2. Information We Collect

2.1 Information You Provide Directly

• Account & Identity Data: Full name, email address, phone number, date of birth, gender, and profile photo.
• Business & Verification Data (Providers/Suppliers): Business name, address, GST/tax registration details, government-issued IDs for KYC (e.g., PAN, Aadhaar where legally permitted), trade licenses, and bank account details for payouts.
• User-Generated Content (UGC): Reviews, ratings, service/product listings, images, videos (including reels), and in-app chat messages. (Note: Content posted in public areas like reviews or reels is visible to all users. Please refrain from sharing sensitive personal data in these spaces.)
• Support Data: Communications with our customer support team or Grievance Officer.

2.2 Information Collected Automatically (with permissions)

• Location Data: Precise GPS location (if consent is granted) to match you with nearby suppliers, providers, and deliveries. If disabled, we rely on approximate location derived from your IP address.
• Device & Hardware Data: Device model, OS, unique device identifiers (IMEI/MAC), and mobile network. We also request access to your Camera, Microphone, and Photo Gallery specifically to enable you to upload listings, reels, or profile photos.
• Usage & Telemetry Data: Search queries, transaction history, interaction with UI elements, session duration, and crash logs.

2.3 Information from Third Parties

• Single Sign-On (SSO): If you authenticate via Google or Apple, we receive basic profile data (name, email) subject to your authorization with them.
• Authentication Providers: Firebase (Google) processes your phone number and OTP for login security.

3. How We Use Your Information

We process your data strictly for legitimate purposes, including to:

• Provide the Service: Create accounts, verify the identity of providers/suppliers, and process bookings, orders, and payments.
• Platform Matching & Personalization: Use algorithmic matching to connect customers with relevant providers based on location, ratings, search history, and availability.
• Communications: Enable in-app messaging between transacting parties and send operational updates (OTPs, order tracking, security alerts).
• Safety & Fraud Prevention: Detect malicious activity, verify reviews, prevent fake accounts, and enforce our Terms and Conditions.
• Legal Compliance: Fulfill tax, accounting, and regulatory obligations, including mandatory reporting to law enforcement agencies.

4. How We Share Your Information

We do not sell your personal data. Data is shared on a strict need-to-know basis:

• Between Users: When a booking or order is confirmed, we share necessary details (name, phone number, delivery address) between the customer and the respective provider/supplier to fulfill the transaction.
• Payment Aggregators: Transaction details are shared with RBI-authorized payment gateways. kartsquare does not capture or store full credit/debit card numbers or UPI PINs.
• Service Providers: Cloud hosting (e.g., AWS/GCP), SMS/Email delivery partners, and analytics providers act as Data Processors under strict confidentiality agreements.
• Law Enforcement & Regulators: We will disclose data if required by a valid legal order, court warrant, or directive from agencies like CERT-In, or to protect the safety of users and the public.
• Business Reorganization: In the event of a merger, acquisition, or bankruptcy, your data may be transferred to the new entity under the same privacy commitments.

5. Data Retention

We retain data only as long as necessary or as legally mandated:

• Account Data: Retained while active. Upon deletion, data is removed within 30 days, except where retention is legally required.
• Financial & Tax Records: Retained for up to 8 years under the Companies Act and GST regulations.
• Security Logs: IP logs, login instances, and critical security telemetry are retained for 180 days on a rolling basis as per CERT-In directives.
• Dispute Retention: If there is an active legal dispute, fraud investigation, or unpaid balance, relevant data is locked and retained until the matter is resolved.

6. Data Security

We implement robust technical and organizational measures (TOMs) as required by law, including TLS encryption in transit, AES-256 encryption for sensitive data at rest, Role-Based Access Control (RBAC), and periodic vulnerability assessments. In the event of a legally notifiable data breach, we will inform you and the Data Protection Board of India without undue delay.

7. Your Rights Under the DPDP Act

As a Data Principal in India, you hold the following rights regarding your personal data:

• Right to Access: Request a summary of the personal data we process and the identities of third parties it has been shared with.
• Right to Correction & Erasure: Correct inaccuracies or request deletion of your data via the Account Deletion page.
• Right to Withdraw Consent: You may revoke consent for non-essential processing (e.g., marketing emails or location access) at any time via your device or app settings. Withdrawal does not affect past processing but may limit platform functionality.
• Right to Grievance Redressal: The right to readily available means of registering complaints. You may reach us at privacy@kartsquare.com.
• Right to Nominate: You may nominate another individual to exercise your privacy rights on your behalf in the event of your death or incapacity. To register a nominee, please email our Support team.

We fulfill valid rights requests free of charge within the legally mandated timeframe (typically 30 days).

8. Children's Privacy

The Platform is restricted to individuals aged 18 and older. We do not knowingly collect personal data from, nor do we target behavioral advertising toward, individuals under 18. If we discover that a minor has provided us with personal data without verifiable parental consent, we will promptly delete the data and terminate the account.

9. Contact Us

• Privacy Inquiries: privacy@kartsquare.com
• General Support: contact@kartsquare.com
• Phone: +91 80056 73985
• Registered Entity: Kartsquare Pvt. Ltd., Plot 63-A, Prakash Nagar, Kalwad Road, Jhotwara, Jaipur, Rajasthan, India - 302012

10. International Data Transfers

kartsquare's primary servers are located in India. If we utilize cloud infrastructure or third-party processors outside India, we ensure that the destination country is not restricted by the Government of India, and that data is protected via binding corporate rules or standard contractual clauses.

11. Policy Updates

We may update this policy to reflect changes in our services or legal obligations. If we make material changes, we will notify you via an in-app banner or email prior to the changes taking effect. Your continued use of the Platform signifies acceptance of the updated policy.