Privacy Policy

Draft for review by counsel. Not yet in force.

This Privacy Policy explains how Leapforge Innovations Pvt Ltd ("Groopit", "we", "us") collects, uses and protects your personal data when you use the Groopit app and website. We follow the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable Indian laws. For the data described here, we are the Data Fiduciary.

1. Data we collect

• Account details: mobile number, name, preferred language and your role (customer, partner or captain).
• Address details: flat or house number, building, society, area, pin code and any landmarks you save.
• Location: your device's approximate or precise location, only when you allow it, to show deals near you and to place your society on the map.
• Booking history: deals you join, services, slots, notes and photos you add, ratings, reviews and support tickets.
• Payment references: order IDs, payment IDs, amounts and refund status from our payment processor, Razorpay. We do not store your card number, UPI PIN or bank login details.
• Partner KYC: for technicians, sellers and travel partners — identity and address proof, PAN, GSTIN, bank account details and business registrations.
• Device and usage data: device type, app version, IP address, crash logs and how features are used, to keep the app secure and working.
• Communications: messages with Partners and our support team, and call records where call masking is used.

2. Why we use it

• To create and secure your account and sign you in with OTP.
• To show deals near you, take bookings, form groups, lock deals and schedule Partners.
• To collect payments, process refunds and issue GST invoices.
• To send booking updates, reminders and offers through the app, SMS and WhatsApp. You can turn off promotional messages at any time.
• To verify and pay Partners, and to keep the platform safe.
• To handle support requests, complaints and the revisit guarantee.
• To prevent fraud and misuse of referrals, coupons and points.
• To improve the app using aggregated, de-identified data.
• To meet our legal duties, such as tax, accounting and lawful requests from authorities.

3. Consent and legal basis

We process your personal data with your consent, which you give when you sign up and when you turn on features such as location. We tell you the purpose when we ask. Some processing is done for "legitimate uses" allowed by the DPDP Act — for example, completing a booking you asked for, or keeping records the law requires. You can withdraw consent at any time (see Your rights). This does not affect processing already done, but some features may stop working without the data they need.

4. Who we share it with

We share only what is needed:

• Partners who fulfil your booking get your name, flat and address details, the booking details and any notes or photos you add. When call masking is on, they never see your phone number — calls go through a masked number.
• Payment processors (Razorpay), to collect payments and make refunds.
• SMS and WhatsApp providers, to send OTPs and updates.
• Cloud hosting and support tools that process data for us under contract.
• Government authorities, courts or regulators, when the law requires it.

We do not sell your personal data.

5. Location

We use location to find deals and Partners near you and to confirm your society. You can switch location off in your phone settings and enter your area or pin code instead. A Partner sees your saved address only after you book with them.

6. How long we keep it

• Bookings, invoices and payment records are kept for as long as tax and accounting laws require — currently about 8 years.
• If you ask us to delete your account, we delete or anonymise your account data within 30 days, except data we must keep by law or to resolve an open dispute.
• Partner KYC documents are kept while the partner account is active, and afterwards for as long as the law requires.
• Security logs are kept for a limited period.

7. Your rights

Under the DPDP Act, you have the right to:

• Access a summary of your personal data and how we use it (Profile → Privacy → Export my data).
• Correct and update inaccurate or incomplete data.
• Erase your data — request deletion from Profile → Privacy, subject to legal retention.
• Withdraw consent for any purpose, including marketing messages.
• Grievance redressal — complain to our Grievance Officer and, if you are not satisfied, to the Data Protection Board of India.
• Nominate a person to exercise these rights for you in case of death or incapacity.

We will respond within the time set by law.

8. Children

Groopit is for adults aged 18 and above. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

9. Security

We protect your data with encryption in transit (HTTPS), encryption of Partner KYC documents at rest, role-based access controls so staff see only what they need, audit logs and regular reviews. No system is perfectly secure. If a personal data breach affects you, we will inform you and the Data Protection Board as the law requires.

10. Cookies and local storage

We use a small number of cookies and browser storage items that the app needs to work: to keep you signed in (session), to remember your language, and to remember whether you have seen the intro screens. We do not use third-party advertising cookies.

11. Where your data is stored

Your data is stored on servers located in India. If a service provider ever needs to process data outside India, we will make sure this is allowed by law and that your data stays properly protected.

12. Contact and Grievance Officer

For privacy questions, write to support@groopit.in. Our Grievance Officer:

• Name: —
• Email: grievance@groopit.in
• Phone: —
• Address: —
• Hours: Mon–Sat, 10:00–18:00 IST

13. Updates to this policy

We may update this policy from time to time. We will tell you about important changes in the app and, where required, ask for your consent again.