Privacy Policy

This Privacy Notice for Anuuj Techos LLP (doing business as Zaruri Papers) ("we", "us" or "our") describes how and why we might access, collect, store, use and/or share ("process") your personal information when you use our services ("Services"), including when you:

• visit our website at https://www.zaruripapers.com, or any website of ours that links to this Privacy Notice;
• download and use our mobile application (Zaruri Papers), or any other application of ours that links to this Privacy Notice;
• use Zaruri Papers. Zaruri Papers is a digital platform for informal businesses in India. It allows users to create digital promise notes recording business commitments between two parties, maintain a digital record of bills and transactions, and discover other businesses on the platform;
• engage with us in other related ways, for example when you contact support.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact our Grievance Officer at ryaanbhushan@zaruripapers.com.

Summary of key points

What personal information do we process? When you visit, use or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use: for example your name, business and phone number, how you sign in, your promise notes and bills, and information about your device. See section 1.

Do we process any sensitive personal information? Some of the information may be considered "special" or "sensitive" in certain jurisdictions. We process financial data (the amounts in your promise notes and bills) when necessary, with your consent or as otherwise permitted by applicable law.

Do we collect any information from third parties? Yes, in limited cases. Other users give us your name and phone number when they name you in a promise note (section 12). If you sign in with Google or Apple, that service gives us your name, email address and account identifier (section 1).

How do we process your information? We process your information to provide, improve and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. See section 2.

In what situations and with which types of parties do we share personal information? With the service providers that run parts of the Services for us, and with other users as the features require (for example, the other party to a promise note). We do not sell your personal information and we do not show advertising. See section 3.

How do we keep your information safe? We have organisational and technical processes and procedures in place to protect your personal information. No electronic transmission or storage can be guaranteed 100% secure. See section 7.

What are your rights? Under India's Digital Personal Data Protection Act, 2023, you have rights over your personal information, including to access, correct and erase it. See section 9.

How do you exercise your rights? In the App (for example, edit your profile, change your notification choices or delete your account), or by contacting our Grievance Officer. See sections 9, 11 and 17.

Table of contents

1. What information do we collect?
2. How do we process your information?
3. When and with whom do we share your personal information?
4. Do we use cookies and other tracking technologies?
5. Do we offer artificial intelligence-based products?
6. How long do we keep your information?
7. How do we keep your information safe?
8. Do we collect information from minors?
9. What are your privacy rights?
10. Controls for Do-Not-Track features
11. How can you raise a grievance about your data?
12. What happens if someone adds you to a promise note?
13. Where is your information stored?
14. Do you use advertising trackers?
15. Do we make updates to this notice?
16. How can you contact us about this notice?
17. How can you review, update or delete the data we collect from you?

1. What information do we collect?

Personal information you give us

We collect personal information that you give us when you register on the Services, use the Services, or contact us. It may include:

• Name and business details: your name, business name, trade, business description, the year you started, city, business address or location, and profile photo.
• Phone number: your mobile number. Every account has one verified mobile number. It identifies your business, and other users see it only if they are your connections or the other party to one of your promise notes.
• Sign-in details:
• your mobile number, confirmed with a one-time code that we send on WhatsApp;
• if you sign in with Google or Apple, the name, email address and account identifier that Google or Apple gives us (with Apple you can choose to hide your email address; we then receive an Apple relay address);
• if you sign in with an email code, or add an email address, that email address.

We never receive your Google or Apple password.

• Promise note details: the parties involved, commitment terms, amounts and dates, changes both parties agreed to, status history, and evidence or attachments you add.
• Chat messages: the messages you exchange with your connections in the App.
• Bill and transaction records: including uploaded images of bills and the details extracted from them.
• Details of other people: the name and phone number of a person you name in a promise note or invite to Zaruri Papers (see section 12).
• Your choices: your language, your notification settings, and whether you agreed to receive WhatsApp notifications (with the date and the version of the consent text you agreed to).
• Support requests: what you tell us when you contact us.

Sensitive information. When necessary, with your consent or as otherwise permitted by applicable law, we process financial data: the amounts and transactions you record.

Information from your device, with your permission

• Location: precise or approximate location from your device, used to set your business location and show businesses near you. You can turn this off in your phone's settings and set your location by hand.
• Camera and photos: to take or choose bill photos and your profile photo. We receive only the photos you choose.
• Notifications: to send push notifications about your account and promise notes. You can turn them off in your phone's settings.

We do not ask for access to your SMS messages, call logs or microphone, and we do not read your phone's contact list. If you choose a person with your phone's contact picker, we receive only the name and number you choose.

Information collected automatically

• Log and usage data: IP address, the requests your App makes to our servers, dates and times, and errors.
• Device data: device model, manufacturer, operating system, app version, language, and a device token used to send you push notifications.
• Crash reports: when the App crashes, information about the device and the App's state at that moment (through Firebase Crashlytics), so that we can fix the error.
• Location data: as described above, only if you allow it.
• ZP Score data: a score we calculate about your business based on your activity on the platform, including completed promise notes, billing records and confirmed business connections.
• Message records: for each message we send you (push notification, WhatsApp or email), what was sent, when, on which channel, and whether it was delivered.

2. How do we process your information?

We process your information:

• to create your account and sign you in, including sending sign-in codes on WhatsApp or by email;
• to provide the Services: record promise notes and bills, read bill photos (section 5), show businesses near you, and calculate the ZP Score;
• to enable communication between users, such as chat with your connections;
• to send you notifications (see below);
• to respond to your questions and offer support;
• to send administrative and security information;
• to request feedback;
• to protect our Services, including fraud monitoring and prevention, and to limit repeated sign-in attempts;
• to evaluate and improve our Services and identify usage trends, including fixing crashes; and
• to comply with legal obligations.

Messages we send you

• In the App and by push notification: updates about your promise notes, bills, connections and account. Every notification is also kept in the App's notification list.
• On WhatsApp (Meta's WhatsApp, sent through our provider MSG91):
• your sign-in codes;
• a small number of important updates (for example, a promise note due tomorrow or overdue), only if you have turned WhatsApp notifications on.

WhatsApp notifications are off until you agree to them. You can turn them off at any time in the App's settings or by replying STOP. We do not send chat messages on WhatsApp.

• By email (sent through our provider Resend), if you have added an email address: sign-in codes, security notices, and summaries of your records. You can turn summaries off in the App; security notices cannot be turned off.
• No SMS: we do not send SMS messages.
• Invitations: if you invite someone who is not on Zaruri Papers, the App opens WhatsApp on your phone with a message for you to send. We do not send invitations ourselves.

3. When and with whom do we share your personal information?

We do not sell your personal information. We share it only as described below.

Service providers

These providers process personal information for us, only to provide their service to us:

The categories of these providers are cloud computing services, data storage service providers, website and application hosting service providers, communication tools and AI platforms.

Other users

• The other party to a promise note sees your name, business name and phone number, and the note's details, changes and attachments.
• Your connections see your phone number and the chat messages you exchange with them.
• Signed-in users of the App can find your business profile in the in-app directory, for example your business name, trade, city, profile photo and ZP Score, but not your phone number.
• No public web pages: there is no public web page for your profile or your promise notes. When you share your ZP card or a promise note PDF, you choose whom to send it to. The link in it opens the App, and only the parties to a promise note can open that note.

Other situations

• Business transfers: we may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of our business to another company.
• Legal obligations: we may disclose information where the law requires it, for example in response to a valid order of a court or government authority, or to protect the rights and safety of our users and the Services.
• Google Maps Platform: when you use location features, we may store (cache) location results from the Google Maps Platform APIs. You can ask us to remove them by contacting us.

4. Do we use cookies and other tracking technologies?

We use only the technologies the Services need to work:

• secure storage on your phone that keeps you signed in;
• crash reporting (Firebase Crashlytics), which helps us find and fix errors.

We do not use advertising trackers, and we do not allow third parties to use tracking technologies on our Services for advertising (section 14). You can refuse or delete cookies in your browser settings.

5. Do we offer artificial intelligence-based products?

Yes. When you add a bill photo, we send the image to Google's Gemini API, which reads the text so that the App can fill in the bill details for you to check and correct. Google processes the image for us under its terms for API customers. We handle the results under this Privacy Notice.

6. How long do we keep your information?

When we no longer need information, we delete or anonymise it.

7. How do we keep your information safe?

We have reasonable technical and organisational measures in place to protect your personal information, including:

• encrypted connections between the App and our servers;
• sign-in tokens kept in your phone's secure storage;
• private file storage, with links to files that expire;
• limits on repeated sign-in attempts;
• access to personal information limited to the people who need it to run the Services.

However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise that unauthorised third parties will never be able to defeat our security. You should also keep your phone and your accounts secure, and never share a sign-in code. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires.

8. Do we collect information from minors?

We do not knowingly collect data from users under 18 years of age. The minimum age to use the Services is 18. If we learn that we have collected personal information from someone under 18, we will delete it.

9. What are your privacy rights?

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

• obtain a summary of the personal information we hold about you and how we process it;
• correct, complete or update your personal information;
• have your personal information erased, subject to section 17;
• withdraw your consent at any time (this does not affect processing that took place before you withdrew it; if the consent is needed for the Services, we may not be able to keep providing them);
• nominate another person to exercise these rights on your behalf if you die or become unable to; and
• raise a grievance with us (section 11).

You can:

• edit your profile in the App;
• change your notification, WhatsApp and email choices in the App's settings;
• export your records as a CSV file from your profile;
• delete your account in the App (section 17); or
• contact our Grievance Officer at ryaanbhushan@zaruripapers.com.

10. Controls for Do-Not-Track features

Some browsers and phones offer a "Do Not Track" setting. There is no agreed standard for recognising and responding to these signals, so we do not currently respond to them. We do not track you across other companies' apps or websites, and we do not use your information for advertising.

11. How can you raise a grievance about your data?

If you are located in India, the Digital Personal Data Protection Act, 2023 gives you the right to raise a complaint about how we handle your personal information. You can contact our Grievance Officer, Ryaan Bhushan, at ryaanbhushan@zaruripapers.com. We will acknowledge your complaint within 24 hours and aim to resolve it within 15 days. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India.

12. What happens if someone adds you to a promise note?

Our users can create a promise note that records a commitment between them and another person. To do this, they give us that person's name and phone number. This means we may hold information about you even if you have never signed up for Zaruri Papers. We use this information only to record the promise note and to let you know that one has been created naming you: if you have an account, we notify you in the App; if you do not, the user who named you can send you an invitation from their own WhatsApp. We do not use this information for marketing. If you have been named in a promise note and you want your information removed, contact us at ryaanbhushan@zaruripapers.com and we will remove it, unless we are required to keep it as a record of a transaction that has already taken place.

13. Where is your information stored?

Your account, promise notes, bills and uploaded files are stored with our provider Supabase in Tokyo, Japan. Our application servers are run by our hosting provider, Railway. Some of the providers listed in section 3 process information in other countries, for example the United States. We transfer personal information outside India only as permitted under Indian law. By using the Services, you understand that your information is transferred to and processed in these locations.

14. Do you use advertising trackers?

We do not run advertisements, and we do not permit third parties to use tracking technologies on our Services for advertising purposes. Our use of tracking technologies is limited to what section 4 describes and to the Google Maps Platform APIs described in section 3, which we use solely to provide location-based features within the Services.

15. Do we make updates to this notice?

Yes. We will update this notice as necessary. The updated version will be indicated by a new "Last updated" date at the top. If we make material changes, we will tell you in the App, and by email if you have added an email address, before they take effect, and we will ask for your consent again where the law requires it.

16. How can you contact us about this notice?

• Grievance Officer: Ryaan Bhushan, ryaanbhushan@zaruripapers.com
• Postal address: Anuuj Techos LLP, Attn: Grievance Officer, 19 1404 Orchid Petals, Sohna Road, Gurugram, Haryana 122018, India

17. How can you review, update or delete the data we collect from you?

To review or correct your information, use your profile in the App, or contact us at ryaanbhushan@zaruripapers.com.

To delete your account, go to Profile → Delete account in the App and confirm, or send a request to ryaanbhushan@zaruripapers.com. We will act on a deletion request within 30 days, unless a longer period is permitted by applicable law.

What happens to your data when you delete your account. Deleting your account removes your profile, signs you out on all your devices, removes the sign-in methods linked to it (Google, Apple and email), and stops all messages from us. However:

• Promise notes stay for the other party. A promise note you made with another user remains available to them, unchanged and read-only, with your name and phone number as recorded on the note and a notice that your account has been deleted. This keeps the record of the commitment that you both agreed to.
• Billing records involving you may continue to exist where the other party to that transaction has a legitimate interest in keeping them as proof of a completed or ongoing commitment.
• Information we must keep by law (including under the Limitation Act, 1963, for a period of up to three years) will not be deleted until that period ends.
• Backups of our systems may keep your information for a limited period after deletion, after which it is permanently purged.