: Submit grievances directly to our designated Grievance Officer.
• Right to Nominate: Nominate an individual to exercise data rights in the event of incapacity.

6. Security Practices, Cryptographic Storage & Authentication

We maintain comprehensive technical, physical, and administrative safeguards compliant with ISO/IEC 27001 standards and Rule 8 of the SPDI Rules 2011:

• Transport Security: 256-bit TLS (HTTPS) across all network communications with Android Network Security Config pin enforcement.
• Cryptographic Authentication: Store Owner PINs are protected using PBKDF2-HMAC-SHA256 with 15,000 key-stretching iterations, 256-bit derived key length, and unique cryptographically random per-device salts, preventing rainbow table and brute-force guessing attacks.
• Tenant Isolation: POS queries and cloud synchronization are strictly partitioned by cryptographically authenticated Shop Codes.

7. Statutory Data Retention & Financial Records (CGST Act Sec 36)

In accordance with Indian statutory requirements:

• GST & Financial Invoices: In compliance with Section 36 of the Central Goods and Services Tax (CGST) Act, 2017, commercial advertising invoices, sales credit logs, and books of accounts are retained for 72 months (6 years) from the due date of furnishing the annual return. These statutory financial records are logically segregated into an immutable cold compliance archive.
• Cybersecurity Access Logs: Retained for 180 days in compliance with CERT-In directives.
• Ephemeral Geolocation Telemetry: Pushcart vendor live coordinates are held in volatile RAM during active live sessions and purged immediately upon tapping "STOP LIVE" or after 30 minutes of inactivity.
• Rolling Backups: Automated daily encrypted database snapshots rotate on a 30-day lifecycle expiration schedule.

8. Data Residency & Infrastructure Boundaries

Primary application databases, secure cloud backups, and transaction logs reside strictly within certified India data centers (AWS Mumbai ap-south-1 and Google Cloud India). Transient voice parsing utilizes on-device NLP processing and temporary cloud inference without persistent storage or foundation model training, in full compliance with Section 16 of the DPDP Act 2023.