Privacy Policy

1. Overview & Scope

Corbit Technologies Private Limited ("Company", "we") is committed to protecting your privacy, confidentiality, and security. This Policy explains how we collect, process, store, disclose, transfer, and delete personal information on our apps, websites, and services ("QuQ Search" or the "Platform").

Published in compliance with: (1) the Digital Personal Data Protection Act, 2023; (2) Section 43A of the IT Act, 2000; (3) the IT (Reasonable Security Practices and SPDI) Rules, 2011; (4) the Consumer Protection (E-Commerce) Rules, 2020; (5) Apple Guideline 5.1 – Privacy; (6) Google Play User Data policy. For DPDP purposes the Company acts as "Data Fiduciary".

2. Data Principal Consent (Section 6, DPDP Act)

By ticking the consent box at registration or continuing to use the Platform, you give free, specific, informed, unconditional, and unambiguous consent to processing for the purposes below. You may withdraw consent at any time under Section 6(4), subject to statutory retention obligations.

3. Categories of Personal Data We Collect

We collect only what is strictly necessary for marketplace communication, security, and fulfilment.

A. Data provided directly by you

• Registration & account: 10-digit Indian mobile number, full name, email address, username.
• Profile: avatar image, bio/city (if entered).
• Ad content & media: title, category, price, locality, condition, specifications, images, employer/company name.
• Messaging: text messages, price offers, and timestamps exchanged in Platform chat.

B. Voluntary identity verification (DigiLocker / API Setu e-KYC)

• Legal name as verified by DigiLocker.
• Document type restricted to PAN or DRIVING_LICENSE.
• Cryptographic hash — SHA-256 one-way hash (verified_doc_hash) to prevent identity reuse.

C. Geolocation

• Precise/approximate location (with permission): GPS coordinates to compute distance to nearby listings and resolve your city.
• IP-derived location: approximate city/region when GPS is off, for localised recommendations.

D. Device, technical & usage data

• Identifiers: installation UUID (device_id), FCM push token, OS type, app version.
• Crash & performance: Crashlytics traces, memory warnings, screen-transition traces.
• Search & browsing analytics: queries, category views, impressions, lead clicks. (Analytics is disabled in debug builds.)

E. Transaction & billing metadata

• Transaction identifiers, order IDs, and payment status via Apple StoreKit or Razorpay.
• No credential storage: we never store card numbers, CVVs, net-banking passwords, or UPI PINs.

4. Specific Purposes for Data Processing

1. Authenticate your account via SMS OTP and secure sessions;
2. Publish ads and let buyers/employers reach you via Phone, WhatsApp, or in-app Chat;
3. Compute real-time distance between listings and users;
4. Verify voluntary identity via DigiLocker and prevent duplicate/fraudulent accounts;
5. Facilitate negotiations and deliver push notifications for messages and inquiries;
6. Enforce Terms, investigate abuse or recruitment fraud, and comply with lawful Section 91 CrPC requests;
7. Bill and fulfil listing-validity extension packages.

5. Data Sharing and Third-Party Disclosures

We never sell, rent, or trade personal data to brokers or marketers. Sharing is strictly need-to-know:

1. Cloud & database: Supabase Inc. (AWS, encrypted at rest and in transit).
2. SMS gateway: MSG91 (Walkover Technologies) for OTP delivery.
3. Payments: Apple Inc. (iOS IAP); Razorpay Software Pvt. Ltd. (RBI-authorised aggregator, Android/Web).
4. Identity: API Setu / Digital India Corporation (MeitY) for voluntary DigiLocker verification.
5. Analytics & diagnostics: Google Cloud / Firebase (Crashlytics, Google Analytics 4) for crash monitoring and aggregate performance.
6. Legal: disclosure only under binding court orders, warrants, summons, or statutory directives from authorised Indian authorities.

6. Data Principal Rights Under the DPDP Act, 2023

1. Access: request a summary of data processed about you.
2. Correction: update name, email, location, and photo in Settings → Edit Profile.
3. Erasure: delete your data any time (see §7).
4. Grievance redressal: complain to our Grievance Officer.
5. Nomination: nominate someone to exercise your rights on death/incapacity.

To exercise any right, email grievance@quqsearch.com.

7. Data Retention, Account Deletion & 7-Day Grace Period

Per Section 8(7) of the DPDP Act and Apple Guideline 5.1.1(v):

1. Process: delete any time via Profile → Preferences → Danger Zone → Request Account Deletion.
2. 7-day grace: your account is immediately deactivated and hidden; data is retained 7 days to prevent fraud and allow recovery. To cancel, contact support@quqsearch.com within 7 days.
3. Purge: after 7 days, automated purge (purge_expired_deleted_accounts) irreversibly deletes profile, listings, notifications, wishlists, and auth records from active tables.
4. Fraud exception: under Section 8(7), we retain a one-way hash of numbers involved in violations, scams, or spam in a permanent blacklisted_phones table to block re-registration.

8. Reasonable Security Practices & Safeguards

• Transport: TLS 1.3 / HTTPS between app, Edge Functions, and database.
• Storage: AES-256 encryption for databases and buckets.
• Access control: PostgreSQL Row-Level Security — users can only read/mutate authorised rows.
• No plaintext secrets: single-use OTP auth; no passwords or biometrics stored.

9. Children's Data

QuQ is for adults 18+. We do not knowingly collect data from minors; accounts found to belong to minors and their listings are removed immediately.

10. Policy Updates

We may update this Policy; material changes will be announced via in-app banner or by updating the "Last Updated" date above. Continued use after the effective date constitutes acceptance.