Privacy Policy

Last updated: April 1, 2026 · Effective: April 1, 2026

This Privacy Policy describes how Snellcart Online Services Private Limited ("ZephyGuard," "we," "us," or "our") collects, uses, shares, and protects information in relation to the ZephyGuard SaaS platform, mobile applications, and website (collectively, the "Services"). We are committed to complying with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India and applicable global privacy regulations.

1. Information We Collect

a) Information you provide directly

• Account information: Name, email address, phone number, agency name, billing address, GSTIN.
• Guard and employee data (uploaded by agency administrators): Name, contact details, photograph, Aadhaar/PAN where required for PSARA compliance, attendance records, shift history, training records.
• Client and site data (uploaded by agency administrators): Client name, site addresses, contract details.
• Communications: Support tickets, call recordings (with consent), WhatsApp messages, emails.

b) Information collected automatically

• Location data: GPS coordinates from guard mobile devices during active shifts only (explicit opt-in required).
• Device information: IP address, device model, OS version, app version, language preference.
• Usage analytics: Feature usage, session duration, errors encountered — strictly for product improvement.
• Cookies: Session cookies, preference cookies. No third-party advertising cookies.

2. How We Use Information

We use collected information to:

• Provide, maintain, and improve the Services
• Process payments and send billing communications
• Authenticate users and prevent fraud
• Send service announcements, security alerts, and administrative messages
• Respond to customer support requests
• Comply with legal obligations and enforce our terms

We do NOT: sell your data, share with advertisers, use your operational data to train AI models beyond anonymous aggregated metrics, or read private messages between agency admins and their guards.

3. Legal Basis for Processing

We process personal data on the following lawful bases: (a) performance of a contract with you; (b) your consent, where required; (c) compliance with legal obligations; and (d) our legitimate interests in operating and securing the Services, where not overridden by your rights.

4. Data Sharing and Disclosure

We share data only in the following circumstances:

• Service providers: Cloud hosting (AWS Mumbai region), payment processors (Razorpay, Stripe), email delivery (AWS SES), SMS gateways (MSG91) — all bound by strict data processing agreements.
• Legal requirements: When required by court order, subpoena, or government authority with lawful jurisdiction.
• Business transfers: In the event of merger, acquisition, or asset sale, with prior notice and continued application of this Policy.
• With your consent: For any other purpose disclosed at the time of collection.

5. Data Retention

We retain personal data for as long as your account is active, plus the periods required by law (typically 7 years for tax and financial records under Indian law). Upon account closure, personal data is deleted or anonymized within 90 days unless retention is required by law. You may request earlier deletion subject to legal obligations.

6. Your Rights

Under the DPDP Act and other applicable laws, you have the right to:

• Access personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Withdraw consent at any time
• Port your data to another service in a machine-readable format
• Lodge a complaint with the Data Protection Board of India

To exercise these rights, email contact@zephyguard.com. We respond within 30 days.

7. Data Security

We implement industry-standard security measures including: TLS 1.3 encryption in transit, AES-256 encryption at rest, role-based access controls, audit logging, regular security assessments, and ISO 27001-aligned practices. Our primary data centers operate in the AWS Mumbai region (ap-south-1) with encrypted daily backups. We are ISO 27001 certification is in progress.

8. International Data Transfers

Your data is primarily stored in India. If you are located outside India and use our Services, your data will be transferred to and processed in India. We maintain appropriate safeguards consistent with applicable data protection laws.

9. Children's Privacy

Our Services are not directed at individuals under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us immediately.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via email to account administrators at least 30 days before taking effect. Continued use after the effective date constitutes acceptance.

11. Contact the Data Protection Officer

Questions, concerns, or requests? Reach our Data Protection Officer at:
Email: contact@zephyguard.com (subject line: "DPO Request")
Phone: +91 79018 12796
Mail: Data Protection Officer, Snellcart Online Services Pvt Ltd, Mohali, Punjab 160062, India

12. Grievance Officer

In compliance with the Information Technology Act, 2000 and the DPDP Act, 2023, our Grievance Officer can be reached at contact@zephyguard.com with the subject line "Grievance." We acknowledge grievances within 48 hours and resolve them within 30 days.