Skip to main content
VyaparTrust

Privacy

What we collect, why, how long we keep it, and the rights you have over it.

Last reviewed:

This is a draft under review

Published so members can read it during the pilot, and under review against the Digital Personal Data Protection Act 2023.

What we collect

  • Your name, mobile number and email, so you can sign in and be contacted.
  • Your firm's GSTIN, PAN and registered address, to verify the firm is real.
  • Documents you upload — invoices, dispatch proofs, certificates.
  • A record of what you did on the platform, with times, which is what makes an evidence pack trustworthy.

Aadhaar

We never store an Aadhaar number. Where Aadhaar is used to verify identity, only the last four digits are kept, so a record can be matched without holding the number itself.

Do not upload an Aadhaar card as a document. If a proof you upload shows an Aadhaar number, mask all but the last four digits first — an unmasked upload is refused at review.

Adults only

The service is for adults. The sign-up asks you to confirm that you are 18 or over, and the identity checks (PAN or offline Aadhaar) confirm it. We do not knowingly hold a child's data.

Why we hold it

To verify that firms are real, to let members check each other before giving credit, to keep a dated record of claims and replies, and to meet our own legal obligations. We do not sell your data and we do not use it for advertising.

Where it is stored

Your data is stored in India, in the AWS Mumbai region (ap-south-1).

Cloudflare sits in front of the site and the API. To do that it may process connection data — your IP address and the URL you asked for — at its edge locations, some of which are outside India. The content of your records does not leave Mumbai.

When it is switched on, we count page visits with Cloudflare Web Analytics. The count is sent to Cloudflare (cloudflareinsights.com). Cloudflare says it 'does not use any client-side state, such as cookies or localStorage, to collect usage metrics' and does not 'fingerprint' individuals via their IP address, User Agent string, or any other data. The count records which page was visited and how quickly it loaded; Cloudflare says it does not record the part of a web address after '?', and that it keeps the detailed data for 7 days before summarising it. It is never used on the page where our legal advisers answer our questions.

Who else sees it

  • Other members see only what the platform is designed to show — a verification result, or a claim to which they are a party. Your documents are not published.
  • Service providers who verify records or deliver messages on our behalf, and only the minimum needed to do that. They are named in the next section.
  • A court, regulator or authority where the law requires it.

The providers we use, and what each receives

  • MSG91 — your mobile number and the text of the SMS, to deliver one-time passwords and notices.
  • Meta (WhatsApp Business) — your mobile number and the message text, only if you opt in to WhatsApp notices.
  • Razorpay — your name, mobile number, email and the amount, only when you pay a fee.
  • Cloudflare and Amazon Web Services — all data, as the hosting and network providers described above.
  • Our credit bureau partner — your PAN, name and mobile number, only when you ask for your own credit report.

How long we keep it

An account that is never completed is archived after 90 days. Records connected to a claim are kept while the claim is open and for as long afterwards as the law requires, because an evidence pack is only useful if it still exists when it is needed.

The main periods: sign-in sessions 180 days; documents and claims 3 years; a credit bureau band 3 years; device identifiers 3 years; access logs 1 year; billing and payment records 8 years. The full retention schedule is published on request.

Your rights

Under the Digital Personal Data Protection Act 2023 you may ask us for a copy of your data, ask us to correct it, ask us to erase it where we are not required to keep it, and withdraw consent you gave earlier.

To withdraw a consent that is not required for the service — such as WhatsApp notices or the bureau report — or to ask for a correction or an erasure, write to the grievance officer named on the Contact page. We answer within 30 days.

One limit, stated plainly: the platform's audit record is append-only. An erasure is carried out by pseudonymising your identifiers in it, never by deleting records that other members rely on.

Grievance officer
Named in the Contact page
Email
grievance@vyapartrust.com
We acknowledge a grievance within
24 hours
We resolve a grievance within
15 days
A rights request is answered within
30 days
Who runs this service
VyaparTrust, a sole proprietorship of Babita Fauzdar

If there is a breach

If a personal data breach affects you, we notify the Data Protection Board of India and you, as the Digital Personal Data Protection Act 2023 requires, and we report the incident to CERT-In within six hours of becoming aware of it.

How it is protected

Data is encrypted in transit and at rest. The database is not reachable from the internet. Access is limited to what a job requires, and every change to a record is logged in a tamper-evident audit trail.

Grievance officer

If the grievance officer’s details do not appear here, write to grievance@vyapartrust.com and we will answer within the time the privacy notice promises.

Acknowledged within 24 hours; resolved within 15 days.

Back to top