Privacy Policy

01 Who we are

IVS (“the app”, “we”, “us”) is operated by [Registered company name], a company incorporated in India with its registered office at [Registered address].

For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described in this policy. This policy explains what we collect, why, who we share it with, and the choices you have.

02 Summary

The short version, before the detail:

We do not sell your personal data. We do not use it for advertising or share it with advertising networks.

03 Data we collect

You give us

• Account: mobile number and country code.
• KYC — individuals: full name, contact number, email address, PAN, and Aadhaar number for OTP verification.
• KYC — businesses: company name, contact number, email address, PAN, GST number, and a photograph of the owner.
• Device checks: the IMEI number(s) of a device, its model, and optionally the name of the customer the device relates to.
• Profile photo, where you choose to upload one.

Generated as you use the app

• Verification results returned by the national CEIR database.
• Token wallet balance and a transaction ledger of every credit and debit.
• Payment identifiers issued by our payment gateway.
• Your referral code and, if you were referred, who referred you.
• A device identifier for each signed-in session, so sessions can be revoked.

Collected automatically

• IP address, request timestamps and endpoints accessed, kept in server logs for security, abuse prevention and debugging.

04 Aadhaar and identity verification

Where Aadhaar verification is required, we use the OTP-based e-KYC service operated by the Unique Identification Authority of India (UIDAI), accessed through a UIDAI-authorised verification partner. You enter your Aadhaar number, UIDAI sends a one-time password to your registered mobile number, and you enter that OTP to confirm the number belongs to you.

Aadhaar verification is used only to establish identity for the services you request. We do not use it for any other purpose, and we do not share Aadhaar data with any third party other than the authorised verification partner performing the check.

Where the app is used to verify the identity of a customer selling a device to you, that customer's Aadhaar is verified in the same way, again without the full number being retained. You are responsible for obtaining that person's consent before initiating such a check.

05 Device and IMEI verification

The core function of the app is to check whether a mobile device has been reported lost, stolen or blocked. To do this we send the IMEI number you enter to the Central Equipment Identity Register (CEIR) operated by the Department of Telecommunications, Government of India, and return the status it reports.

We keep a record of each check — the IMEI numbers, device model, the result returned, the time of the check, and any customer name you chose to enter. This record exists so that you can review your own verification history, and so that we can resolve billing disputes and meet our obligations if a check is later questioned.

06 Payments and the token wallet

Paid features are charged in tokens, which you buy through our payment gateway. When you make a payment we receive and store the gateway's order and payment identifiers, the amount, and the resulting token credit — never your card, UPI or bank details, which are handled entirely by the gateway under its own privacy policy.

We maintain a ledger of every token credit and debit on your account. Where a verification cannot be completed, the tokens charged are refunded automatically and both entries appear in that ledger.

07 Why we use your data

We process your personal data on the following bases:

• To provide the service you asked for — creating your account, signing you in, running verifications, and maintaining your wallet.
• With your consent — Aadhaar-based identity verification, which you initiate and confirm by entering an OTP.
• To meet legal obligations — retaining KYC and transaction records where Indian law requires it.
• For our legitimate interests — preventing fraud and abuse, securing the service, and diagnosing faults.

08 Who we share data with

We share only what each provider needs to perform its function, and only for that purpose. We do not sell personal data.

We may also disclose data where we are required to by law, by a court, or by a government authority acting within its powers.

09 Where data is stored, and for how long

Your data is stored on cloud infrastructure located in India. Some providers named above may process limited data outside India under their own contractual safeguards.

• Account and KYC records — kept while your account is active, and afterwards only for as long as law requires us to retain them.
• Verification history and wallet ledger — retained as financial and audit records.
• One-time passwords — stored only as a hash, and deleted automatically minutes after issue.
• Sessions — revoked when you sign out and expire automatically.
• Server logs — retained for a limited period for security and debugging.

10 How we protect your data

• All traffic between the app and our servers is encrypted in transit.
• One-time passwords and Aadhaar identifiers are stored only as irreversible hashes, never in readable form.
• Access to production systems is restricted to authorised personnel.
• Sessions use short-lived access tokens with revocable refresh tokens tied to your device.
• Rate limiting and audit logging guard against abuse of verification and login endpoints.

No system can be guaranteed completely secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as required by law.

11 Your rights

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Ask what personal data we hold about you and how it is processed.
• Have inaccurate or incomplete data corrected or updated.
• Request erasure of your data, subject to records we must retain by law.
• Withdraw consent you previously gave, including for Aadhaar verification. Withdrawing consent may mean we can no longer offer parts of the service.
• Nominate another person to exercise these rights on your behalf if you are unable to.
• Raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied with our response.

To exercise any of these rights, contact us using the details in §15.

12 Deleting your account and data

You can delete your account at any time from within the app, under Profile → Settings → Delete Account. If you cannot sign in, email [support@yourdomain] from the address registered on your account, or write to us at the address in §15, and we will verify your identity and act within [30] days.

Deletion removes your name, contact number, email address, profile photograph and your PAN, GST and company details straight away, and signs you out on every device. Your KYC status is cleared, so you would need to submit KYC again before using paid features.

We keep your mobile number, so that signing in again with it restores the same account together with your token balance and verification history. We also keep your Aadhaar verification status so it need not be repeated, and the payment, wallet and verification records described in §9, which we are required to retain for tax, accounting and audit purposes.

If you would prefer complete erasure, with nothing kept beyond what the law obliges us to retain, say so when you write to us and we will process your request on that basis instead.

13 Children

The app is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

14 Changes to this policy

We may update this policy as the service changes or the law requires. The “last updated” date at the top shows when it last changed. Where a change materially affects how we use your data, we will tell you in the app or by message before it takes effect.

15 Contact us

For any question about this policy, or to exercise your rights, contact our Grievance Officer, appointed under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000: