Data Policy

This policy describes how Edvet — a registered product of Sazag Infotech Private Limited — stores, protects, retains, and deletes data. It complements the Privacy Policy (what we collect and why) and reflects our obligations under the DPDP Act, 2023.

1. Where data lives

• Application data is stored in a managed PostgreSQL database and object storage hosted on professional cloud infrastructure (currently Render, Singapore region, with encrypted backups).
• Uploaded documents (certificates, teaching videos) are stored in private buckets, accessible only through short-lived signed links.
• Conversations are stored to operate the service and for quality review of our AI-assisted operations.

2. Identity data — special handling

• We never store a full Aadhaar number. We keep the verification result from our KYC provider, the last four digits, and a salted one-way hash used solely to prevent banned users from re-registering.
• PAN, when provided, is stored as a salted hash plus the verification result.
• Face-match comparisons produce a numeric embedding, stored in a restricted table; the underlying rules never allow it to be used for anything except duplicate/fraud prevention.
• KYC provider raw responses are retained briefly for audit (60 days), then reduced to key fields.

3. Security measures

• Encryption in transit (TLS) everywhere; sensitive fields (addresses, dates of birth, KYC references) additionally encrypted at the application layer.
• Access on a strict need-to-know basis: internal team members see only what their role requires; every access to identity tables is logged.
• Webhooks and integrations are signature-verified; automated systems act through audited, permission-scoped internal APIs.
• An immutable audit log records who (human or automated agent) changed what, and when.

4. Retention schedule

• Enquiries that never become active: deleted or anonymised after 12 months.
• Conversations: 24 months, then summarised and redacted.
• KYC raw responses: 60 days (then key fields only).
• Tax records and invoices: 8 years (legal requirement).
• Fraud-prevention identity hashes of banned accounts: retained as a legitimate interest to protect users.

5. Deletion & export requests

Write to team@edvet.in or use your dashboard. Export is delivered in a machine-readable format. Erasure removes or anonymises personal fields within 30 days, except records the law obliges us to keep (listed above), which are isolated and access-restricted until their retention expires.

6. Breach response

We maintain an internal breach playbook: contain, assess, notify the Data Protection Board of India and affected users as required by the DPDP Act, and publish remediation steps. Suspected issues can be reported to team@edvet.in.

7. Processors

Current categories: cloud hosting & database, object storage, KYC verification, WhatsApp Business Platform, SMS, email, payments (teacher commissions), maps/geocoding, error monitoring, and product analytics. An up-to-date list of named vendors is available on request.