Privacy Policy

1. Data Fiduciary

Under the Digital Personal Data Protection Act, 2023, Elvarex Private Limited is the Data Fiduciary responsible for determining the purpose and means of processing your personal data. Our registered address is Door No. SP-7A, AWFIS Primus Building, Guindy Industrial Estate, Chennai, Tamil Nadu, India - 600032.

2. Personal Data We Collect

Data You Provide (Mandatory for Registration)

• Full Name — to identify your account
• Mobile Number — for OTP-based authentication
• Email Address — for account communication
• Address — for KYC and billing compliance
• Password — stored as a one-way cryptographic hash; we never store plaintext passwords

Sensitive Personal Data or Information (SPDI) under IT Rules 2011

• Password (hashed)
• Financial information provided during payment (processed by RBI-authorised gateways; we do not store card numbers, CVV or UPI PINs)

Data Collected Automatically

• Device information: model, operating system, device identifiers (GAID/IDFA)
• Usage data: videos viewed, duration, interactions, search queries
• Network information: IP address, carrier, connection type
• App performance data: crash reports, error logs
• Location: approximate location derived from IP address (not precise GPS)

Data from Third Parties

• Authentication data from Google Firebase (if you use phone or email sign-in)
• Payment confirmation from our payment gateway partner

3. Purpose and Lawful Basis of Processing

Processing is based on: Consent Contract performance Legal obligation Legitimate interest

4. Consent

Under the DPDP Act, 2023, we collect and process your personal data based on free, specific, informed and unambiguous consent. You provide consent at registration by accepting these Terms and our Privacy Policy.

You may withdraw consent at any time by deleting your account. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

5. Data Sharing and Disclosure

We do not sell your personal data. We may share your data with:

• Payment processors (RBI-authorised) to complete transactions — only transaction-relevant data is shared
• Cloud infrastructure providers — Google Firebase (authentication, database), Qiniu (media storage and CDN) — under data processing agreements
• Analytics providers — for app performance monitoring, under strict confidentiality obligations
• Law enforcement / government authorities — when required by a court order, government direction, or as mandated under the IT Act, 2000, DPDP Act, 2023, or any other applicable Indian law
• Successors in business — in the event of merger, acquisition or restructuring, subject to this Privacy Policy continuing to apply

6. Data Retention

• Account data is retained for as long as your account is active and for 6 months after deletion, as required under IT Rules 2021.
• Transaction records are retained for 7 years as required under the Companies Act, 2013 and Income Tax Act, 1961.
• Content moderation logs are retained for 180 days as per IT Rules 2021.
• You may request deletion of your personal data by emailing admin.elvarex@gmail.com. We will action the request within 30 days subject to legal retention obligations.

7. Data Security

We implement security measures as prescribed under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, including:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest
• Multi-factor authentication (OTP) for user accounts
• Access controls limiting employee access to personal data on a need-to-know basis
• Regular security audits and vulnerability assessments

8. Your Rights as a Data Principal (DPDP Act, 2023)

• Right to Access: Obtain a summary of your personal data processed by us
• Right to Correction: Correct inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data (subject to legal retention obligations)
• Right to Grievance Redressal: File a complaint with our Grievance Officer
• Right to Nominate: Nominate another person to exercise your rights in the event of death or incapacity

To exercise these rights, contact: admin.elvarex@gmail.com

9. Children's Privacy

The Platform is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us personal data, please contact us immediately at admin.elvarex@gmail.com and we will delete such data promptly. We comply fully with the POCSO Act, 2012 — any content sexualising minors will be removed immediately and reported to law enforcement.

10. Cookies and Tracking Technologies

Our website uses essential cookies required for basic functionality (session management, security). We do not use advertising or cross-site tracking cookies without your explicit consent. You may manage cookie preferences in your browser settings.

Our mobile app uses Firebase SDKs for analytics and crash reporting. You may opt out of analytics data collection in the app settings.

11. Grievance Redressal & Contact