Privacy Policy

⚠️ Template document. Please have reviewed by India-qualified counsel before going live.

1. Who processes your data

Data Fiduciary: Kameswar Digital Services (Glow On The Map), Udyam: UDYAM-AP-17-0076669.
Registered address: Pavara Village, Samalkot, Kakinada, AP 533450, India.
Contact for privacy matters: support@glowonthemap.com

This policy describes how Glowmap collects, uses, stores, and protects your personal data in compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act).

2. What data we collect

2.1 Data you provide directly

• Name, email address, phone number, business name
• Business type, address, and Google Business Profile details
• Payment details (processed securely by Razorpay — we don't store card details)
• Any content you submit through the platform (voice samples, customisations)

2.2 Data from third parties (with your consent)

• Google Business Profile data (reviews, posts, Q&A, analytics) — via Google's official API, with OAuth consent
• WhatsApp messages you send to us (via WhatsApp Cloud API)

2.3 Data collected automatically

• IP address, browser type, device info (for security and analytics)
• Usage data: pages visited, features used, clicks (via PostHog, Google Analytics 4)
• Cookies (see Cookie Policy below)

3. Why we process your data (purposes)

• Providing the service: Generating AI responses, scheduling posts, sending alerts
• Billing: Processing payments, sending receipts and invoices
• Support: Responding to your questions, troubleshooting issues
• Improving the product: Understanding usage patterns, fixing bugs
• Legal compliance: Meeting tax, auditing, and regulatory requirements

We do not sell your data to third parties. We do not use your business data to train public AI models.

4. Legal basis for processing (DPDP)

We process your data on one of these bases:

• Consent — when you sign up and connect your Google/WhatsApp accounts
• Contract — to deliver the service you subscribed to
• Legal obligation — tax records, audit compliance
• Legitimate interest — security monitoring, fraud prevention

5. Where your data is stored

All primary data is stored in India, on Amazon Web Services (ap-south-1, Mumbai region) via Supabase. Backups are encrypted and stored in the same region. We do not transfer data outside India without your explicit consent.

A small subset of data may be processed by these sub-processors:

• Anthropic (Claude AI) — USA — for AI-generated replies. Only the public review text is sent (no personal data).
• Razorpay — India — for payments.
• Meta (WhatsApp Cloud API) — USA — for WhatsApp notifications.
• Vercel — USA/global — for website hosting.
• PostHog, Google Analytics — for anonymised usage analytics.
• Resend — for transactional emails.

6. How long we keep your data

• Active account: We retain data while your account is active
• After cancellation: Data retained for 30 days, then permanently deleted (you can export before)
• Billing & tax records: Retained for 8 years as required by Indian tax law
• Logs: Anonymised after 90 days

7. Your rights under DPDP

As a Data Principal, you have the right to:

• Access — request a copy of your data
• Correction — have inaccurate data corrected
• Erasure — have your data deleted
• Portability — receive your data in machine-readable form
• Grievance — file a complaint with us or the Data Protection Board of India
• Withdraw consent — at any time, without penalty

To exercise any right, email support@glowonthemap.com. We will respond within 7 days.

8. Data security

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access to your data is restricted to authorised personnel on a need-to-know basis
• Regular security audits; SOC 2 Type II certification in progress
• Data breach notification within 72 hours to DPBI and affected users (as required by DPDP)

9. Children's data

Glowmap is not intended for individuals under 18. We do not knowingly collect data from children.

10. Cookies

We use cookies and similar technologies for:

• Essential cookies — required for login, preferences (cannot be disabled)
• Analytics cookies — anonymised usage statistics (you can opt out)
• Advertising cookies — for retargeting (only with your consent)

Manage your preferences in your browser settings or our cookie banner.

11. Changes to this policy

Material changes will be notified via email 30 days in advance. Current version always available at glowonthemap.com/privacy.

12. Grievance Officer

Name: Malladi Aruna
Role: Grievance Officer, Data Protection
Email: support@glowonthemap.com
Response time: Within 7 business days