Privacy Policy

We collect information you provide directly and information generated through your use of the TrustTown platform.

1.1 Information You Provide

• Account information: mobile phone number (verified via OTP), full name, and profile photo.
• Provider profile: business name, professional bio, service areas (localities and pincodes), and identity verification documents (government-issued ID such as Aadhaar or PAN) for KYC.
• Supplier profile: business name, product listings, and identity documents.
• Booking data: service requests, customer addresses, and booking history.
• Communications: messages sent through the in-app chat between customers and providers.
• Reviews and ratings: feedback you submit about services or suppliers.

1.2 Information We Collect Automatically

• Location data: with your permission, precise GPS location to match you with nearby providers. You can disable this in your device settings at any time.
• Device information: device model, operating system version, unique device identifiers, and app version.
• Usage and analytics data: screens visited, features used, button taps, session duration, and interaction patterns — collected via PostHog (see Section 4).
• Log data: IP address, timestamps, and error logs for security and debugging purposes.

1.3 Information from Third Parties

• Google Maps / Places API: locality names, addresses, and geocoding when you search for or set service areas.
• MSG91: OTP delivery confirmation for phone number verification.

We use the information we collect to:

• Create and manage your account and verify your identity via OTP.
• Connect customers with verified service providers in their area.
• Facilitate service bookings and communicate job status updates.
• Send transactional notifications (booking confirmations, OTPs, job alerts).
• Verify provider and supplier identities through KYC document review.
• Improve the platform using product analytics (PostHog).
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Comply with legal obligations under Indian law.
• Respond to support requests and resolve disputes between users.

We do not use your data for automated profiling that produces legal or similarly significant effects without human review. We do not sell your personal data.

3.1 Within the Platform

• Customers ↔ Providers: when a booking is confirmed, relevant contact details (name, phone number) and service location are shared between the customer and assigned provider.
• Providers ↔ Suppliers: order details are shared when a provider places a supply order through the platform.

3.2 Service Providers (Data Processors)

We engage the following third-party services that process data on our behalf:

• Cloudflare — CDN, security, and object storage (R2) for KYC documents. Documents are stored in a private bucket not accessible to the public.
• MSG91 — SMS OTP delivery.
• Google Maps Platform — location search, geocoding, and map display.
• PostHog — product analytics and usage tracking (see Section 4).
• PostgreSQL / Supabase — database infrastructure for storing application data.

3.3 Legal Requirements

We may disclose your information if required by Indian law, court order, or a request from a government authority, or to protect the rights, property, or safety of Shaiksaif (Sole Proprietorship), our users, or the public.

3.4 Business Transfers

If Shaiksaif (Sole Proprietorship) undergoes a merger, acquisition, or sale of assets, your data may transfer as part of that transaction. We will notify you via email or in-app notice before your data is subject to a different privacy policy.

We use PostHog (posthog.com) for product analytics. PostHog helps us understand how the app is used so we can improve it. PostHog may collect:

• Screen views and navigation paths within the app.
• Button taps and feature interactions.
• Session duration and frequency of use.
• Device type, operating system, and app version.
• Anonymised IP address and approximate location (country/city level).

We configure PostHog to not record session replays or capture sensitive form inputs. PostHog data is processed under PostHog's own privacy policy available at posthog.com/privacy.

We do not use third-party advertising trackers, Facebook Pixel, Google Ads tags, or any cross-site tracking technologies.

• Active account data: retained for as long as your account is active.
• KYC documents: retained for 5 years from the date of collection as required under Indian regulations, then securely deleted from storage.
• Booking and transaction records: retained for 7 years for compliance and dispute resolution purposes.
• Deleted accounts: personal data is anonymised within 30 days of a verified account deletion request, except where retention is required by law.
• Usage and analytics logs: retained for 90 days then purged.
• Chat messages: retained for 1 year after the associated booking is closed.

Under the Digital Personal Data Protection Act, 2023 (DPDPA), you have the following rights:

• Access: request a summary of the personal data we hold about you.
• Correction: update inaccurate data through app settings or by contacting us.
• Erasure (Right to be Forgotten): request deletion of your account and associated personal data.
• Withdraw consent: withdraw consent for optional processing (e.g., analytics) at any time without affecting prior lawful processing.
• Grievance redressal: raise concerns with our Grievance Officer (Section 11).
• Nomination: nominate someone to exercise your rights in the event of death or incapacity.

• All data is transmitted over TLS/HTTPS encryption.
• KYC documents are stored in a private Cloudflare R2 bucket — not publicly accessible. Retrieval requires a valid, authenticated backend request.
• Authentication is OTP-only — no passwords are stored, reducing credential exposure risk.
• Database access is restricted to backend services in a secured environment.
• We conduct periodic security reviews and remediate vulnerabilities promptly.

No system is 100% secure. If you suspect unauthorised access to your account, contact us immediately at contact@trusttown.in.

TrustTown is not directed at children under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, please contact us at contact@trusttown.in and we will delete the account promptly.

The TrustTown platform may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party services you use.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date and notify you via in-app notification or email at least 15 days before the change takes effect. Continued use of TrustTown after that date constitutes acceptance.

For privacy queries, data requests, or complaints, contact our Grievance Officer: