Privacy Policy

Instant Dekho Private Limited (Policy Vault) respects your privacy. This policy explains what data we collect, why we collect it, how we use it, and your rights.

1. Data We Collect

Account Data

• Email address (for authentication and important notifications)
• Full name (for policy ownership identification)
• Profile photo (optional, via Supabase Auth avatar)

Policy & Document Data

• Insurance policy details: insurer, policy number, type, coverage amounts, premiums, dates
• Uploaded documents: PDFs, images (stored in Supabase Storage, encrypted at rest)
• People records: names, relationships, contact details you add to your vault

Technical Data

• Authentication logs: login timestamps, IP addresses (Supabase Auth)
• Usage analytics: page views, feature usage (no third-party trackers)
• Error logs: crash reports, performance metrics (server-side only)

2. Legal Basis for Processing

• Contract performance: Storing your policies and documents to provide the service
• Legitimate interest: Security monitoring, fraud prevention, service improvement
• Consent: Marketing emails (opt-in only), optional profile data
• Legal obligation: Compliance with applicable laws, data retention requirements

3. How We Use Your Data

• Provide and maintain your policy vault
• Send renewal reminders and critical account notifications
• Secure authentication and authorization (Supabase Auth)
• Improve service reliability and fix bugs
• Comply with legal obligations

4. Data Sharing

We do not sell your data. We share data only:

• With Supabase (auth, database, storage) — our processor under a DPA
• When required by law or valid legal process
• With your explicit consent (e.g., sharing a policy with a family member)

5. Data Retention

• Account data: Retained while your account is active
• Policy/documents: Retained until you delete them or request account deletion
• Auth logs: 90 days (Supabase default)
• Error logs: 30 days
• Backups: 30 days (encrypted)

6. Your Rights (GDPR / DPDP Act)

• Access: Request a copy of your data
• Rectification: Correct inaccurate data
• Erasure: Delete your account and all associated data
• Portability: Export your policies and documents
• Restriction: Limit processing in certain cases
• Objection: Object to legitimate-interest processing

To exercise these rights, email info@chiraggroup.com or use the "Delete Account" option in Settings.

7. Security

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Row Level Security (RLS) on all database tables
• Supabase Auth with MFA support
• Regular security reviews and dependency updates

8. International Transfers

Supabase hosts data in the region you select during project creation. We do not transfer data outside that region without adequate safeguards (Standard Contractual Clauses).

9. Children's Privacy

Policy Vault is not directed at children under 18. We do not knowingly collect data from children. If you believe a child has provided us data, contact us immediately.

10. Changes to This Policy

We will notify you of material changes via email or in-app notice at least 30 days before they take effect.

11. Contact