Privacy Policy

Welcome to TrustSaathi ("we," "our," "us," or "the App"). TrustSaathi is owned and operated by TrustSaathi Developer Team (the "Developer"). We are committed to protecting your privacy and ensuring the security of your personal data.

This Privacy Policy explains how we collect, use, share, and protect information for all users of the TrustSaathi mobile application — including residents, visitors, security personnel, society administrators, and referral program participants. It also details the rules governing our Referral Earn Program, Withdrawal of Earned Balances, KYC Verification, and our full legal compliance framework.

---

1. Information We Collect

To provide our visitor verification and community security services, we collect the following categories of information depending on your role:

A. For Residents

• Account Information: Name, phone number, email address, flat/house number, block/building name, and society name.
• Verification Status: Logs confirming your status as an authorized resident of a registered society.
• Interaction Data: Visitor approvals or rejections, pre-invitation codes, and gate communications.
• Referral Data: Your unique referral code, the referral code you used (if any), and the UID of the user who referred you (referredBy field).

B. For Visitors (Guests, Delivery Partners, Daily Help)

• Identity Information: Full name, phone number, and profile photo/selfie (if required by society security rules).
• Visit Information: Society name, flat/house number visited, purpose of visit (e.g., food delivery, guest, maintenance), vehicle registration number (if applicable), and delivery company name (e.g., Zomato, Swiggy, Delhivery, Uber).
• Access Logs: Timestamped entry and exit records at the security gate.

C. For Security Personnel & Society Administrators

• Account Details: Profile picture, name, phone number, login credentials, and assigned role.
• Activity Logs: Actions performed inside the App — visitor logging, OTP verifications, society settings changes.

D. Device & Technical Information (All Users)

• Device Identifiers: Device type, OS version, unique Android ID, IP address, and push notification tokens.
• Usage Logs: Crash logs, performance data, and navigation flow for debugging and optimization.

E. Sensitive Personal Data & Government ID Verification

• Aadhaar Card Verification: When Aadhaar-based identity verification is required (e.g., for residents or domestic staff), your Aadhaar number is submitted to apitxt.com — a licensed third-party KYC API service — for real-time verification. TrustSaathi does not store your Aadhaar card image or full Aadhaar number in its own databases or Firebase Storage. Only the verification result (verified / failed) and masked reference are retained.
• PAN Card Verification: PAN card verification for KYC (referral withdrawal eligibility) is performed via the apitxt.com API. Your PAN number is transmitted securely to apitxt.com for real-time validation. TrustSaathi does not store your PAN card image or full PAN number in Firebase Storage. Only the verification result and PAN number format confirmation are stored in your KYC record.
• Aadhaar Act Compliance: In full compliance with the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 — Aadhaar numbers are never stored in plain text, never indexed in our databases, and are transmitted only to the authorized apitxt.com verification endpoint using encrypted connections.
• Third-Party Privacy: Identity verification data processed by apitxt.com is governed by their own privacy policy. Please review: apitxt.com/privacy-policy.

F. Referral & Earnings Data

• Referral Code: A unique auto-generated alphanumeric code assigned to each registered user to identify referrals.
• Referral Linkage: The UID and referral code of the person who referred you, stored in your user profile upon successful code application.
• Earned Wallet Balance: Running total of referral commission credited to your Earned Wallet balance.
• Referral Events: A log of each referral event including referred user name, join date, status (Awaiting Purchase / Eligible), and reward amount credited.

G. KYC Data (for Withdrawal Eligibility)

• Full Name — must match the name on your PAN Card and Bank Account linked to your UPI ID.
• PAN Card Number — entered in standard format (ABCDE1234F) and verified in real-time via the apitxt.com API. Not stored as an image; only the verification result is retained in your KYC record.
• UPI ID — the payment handle to which approved withdrawals are transferred. Stored in your KYC record in the database.
• KYC Status & Admin Notes — approval/rejection status and reviewer notes stored in Firebase Realtime Database (not in Storage).

H. Worker (Domestic Staff) Data

• Personal Details: Full name, phone number, date of birth, and profile photo.
• PAN Verification: PAN number and name (exactly as on PAN card) and date of birth — submitted to apitxt.com for real-time verification. Not stored as an image.
• Aadhaar OTP Verification: 12-digit Aadhaar number submitted to apitxt.com which triggers an OTP to the Aadhaar-linked mobile number via UIDAI. The 6-digit OTP and a session reference ID are used to confirm Aadhaar identity. Neither the Aadhaar number nor the OTP is stored permanently by TrustSaathi.
• Digital Trust Card: Upon successful PAN + Aadhaar verification, a Digital Trust Card is generated and associated with the worker's profile, indicating verified identity status.
• Employment / Society Links: The societies or flats where the worker is registered as daily help, along with entry/exit timestamps.

I. Home Owner (Saathi Owner) Data

• Profile Information: Full name (as per identity documents), email address, OTP-verified mobile number, alternate phone number (optional), and home address.
• Profile Photo: A photograph uploaded from gallery or captured via camera, stored in Firebase Storage for profile identification.
• Membership: Owner membership plan details (12-month duration), registration fee deduction record from Deposit Wallet (₹199 registration fee), and registration timestamp.
• Consent Record: A log that the user explicitly agreed to TrustSaathi's Privacy Policy and Terms & Conditions at the time of Owner Registration.

---

2. Device Permissions

TrustSaathi requests only the permissions necessary to deliver our services:

• Camera: Used by security guards to photograph visitors at the gate, and by users to capture profile photos or KYC/identity documents.
• Storage / Media Files: To upload identity documents from device gallery and save monthly PDF visitor log backups.
• Notifications: For real-time push alerts to residents when a visitor arrives at the gate, enabling instant approvals.

---

3. How We Use Your Information

• Visitor Management: Verifying visitor identity, notifying residents, and authorizing gate entry.
• Real-time Alerts: Push notifications and gate approval flows.
• Audit Trails: Maintaining digital visitor entry/exit ledgers for residential society security records.
• Security & Authentication: OTP-based phone verification, preventing unauthorized access.
• Referral Program Management: Tracking referral linkages, calculating earned rewards, updating Earned Wallet balances, and displaying referral invite lists.
• KYC Review & Withdrawal Processing: Reviewing submitted PAN/UPI details to approve withdrawal eligibility and process UPI payouts.
• Subscription Management: Tracking active society plans, flat security links, resident memberships, and automated renewals.
• Tax Compliance: Calculating and deducting 10% TDS on withdrawal amounts as required under Indian income tax law.
• Customer Support: Responding to queries and resolving app issues.

---

3B. Worker Verification & Owner Registration

Worker (Domestic Staff) Verification — 2-Step Process

To create a trusted Digital Identity for domestic workers (maids, drivers, cooks, security helpers, delivery agents, etc.), TrustSaathi uses a mandatory 2-step government ID verification powered by apitxt.com:

Upon Successful Verification:

• A Digital Trust Card is generated for the worker, indicating that their PAN and Aadhaar have been government-verified.
• The worker's profile is marked as "Trusted" and visible to society residents and admins who link the worker to their household.
• Verification result (verified ✓ / failed ✗) and masked Aadhaar reference are stored. The full Aadhaar number and PAN image are never retained.
• Worker profiles are linked to the societies and flats where they serve, enabling secure gate entry logging.

Data Handled During Worker Verification:

Data Field	Where Processed	Stored by TrustSaathi?
PAN Number	apitxt.com API	❌ No — only result stored
Name (as on PAN)	apitxt.com API	✅ Stored in worker profile
Date of Birth	apitxt.com API	✅ Stored in worker profile
Aadhaar Number	apitxt.com → UIDAI OTP	❌ No — never stored
OTP (6-digit)	apitxt.com API	❌ No — session only
Verification Result	Firebase Realtime DB	✅ Yes — verified/failed flag

---

Home Owner (Saathi Owner) Registration

Users who want to register as Home Owners (independent residents not part of a full society subscription) can join with an annual membership. The following data is collected and used:

• Full Name — as per identity documents, cross-checked against the user's existing phone-verified profile name.
• Email Address — optional, for communication and account recovery.
• Verified Mobile Number — auto-filled from OTP-verified registration, read-only and non-editable.
• Alternate Mobile Number — optional, for family or emergency contact.
• Home Full Address — stored to identify the owner's residential location and link with gated security systems.
• Profile Photo — captured via camera or uploaded from gallery. Stored in Firebase Storage for identity display to gate security.
• Registration Fee Deduction — ₹199 is deducted from the user's Deposit Wallet at the time of submission. A consent checkbox confirming agreement to Privacy Policy and Terms & Conditions is required before registration is processed.
• Membership Period: 12 months from registration date. Membership records are stored in Firebase Realtime Database.

---

4. Referral Earn Program — Data & Rules

TrustSaathi operates a Refer & Earn program that allows users to earn commissions when their referred friends make qualifying purchases on the platform.

4.1 How the Referral System Works

• Every registered user receives a unique referral code generated via a secure Cloud Function.
• A new user may enter a referral code during or after registration. Once applied, the referral linkage is permanent and cannot be changed.
• Each user can only apply one referral code (one referrer per account). Self-referrals are blocked.
• Referred users appear in the referrer's invite list as "Awaiting Purchase" until they make a qualifying first purchase, after which their status becomes "Eligible" and the reward is credited.

4.2 Reward Structure

All referral commissions are credited to your Earned Wallet automatically upon a qualifying purchase or renewal by your referred user.

Society Subscriptions

Plan	1st Purchase Reward	On Each Renewal
1 Month Plan	₹50	₹25
3 Months Plan	₹150	₹70
6 Months Plan	₹300	₹100

Flat Security Links (Per Flat Linked)

Plan	1st Purchase Reward	On Each Renewal
Per Flat — 1 Month Link	₹15	₹10
Per Flat — 3 Month Link	₹45	₹30
Per Flat — 6 Month Link	₹90	₹60

Resident & Worker Memberships (12 Months)

Plan	1st Purchase Reward	On Each Renewal
Resident Membership (12 Mo)	₹50	₹25
Worker Verification (12 Mo)	₹50	₹25

4.3 Referral Program Rules & Conditions

• Rewards are only credited when the referred user completes a genuine, successful, and non-refunded payment.
• Fraudulent referrals (fake accounts, self-referrals, bulk registrations using automated methods) will result in immediate account termination and forfeiture of all earned rewards.
• Rewards are credited in real time to your Earned Wallet upon successful payment processing of the referred user's purchase.
• Renewal rewards are paid automatically and indefinitely for each active plan renewal of each referred user, as long as both accounts remain active and in good standing.
• TrustSaathi reserves the right to modify, pause, or terminate the Referral Earn Program at any time with reasonable notice.
• Referred users who request refunds will result in the corresponding reward being reversed from the referrer's Earned Wallet.

---

5. Earned Wallet & Withdrawal Policy

5.1 Earned Wallet

• The Earned Wallet holds all referral commissions earned by you through the Refer & Earn program.
• The Earned Wallet is separate from the Deposit Wallet (funded via Razorpay top-ups), which is used only for subscription payments. Deposit Wallet funds cannot be withdrawn to a bank or UPI account.
• Earned Wallet credits are non-transferable between users and cannot be converted to Deposit Wallet balance.

5.2 Withdrawal Eligibility

• You must have a minimum balance of ₹100 in your Earned Wallet to initiate a withdrawal.
• Your KYC must be approved by the TrustSaathi admin team before any withdrawal is processed. Withdrawals are blocked if KYC is pending, not submitted, or rejected.
• Withdrawals are sent exclusively to the verified UPI ID submitted and approved during your KYC process.

5.3 Withdrawal Process

• Navigate to Wallet → Referral Earnings → Withdraw within the app.
• Enter the withdrawal amount (minimum ₹100, maximum equal to your available Earned Wallet balance).
• A 10% TDS (Tax Deducted at Source) is automatically calculated and deducted from the withdrawal amount as mandated by Indian income tax regulations. The net payout you receive will be the requested amount minus the TDS deduction.
• Withdrawal requests are processed by our finance team. Processing time is typically 3–7 business days.
• Upon approval, the payout is sent to your verified UPI ID. The Earned Wallet balance is debited at the time of request, not at the time of payout processing.

5.4 Withdrawal Restrictions

• Withdrawal amounts cannot exceed your current Earned Wallet balance at the time of the request.
• Multiple pending withdrawal requests for the same balance are not permitted.
• Withdrawals may be delayed or blocked if we detect unusual activity, suspected fraud, or a dispute on your account.
• Upon permanent account deletion, any remaining Earned Wallet balance will be forfeited. No refunds or payouts will be issued after account closure is initiated.
• TrustSaathi is not responsible for failed UPI transfers due to an incorrect, inactive, or closed UPI ID provided during KYC.

---

6. KYC Verification Policy

Know Your Customer (KYC) verification is mandatory for unlocking withdrawal of referral earnings. This requirement is enforced to prevent fraud, comply with Indian financial regulations, and ensure payouts reach the correct, verified individuals.

6.1 KYC Requirements

• Full Legal Name — must exactly match the name on your PAN Card and Bank Account linked to your UPI ID.
• PAN Card Number — a valid 10-character Indian Permanent Account Number in the format ABCDE1234F. This is verified in real-time via the apitxt.com KYC API. The PAN number is transmitted securely to apitxt.com for validation — it is not stored as an image or full string in TrustSaathi's databases.
• Aadhaar Verification (where applicable) — if Aadhaar verification is required, the number is submitted to apitxt.com for real-time OTP-based verification. TrustSaathi does not store the Aadhaar number or any Aadhaar document image.
• UPI ID — a valid UPI payment handle (e.g., username@upi) to which withdrawals will be sent.

6.2 KYC Review Process

• KYC submissions are reviewed by the TrustSaathi admin team within 2–5 business days.
• KYC status can be: Not Submitted → Pending Review → Approved or Rejected.
• If rejected, the reason provided by the admin reviewer will be displayed in the app. You may correct your details and resubmit.
• Once approved, your KYC details are locked for editing (except the UPI ID, which can be updated at any time through the app). Any change to UPI ID after approval takes effect immediately for future withdrawals.
• Re-verification (re-submission of KYC) may be required if we detect inconsistencies or if your previous submission was rejected.

6.3 KYC Data Security

• PAN Card and Aadhaar verification is performed via the apitxt.com API over an encrypted (HTTPS/TLS) connection. No Aadhaar or PAN card images are uploaded to or stored in Firebase Storage.
• Only the KYC verification result (approved/rejected/pending), reviewer notes, and UPI ID are stored in Firebase Realtime Database, protected by strict security rules.
• Data transmitted to apitxt.com for verification is handled according to their privacy policy: apitxt.com/privacy-policy.
• KYC data within TrustSaathi's systems is never shared with third parties except as required by law or tax compliance mandates.
• Upon account deletion, all KYC records (name, PAN number, UPI ID, verification status) are permanently purged from our databases within 30 days.

---

7. Wallet, Payment Data & Razorpay Policy

7.1 Our Payment Partner — Razorpay

All financial transactions within TrustSaathi — including wallet top-ups and subscription payments — are processed through Razorpay Software Private Limited, a licensed Payment Aggregator regulated by the Reserve Bank of India (RBI).

• TrustSaathi does not collect, process, or store your payment card numbers, CVV, UPI PINs, net banking passwords, or any sensitive payment credentials. All such data is entered and processed exclusively on Razorpay's secure, PCI-DSS Level 1 certified payment interface.
• By making a payment on TrustSaathi, you agree to Razorpay's Terms of Service and Privacy Policy: razorpay.com/privacy
• Razorpay collects and processes your payment method details, billing information, device fingerprint, and transaction metadata in accordance with their own privacy policy and RBI Payment Aggregator guidelines.
• In the event of a payment dispute, chargeback, or fraud investigation, Razorpay may share relevant transaction data with your bank, card network (Visa/Mastercard/RuPay), or law enforcement as required.

7.2 Data TrustSaathi Receives from Razorpay

Upon a successful payment, Razorpay shares the following limited data with TrustSaathi to update your wallet balance and generate a transaction record:

• Razorpay Order ID and Payment ID (unique reference numbers)
• Payment amount and currency
• Payment status (success / failed / pending)
• Payment method type (e.g., UPI, Card, Net Banking — but NOT card numbers or UPI handles)
• Transaction timestamp

This data is used solely to credit your Deposit Wallet and generate an in-app transaction receipt. It is stored in our Firebase Realtime Database and never shared with third parties for commercial purposes.

7.3 Deposit Wallet

• The Deposit Wallet holds funds added via Razorpay and is used exclusively for purchasing TrustSaathi services (society subscriptions, flat security links, resident memberships, worker verifications).
• Deposit Wallet balance cannot be withdrawn to a bank account or UPI. It is a prepaid service credit wallet only.
• Unused Deposit Wallet balance is non-refundable except for accidental duplicate recharges reported within 48 hours (see Refund Policy).
• Upon account deletion, any remaining Deposit Wallet balance is forfeited and cannot be claimed.

7.4 Earned Wallet (Referral Withdrawals via UPI)

• The Earned Wallet holds referral commission income. Unlike the Deposit Wallet, Earned Wallet balances can be withdrawn to your verified UPI ID (subject to minimum ₹100 balance and approved KYC).
• Withdrawal payouts are processed manually by TrustSaathi's finance team using your KYC-verified UPI ID. These transfers are direct UPI bank transfers — not Razorpay payouts.
• A 10% TDS is deducted before payout as per Indian income tax law. See Section 15 for full TDS policy.

7.5 Transaction Records

• All wallet transactions (top-ups, subscription payments, referral credits, withdrawal requests) are logged in a Transaction History accessible within the app.
• Transaction records include: amount, type (credit/debit), description, Razorpay payment ID, timestamp, and status.
• These records are retained for a minimum of 7 years to comply with Indian accounting and financial record-keeping requirements under the Companies Act, 2013 and the Income Tax Act, 1961.
• Failed transactions are also logged for dispute resolution purposes.

---

8. Lawful Basis for Processing (DPDP Act Compliance)

Under the Digital Personal Data Protection Act (DPDPA), 2023 of India:

• Consent: We process personal data based on your explicit, informed consent at the time of registration, KYC submission, and referral program participation.
• Legitimate Interest: Processing visitor, gatekeeper, and resident data is necessary for the security and operational management of residential communities.
• Contractual Necessity: Processing is required to deliver services agreed upon at sign-up and to execute valid financial transactions (subscriptions, payouts).
• Legal Obligation: Processing financial transaction records, PAN data, and TDS deductions is required by Indian tax law (Income Tax Act, 1961).

---

9. How We Share Your Information

We do not sell, trade, or rent your personal data to third parties for commercial purposes. We share data only in the following scenarios:

• With Your Society: Visitor logs, resident names, and flat numbers are accessible to your Society Administrators and Security Staff to maintain community safety.
• With Service Providers:
  • Google Firebase — database, authentication, and cloud functions (Firebase Privacy Policy)
  • apitxt.com — real-time Aadhaar & PAN card identity verification API. Your Aadhaar/PAN number is transmitted to apitxt.com only during the verification step and is not stored by TrustSaathi thereafter. (apitxt.com Privacy Policy)
  • Razorpay Software Pvt. Ltd. — RBI-licensed Payment Aggregator for wallet top-ups and subscription billing. Razorpay processes your payment credentials directly on their PCI-DSS Level 1 certified platform. TrustSaathi never sees or stores your card/UPI credentials. (Razorpay Privacy Policy)
  • SMS / Push Notification Providers — for OTP delivery and gate approval alerts
• For Withdrawal Processing: Your verified UPI ID and name (from KYC) are shared with our payment processor to execute approved withdrawal transactions.
• For Tax Compliance: PAN number and withdrawal amounts may be reported to Indian tax authorities (Income Tax Department) as required for TDS compliance.
• For Legal Compliance: We may disclose information to law enforcement, government bodies, or courts when required by applicable law or a valid legal order.

---

10. Data Security

• All data transmitted between the app and our servers is encrypted using SSL/TLS.
• Aadhaar & PAN verification is performed via apitxt.com API over an encrypted (HTTPS/TLS) connection. No Aadhaar or PAN card images are stored in Firebase Storage by TrustSaathi. Only the verification outcome is retained.
• KYC records (name, UPI ID, verification status) are stored in Firebase Realtime Database protected by strict server-side security rules. Only authorized admin personnel can access KYC records.
• All financial data, transaction records, and wallet balances are stored in Firebase Realtime Database with access restricted to the authenticated account owner and authorized admins only.
• Firebase Realtime Database access is governed by strict security rules validated at the server level.

While we implement industry-standard safeguards, no digital system is 100% immune to security threats. We cannot guarantee absolute security but commit to prompt notification and mitigation in the event of a data breach.

---

11. Data Retention & Deletion

• Resident & Admin Accounts: Retained while you are an active member of a TrustSaathi-registered society.
• Visitor Logs: Logs older than 31 days are automatically compiled into a secure monthly PDF report, emailed to Society Admin, and permanently deleted from live databases on the 7th of each month.
• KYC Documents: Retained as long as your account is active. Permanently purged within 30 days of account deletion.
• Transaction & Financial Records: Retained for a minimum of 7 years as required by Indian financial laws (Income Tax Act, Companies Act).
• Referral Earnings Records: Retained as long as your account is active and for the financial record retention period post-deletion.

---

12. Account & Data Deletion (Google Play Compliance)

As required by Google Play Policy, users who have created an account can request its deletion along with all associated personal data. We offer two methods:

• In-App Deletion: Go to Settings → Account → Delete Account in the TrustSaathi app. This initiates an automated deletion queue for your account and all personal records.
• Email Deletion Request: Contact mtechshop5@gmail.com with your registered phone number and deletion request. We verify your identity and process the request.

Upon processing, all personal data (name, phone, flat details, referral data, KYC documents, Earned Wallet balance) will be permanently purged within 30 days. Financial transaction logs may be retained for the legally mandated period. Any pending withdrawal requests at the time of deletion will be forfeited and not processed.

---

13. Your Rights as a Data Principal (DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023 (India), you hold the following rights:

• Right to Access: Request a summary of the personal data we hold about you and its processing purpose.
• Right to Correction & Erasure: Request correction of inaccurate data or deletion of data no longer required for processing.
• Right to Withdraw Consent: Withdraw consent at any time. Note: withdrawal of consent means you will no longer be able to use TrustSaathi services, and any pending referral rewards may be forfeited.
• Right of Grievance Redressal: Lodge a formal complaint with our Grievance Officer (see Section 17).
• Right to Complain to the Board: If unresolved, register a complaint with the Data Protection Board of India (DPBI).
• Right to Nominate: Nominate another individual to exercise your rights in case of death or incapacity.

---

14. Children's Privacy

TrustSaathi does not knowingly collect personal data from children under the age of 18 without verifiable parental consent. The Referral Earn Program and KYC/withdrawal features are available only to adults (18+). If we discover we have inadvertently collected data from a minor, we will delete it promptly.

---

15. Tax Compliance — TDS on Referral Withdrawals

• TDS is calculated automatically within the App's withdrawal flow and displayed before confirmation.
• Your PAN Card number (submitted during KYC) is used for TDS filing and Form 26AS credit.
• TrustSaathi is not responsible for any additional tax liability arising from your referral income. Users are advised to consult a tax professional regarding their individual tax obligations on income earned through the Refer & Earn program.
• Failure to provide a valid PAN Card during KYC may result in a higher TDS rate being applied as per Income Tax Act provisions.

---

16. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, the Referral Program structure, or applicable laws. Material changes will be communicated via an in-app notification. The "Last Updated" date at the top of this document will reflect the most recent revision. We recommend reviewing this policy periodically.

---

17. Contact Us & Grievance Redressal

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, our Grievance Officer details are:

• Grievance Officer: Mr. Manoj Kumar
• Designation: Data Protection & Grievance Officer, TrustSaathi
• Email: mtechshop5@gmail.com
• Postal Address: TrustSaathi Developer Office, JP Nagar, Bangalore, Karnataka, India — 560078
• Response Time: We aim to respond to all queries and resolve grievances within 30 days of receipt.

For withdrawal-related disputes, KYC rejection appeals, or referral reward discrepancies, please email us with your registered phone number and a description of the issue. Include "Withdrawal Dispute" or "KYC Appeal" in the subject line for faster routing.