Privacy Policy

1. Who we are

ZUVVA is a trust-based people network operated by GrandGate Ventures Private Limited (“ZUVVA”, “we”, “us”), incorporated in India. This policy covers our mobile applications (Android & iOS) and our website at zuvva.in.

2. Data we collect

You give us

• Profile data: name, phone number, profession, city, area, profile photo, optional bio, and optional work details you add: business or workplace, position, speciality, the services you offer and the towns you serve, what you can help with, and a professional registration number where your trade has one (for example a RERA number).
• Contacts: only when you grant the contacts permission, to help you find people you already know on ZUVVA and invite others. We store contact names and phone numbers you choose to import. You can revoke this at any time.
• Content you create: messages (text, and optional voice recordings you record in chat), posts on Billboard (including any photo you choose to attach), vouches, SOS messages, ratings, reviews.
• Your work portfolio (optional): photos of your work, one short video, one brochure or price list (PDF), and questions and answers you write. Photos are made smaller and their location and camera details removed when you upload them. Who can see it is your choice (all your network, only your connections, or only you), and anyone you are chatting with can open it unless it is set to only you. If you turn on its outside link, anyone with that link or its QR code can see the page; it never shows your phone number, and you can turn it off or make a new link at any time. Lawyers' and doctors' work portfolios hold facts only.
• Your issues list (optional): problems or pending work you write or say (for example “my work at the MRO office is pending”), what ZUVVA understood from it, a timeline of what happened, and when you mark it done, how it went and who helped. It is private to you: nobody else sees it unless you share an item. Items about court, health or money are marked private and can never be shared with your whole network.
• Communications: emails or messages you send us (e.g. via contact form, support, grievance).

Collected automatically

• Device data: device type, OS version, app version, language, time zone.
• Usage data: features used, screens viewed, action timestamps. Used to improve the product and detect abuse.
• Approximate location: city-level location derived from your profile, used for search and profile context.
• Your position for a search: only when you allow location and ask for it. For “Near <town>” on Home, your position (rounded to about 1 km) is used to find the town’s name. For search near me, when you choose a distance (1, 3 or 5 km), your position (rounded to about 100 metres) is sent with that search to find people whose saved area or town lies within it. It is used for that search only — not stored, not shown to anyone, and not shared. Search near me never uses anyone else’s live location; people are placed by the area or town saved for them.
• Precise location (GPS): collected only when you grant location permission and only for the safety features you actively trigger. When you raise an SOS, or share live location in a chat, your precise location is captured and streamed live to the specific people you choose to alert/share with (so they can reach you while you move), for the duration of that SOS or share. A foreground-service notification is shown while this is active. It is shared only with those chosen recipients within ZUVVA — never sold or shared with third-party companies — and stops when the SOS is resolved/cancelled or you stop sharing.
• Search and app use: what you search for, so ZUVVA can keep looking when nobody is found and suggest people in For you; and the hours you usually open ZUVVA, so reminders arrive then. A search that finds nobody is also kept for 60 days without your account attached, to learn what the network is missing.
• Work portfolio activity: when someone opens your work portfolio, asks you through it, passes it on, or opens its outside link, and the search words that found it. You see counts only — never who. A search word is shown only when at least two different people used it. These counts are kept for 120 days. Two weeks after someone asks you through it, ZUVVA may ask them privately whether you helped; you see their answer and note without their name, and a “yes” becomes a thank-you that you choose whether to show.
• Push tokens: an FCM/APNs token to deliver notifications.
• Network data: IP address and connection metadata, used for security and rate limiting.

3. Why we collect it

• Provide the ZUVVA trust-network service: profile, contacts, messaging, vouching, billboard, SOS.
• Find mutual connections and surface relevant people.
• Calculate trust scores and network insights.
• Deliver notifications, emails, and OTPs you've consented to.
• Detect and prevent abuse, fraud, and policy violations.
• Comply with legal obligations (record-keeping, lawful requests).

4. Legal basis

We process personal data under one of the following lawful bases:

• Consent — for sensitive data (e.g. contacts import, precise GPS) and optional features.
• Contract — to deliver the ZUVVA service you signed up for.
• Legitimate interest — for security, fraud prevention, and product improvement, where this does not override your rights.
• Legal obligation — to comply with applicable laws including the Digital Personal Data Protection Act, 2023 (India) and the GDPR where applicable.

5. How we share data

ZUVVA does not sell your personal data. We share it only when:

• You direct us to — e.g. when you vouch, post, or send a message, the relevant recipients see the content. When you raise an SOS or share live location, the contacts you choose receive your alert and your live precise location for the duration of that SOS/share.
• Service providers — payment, SMS (MSG91), email (Google Workspace), push notifications (Firebase/Google), maps (Mapbox), AI (OpenAI, Google) act as processors under contract.
• Translation and voice — when you choose to translate a chat message, that one message is sent to our AI provider (OpenAI) only to be translated. The translation is shown only on your phone; we do not store the message or its translation, and the sender is not told. If you turn on Read in my language in Chat settings, other people's messages in another language are translated this way automatically as they arrive, until you turn it off. Billboard posts are translated the same way, and the translation is kept so other readers of that post see it too. In voice mode, your phone's own speech service (for example Google's) turns your speech into text; only that text is sent to us and our AI provider to understand your request, and ZUVVA does not record your voice for this. OpenAI does not use this data to train its models and may keep it for up to 30 days to detect abuse.
• Work portfolio helper — only when you use it: the words you say or type about your work, the text read from a visiting card on your phone (not the photo), or small low-quality copies of the work photos you picked are sent to our AI provider (OpenAI) to draft your work portfolio, choose and caption photos, tidy a question, or check it against the rules for your kind of work. You see and can change every result before anything is saved. It never sees who you are.
• Your issues list and AI — when you add an item, its words are sent to our AI provider (OpenAI) to give it a short title, work out what kind of person could help, and tell whether it is about court, health or money. While it is open, ZUVVA reruns that search in your own network every 6 hours, and every 6 hours sends the item's title and the new Billboard posts you can already see to our AI provider, to find posts from people who could help. It never sees who you are. OpenAI does not use this data to train its models.
• Sharing an item from your issues list — only when you choose, and only with the people you pick: chosen contacts, a contact group, a circle you belong to, or your whole network. You see and can change the words they will read before sharing. Sharing with a group, a circle or your network places it on Billboard as an ordinary post, seen as Billboard posts are; chosen contacts get a notification. People it is shared with can offer to help or say they know someone, and you see that on the item's timeline. You can stop sharing at any time. When you mark an item done and choose who helped, each of them receives your thank-you, which they decide whether to show.
• Introducing someone from your contacts — when you share a contact, ZUVVA introduces them instead of handing out their details. A shared link shows only their name, work and town, never their phone number. People you introduce inside ZUVVA see the same, plus your note; their number is passed on only if you switch on “Include their phone number”, and then only to that one person. Someone who opens a shared link can connect with you and ask you for the introduction; you decide.
• People on your invite line — the person whose invitation you joined through, and the people who joined through yours, see how many members you are connected to (a number only, never who), how many people joined through you, and whether an invitation was used from a phone it wasn't sent to. This lets them limit what you can see through them, remove the connection, block or report you; you are not told.
• What other members see on your profile — your name, photo, work, area, bio and the year you joined; your trust score; the help you gave in the last 12 months that the people you helped confirmed, with the badge it earns; the kinds of people you know (for example doctors or teachers — never sensitive groups such as public office); and the people you and the viewer both know, limited to people the viewer can already see in their own network. People you have saved yourself (and not set to “Only me”) also see totals about your network: how many people, cities and countries it reaches, how many helps, the kinds of people it is strongest in, and up to two places abroad where at least two of your people live. These are totals only — never who those people are, their numbers or their exact places.
• How trust is calculated — your trust is worked out from what other people confirm: help the person you helped confirmed in the last 12 months, “Did it help?” answers and ratings, people who joined through your invitation and stayed, how often you answered requests, introduction asks and SOS alerts in time, your profile, and help between members of circles you started. A report upheld by a ZUVVA moderator lowers it. Time spent in the app, the number of contacts and messages sent are never used. You see your number and why; other members see only a band (New, Trusted, Reliable or Pillar).
• Chat status and your choices — people you chat with see “Online” while ZUVVA is open on your phone, and blue ticks when you read their messages. In Chat settings you can turn off showing when you're online, turn off read receipts (you then don't see others' either), hide message text on your lock screen, and get group and circle notifications only when you're @mentioned.
• Reports — when someone reports a chat, ZUVVA's moderators read the last messages of that chat before the report (up to 30), and our AI provider (OpenAI) summarises them for the moderator; it never reads anyone's other chats. People who were in that chat may be asked what they saw. The reported person is told what the report is about but never who made it, and a person — not the AI — decides. Nothing about a report is shown on anyone's profile. The one exception: once at least two different members have reported someone, the person whose invitation they joined through sees that count — never who reported them or why.
• Legal requirements — to comply with valid legal process or protect rights, safety, or property.
• Business transfers — in the event of a merger, acquisition, or sale of assets, subject to confidentiality and notice to affected users.

6. Data retention

• Active accounts: retained while your account exists.
• Deactivation: data is hidden from others but preserved until you delete or reactivate.
• Deletion: 30-day grace period during which you can restore the account, after which personal data is permanently erased (limited fields may be retained to satisfy legal obligations).
• Work portfolio counts: 120 days. Searches that found nobody: 60 days, without your account attached. Your work portfolio's photos, video and PDF are deleted as soon as you remove them, and with your account.
• Your issues list: an open item stays until you mark it done or delete it (after 3 months ZUVVA asks whether it is still pending). A done item is kept for 12 months, then deleted. Deleting an item deletes it, its timeline and the search behind it straight away, and the whole list is deleted with your account. Thank-yous you sent are kept by the people who received them.
• Backups: encrypted backups are purged on a rolling 30-day cycle.
• Audit logs: certain compliance-related logs (e.g. consent acceptance, security events) are retained for up to 3 years even after deletion.

7. Your rights

Under India's DPDP Act 2023 §§5–8 and the GDPR Art. 15–22, you have the right to:

• Access: view all your data. In-app: Settings → Download My Data.
• Correction: edit your profile at any time.
• Erasure: delete your account permanently (Settings → Delete Account).
• Portability: export your data as JSON.
• Withdraw consent: revoke optional permissions (contacts, location) in Settings.
• Object / restrict processing: contact us to object to specific processing.
• Lodge a complaint: with the Data Protection Board of India (DPDP §29) or your local supervisory authority.

8. Security

We protect your data using industry-standard measures including encryption in transit (TLS 1.2+), encryption at rest for sensitive stores, access controls, audit logging, and regular review of our infrastructure. No system is perfectly secure — please use a strong phone-screen lock and report any suspected compromise to us immediately.

9. Children

ZUVVA is not directed at children under 13. We do not knowingly collect personal data from children under 13. Users between 13 and 18 should use ZUVVA only with parental or guardian consent. If you believe we have collected data from a child under 13, contact us and we will delete it.

10. International transfers

Our primary infrastructure is hosted in India. Some processors (e.g. Firebase, OpenAI, Mapbox) may process data in the United States or the European Union under appropriate contractual safeguards (Standard Contractual Clauses, where applicable).

11. Cookies & analytics

The ZUVVA website uses strictly necessary cookies to keep you signed in and remember your preferences. We do not use third-party advertising cookies. Server-side analytics (page views, action counts) are aggregated and not used to track individuals across sites.

12. Changes to this policy

We may update this policy as the product evolves or as the law requires. Material changes will be announced in the app and via email to your registered address at least 14 days before they take effect. The “Effective” date at the top reflects the most recent change.

13. Grievance officer

In accordance with DPDP Act 2023 §8(10) and Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our Grievance Officer can be reached at:

Name: ZUVVA Data Protection Officer
Email: grievance@zuvva.in
Response time: Within 15 business days of receipt.

For all other privacy questions, email privacy@zuvva.in.