Privacy Policy

PakkaProof (pakkaproof.in) is operated by [Registered company name], [registered address] (“PakkaProof”, “we”). This policy is published under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it.

• For account, billing and website data, PakkaProof is the Data Fiduciary: we decide why and how that data is processed.
• For evidence videos and buyer responses, the business that records them (our customer, the “Seller”) is the Data Fiduciary. PakkaProof acts as their Data Processor and processes that data only on the Seller's instructions and under our Terms of Service.

• Account data: name, email address, mobile number, business name, GSTIN and team members you invite.
• Billing data: plan, invoices and payment status. Card, UPI and bank details are collected and held by Razorpay; PakkaProof never receives them.
• Evidence data: packing or handover videos (which may show people, addresses or labels), their SHA-256 fingerprint, timestamps, seal serial numbers, order and AWB numbers, and the device clock time.
• Counterparty data: when a buyer or tenant opens a verification link, their response (accept or reject), any reason they give, IP address, browser user agent and the time of response.
• Technical data: security logs and an immutable audit log of actions taken in the service. We use only cookies strictly necessary for sign-in; no advertising or cross-site tracking cookies.

• To provide the service: record, seal, store and share evidence.
• To support resolution of e-commerce, rental and credit disputes.
• To bill you and keep accounting records.
• To keep the service secure, detect tampering and prevent fraud.
• To comply with Indian law, including lawful requests from authorities.

We process personal data on the basis of consent, or where the DPDP Act permits processing for a legitimate use. Where we rely on consent you may withdraw it at any time by writing to us; withdrawal does not affect processing already carried out.

Sellers decide what is recorded. A Seller using PakkaProof must have a lawful basis for recording, tell their staff and counterparties that videos are recorded and why, avoid capturing more personal data than needed (for example, faces), and handle requests from the people in their videos. We will help Sellers respond to such requests.

We share personal data only with the processors needed to run the service:

• Supabase: database and authentication.
• Cloudflare R2: encrypted, write-once video storage.
• Razorpay: payment processing and subscriptions.

Verification links are shared by the Seller, for example over WhatsApp; the Seller chooses the recipient. We may disclose data where required by law or a court order. These providers may process data outside India; we transfer data only to countries not restricted by the Government of India under the DPDP Act.

• Evidence videos: 90 days (Starter), 12 months (Growth) or 24 months (Pro) from sealing. During this period videos are locked and cannot be deleted or altered by anyone, including PakkaProof, because their value as evidence depends on it. They are deleted at the end of the period.
• Fingerprints, timestamps and audit logs: for as long as the related evidence may be needed in a dispute, and at most [N] years.
• Account and billing data: while your account is active, then as required by tax and accounting law.

Under the DPDP Act you may ask us to:

• give you a summary of the personal data we process about you and who we shared it with;
• correct, complete or update inaccurate data;
• erase data no longer needed for the purpose it was collected for;
• resolve a grievance about how we handle your data; and
• record a nominee to exercise your rights in the event of death or incapacity.

Evidence that is still within its retention lock cannot be erased early, because keeping it unaltered is the purpose it was collected for. If your data is in a Seller's evidence, we will pass your request to that Seller and help them respond.

Write to privacy@pakkaproof.in. We will respond within the time required by law.

Evidence is fingerprinted with SHA-256 on the recording device and stored in write-once storage; every account's data is isolated at the database level. See our security overview. If a personal data breach occurs we will inform affected users and the Data Protection Board of India as required by the DPDP Act, and report cyber security incidents to CERT-In within 6 hours as required by its directions.

PakkaProof is a business service and is not meant for anyone under 18. We do not knowingly process children's personal data for our own purposes.

[Name], Grievance Officer
[Registered company name], [registered address]
grievance@pakkaproof.in

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We will post changes here and update the date above. For material changes we will notify account holders by email before they take effect.