AvhaarThis policy explains how Avhaar collects, uses and protects personal data across two services: our company website (avhaar.in) and the Avhaar toilet reporting platform (toilet.avhaar.in and the Avhaar Android app).
1. Who we are
Avhaar is an engineering studio based in Virar West, Maharashtra, India (Udyam registration UDYAM-MH-17-0231762). For the personal data described in this policy, Avhaar decides why and how it is processed and is the "data fiduciary" under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). You can reach us at rohanmishra2823@gmail.com.
2. Our website (avhaar.in)
What we collect
- Contact form: your name, phone number, email address (optional), the service you are interested in, your message, and the page you were on when you sent it.
- WhatsApp: if you tap a WhatsApp button, the chat happens on WhatsApp under WhatsApp's own terms. We see your number and the messages you send us.
- Technical data: our hosting provider processes your IP address, browser type and the time of each request to deliver the site and keep it secure.
- Cookies and storage: the website sets no cookies. It saves only your cookie choice in your browser's local storage. See our Cookie Policy.
Why we use it
To reply to your enquiry, prepare a quote, and keep the site secure. We use the details you send only for these purposes.
Who processes it for us
- Vercel, to host the website.
- Resend, to deliver your contact-form message to our inbox by email.
- WhatsApp (Meta), only if you choose to chat with us there.
We do not sell your data and we do not use it for advertising.
3. The Avhaar toilet reporting platform
The platform lets citizens report dirty or broken public toilets by scanning the QR code at the toilet, and lets administrators handle those reports. It is available at toilet.avhaar.in and as an Android app.
What we collect
- Account details: your name and either your email address or your mobile number (+91). Administrators also have a role and an assigned area, and may add a profile photo.
- Login codes: a one-time code sent by SMS (through Twilio) or email (through Resend). Codes are short-lived; for email logins we store only a hashed form of the code.
- Your reports: the toilet, a description of up to 256 characters, up to four photos, the report's status and history, upvotes, and your feedback on whether it was fixed.
- Notifications: alerts about your reports, and a device token so we can send push notifications to your Android phone.
- Technical data: your IP address, used for abuse prevention (such as rate limits) and in server logs.
What we do not collect
We do not collect your GPS location, contacts, microphone recordings or advertising identifiers. The app asks for camera access only so you can scan a QR code or photograph a problem, and you can use a photo from your gallery instead.
Photos
Please photograph the toilet problem, not people. Photos are stored with our image provider and shown to the administrators handling the report.
Who can see your reports
Administrators responsible for the toilet's area and zone can see the report, its photos and its history so they can fix it. Your contact details are visible only to senior (parent) administrators, where needed to run the service. Reports and photos you submit are not shown publicly.
Why we use it
To let you log in, route your report to the right administrators, notify you of progress, escalate reports that are not resolved in time, prevent abuse, and keep the service secure and working.
4. Service providers and where data is processed
- MongoDB Atlas: our database, hosted in Mumbai, India.
- Render: hosts the platform's server.
- Vercel: hosts the website and web app.
- Twilio: sends SMS login codes.
- Resend: sends email login codes and website contact messages.
- Cloudinary: stores and delivers report photos.
- Google Firebase Cloud Messaging: delivers push notifications to Android phones.
Some of these providers process data outside India. We choose established providers and share only what each needs to do its job. We do not sell personal data.
5. How long we keep data
- Login-code sessions are deleted automatically within minutes to hours.
- Notifications are deleted automatically after 30 days.
- Push device tokens are removed when you log out, or when an administrator is removed.
- Reports and accounts are kept while the platform operates, and until you ask us to delete them, unless we must keep them to meet a legal duty.
- Website enquiries are kept only as long as needed to reply and for our business records.
6. How we protect data
We use encrypted connections (HTTPS), role-based access so people see only what their role needs, rate limiting against abuse, hashed login codes, restricted database credentials, and limited retention. No system is completely secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.
7. Children
These services are not directed at children under 18, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.
8. Your rights
Under the DPDP Act you can ask us to: tell you what personal data we hold and why; correct or complete it; delete it; withdraw your consent (this does not affect what we did before); and nominate someone to exercise your rights if you cannot. Email rohanmishra2823@gmail.com from the address or number on your account so we can verify it is you. We aim to reply within 30 days.
9. Grievance officer
Rohan Mishra, Founder, Avhaar, Virar West, Maharashtra, India. Email: rohanmishra2823@gmail.com. If you are not satisfied with our reply, you may complain to the Data Protection Board of India once it is operational.
10. Changes to this policy
We will update this page when our practices change and show the date at the top. For significant changes to the toilet platform we will also tell logged-in users in the app.