India DPDP Act 2023 Compliant • Privacy Notice

Privacy Policy & Data Protection Notice

BoleVyapar is architected from day one on radical privacy preservation and data minimization. We do not track you across the web, we do not require your personal identity to help you review, and all customer experience inputs are permanently purged within 48 hours.

Governing Law: India Digital Personal Data Protection Act, 2023•Effective Date: October 2026•48-Hour Automated Purge•Zero Ad Tracking
SECTION 01

1. Alignment with India’s DPDP Act, 2023

BoleVyapar processes personal data strictly as a Data Fiduciary in full alignment with the provisions of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000, and corresponding statutory rules.

Our operations honor the foundational DPDP principles:

Data Minimization (Sec. 4)We process only the absolute minimum information necessary to assist with drafting a customer review.
Storage Limitation (Sec. 8(7))Data is retained only as long as strictly necessary. Customer experience inputs are permanently purged within 48 hours.
Purpose Limitation (Sec. 6)Customer details are never monetized, never shared with advertisers, and never repurposed for profiling.
Transparent Notice (Sec. 5)Every mobile customer journey displays clear, bilingual disclosures before text generation occurs.
SECTION 02

2. Zero Direct Identifiers Mandate

No Customer Registration or Identity Collection

Walk-in shoppers who scan our physical standees are never asked to log in, register an account, or disclose direct identifiers. We do NOT collect customer names, phone numbers, email addresses, WhatsApp numbers, gender, age, Aadhaar, PAN, or physical home addresses.

Our public customer session is purely ephemeral and token-based. An opaque, randomized session identifier is generated solely to correlate the customer’s prompt selections with their generated draft and prevent robotic replay attacks.

SECTION 03

3. The 48-Hour Automated Ephemeral Data Purge

Under Section 8(7) of the DPDP Act 2023, personal data must be erased once the purpose for which it was collected has been fulfilled. BoleVyapar enforces this through an automated deletion protocol:

Customer Notes & Drafts Scrubbed at 48 HoursCustomer-typed experience notes, selected chips, and generated AI drafts are automatically, permanently deleted from our live databases within 48 hours.
Minimized Anonymous Telemetry RetainedOnly high-level anonymous counters (such as aggregated QR scan counts, draft generation counts, and copy clicks) are maintained to provide weekly performance digests to store owners. These metrics contain zero customer identity.
Immutable Regulatory Audit RecordsEvery automated purge cycle writes an immutable audit record documenting timestamp, records purged, and cryptographic confirmation to maintain verifiable proof of compliance for statutory oversight.
SECTION 04

4. Information We Process & Purposes

A. In-Store Walk-In Customers (Ephemeral Flow)

  • Customer Input: Keywords/chips tapped (e.g., “Diamond ring”, “Staff hospitality”) and any short optional note typed.
  • Language Selection: Selected articulation dialect (Hindi, Hinglish, or English).
  • Interaction Events: Transient action timestamps (scan, generate, copy, navigate to Google).
  • Purpose: Strictly to compose a natural first-person draft and navigate the user to their destination. Purged at 48 hours.

B. Provisioned Local Businesses (Merchants)

  • Store Profile: Business trade name, physical branch address, commercial vertical, and official Google Maps review URL.
  • Administrative Contact: Owner/manager mobile contact number provided for dispatch logistics and weekly WhatsApp performance digests.
  • Standee Validity Period: Authorized campaign duration (e.g. 1 month, 3 months, 6 months, 1 year, lifetime).
  • Purpose: Standee manufacturing, courier delivery, QR campaign resolution, and automated performance reporting.
SECTION 05

5. Rights of Data Principals (Under DPDP Act)

Every Indian citizen and resident whose data is processed by BoleVyapar is recognized as a Data Principal and possesses the following statutory rights:

  • Right to Summary of Processing (Sec. 11): Right to know what data has been processed and third-party identities with whom data has been shared (we share with none).
  • Right to Erasure & Correction (Sec. 12): Right to request immediate deletion of personal data. Although customer notes are automatically erased at 48 hours, you may request instant manual erasure at any time.
  • Right of Grievance Redressal (Sec. 13): Right to have grievances addressed by our designated Grievance Officer within established regulatory timelines.
  • Right to Nominate (Sec. 14): Right to nominate an individual to exercise rights in the event of death or incapacity.
SECTION 06

6. Anti-Abuse Safeguards & Privacy-Preserving Telemetry

To protect local businesses against robotic scraping, DDoS attacks, and synthetic metric inflation without violating consumer privacy:

  • 5-Second Scan De-Duplication: Rapid double-taps or accidental page reloads from the same device within 5 seconds are collapsed into a single event, preventing scan count distortion.
  • No Invasive Fingerprinting: We do not capture device serial numbers, battery levels, installed fonts, or canvas fingerprints.
  • No Third-Party Ad Trackers: Our pages carry zero Meta Pixel, TikTok, or programmatic ad network tracking cookies.
  • Zero Password Invariant: In-store customers do not create credentials; there are no passwords or security tokens to be compromised.
SECTION 07

7. Third-Party Navigation & Google Maps Boundary

BoleVyapar operates as an in-store articulation assistant. Once a customer copies their draft and chooses to click “Continue to Google Reviews”, they are redirected out of BoleVyapar to the official Google Maps listing of the merchant.

Third-Party Privacy Boundary: When navigating to Google, Google’s independent Privacy Policy and Terms of Service govern your Google account login, review publication, and public profile visibility. BoleVyapar has zero access to your Google account, credentials, or review publication status.

SECTION 08

8. Data Protection & Grievance Redressal Officer

In compliance with Section 8(9) of the Digital Personal Data Protection Act, 2023, BoleVyapar has appointed a dedicated Grievance Redressal Officer to address inquiries and privacy concerns:

DPDP Grievance Redressal Cell
Designation: Data Protection & Grievance Redressal Officer
Email: contact@bolevyapar.in
WhatsApp Concierge: +91 8200177315
Physical Jurisdiction: Gujarat, India
Statutory Acknowledgment Window: Within 24 hours
Resolution SLA: Within 48 business hours