Privacy Policy

1. Information We Collect

To provide, maintain, and improve our services, Kabadigo collects the following categories of personal information:

1.1 Personal Identifiers & Contact Information

• Full name — to identify you, communicate effectively, and process transactions.
• Mobile number — for account registration, pickup scheduling, service updates, delivery of OTPs, and customer support.
• Email address — for sending invoices, payment confirmations, policy updates, and important notifications.

1.2 Location Data (Latitude & Longitude)

• Precise GPS location (latitude and longitude): We collect real-time geolocation data when you use our mobile app for the following purposes:
  • To enable accurate pickup address selection and validation.
  • To allow our Service Partners to navigate to your scrap location efficiently.
  • To verify serviceable areas and assign nearby collection agents.
  • To enhance fraud detection and ensure the authenticity of pickup requests.
• Background location: If you grant permission, we may collect location even when the app is in the background to track collection progress and provide real-time updates. You can disable this permission at any time via your device settings.

1.3 Address Details

• Full address (street, landmark, city, pincode): Required for scheduling pickups, dispatching Service Partners, and generating invoices/reports. Your address may be shared with collection partners solely to facilitate the service.

1.4 Images & Visual Data

• Scrap images: When you upload photos of scrap items during pickup requests, we collect those images to assess material type, estimate weight, and verify the condition of items. These images help prevent disputes and improve our valuation algorithms.
• Optional profile pictures: You may choose to upload a profile image; this is stored to personalise your account experience.
• Proof of delivery / collection images: Service Partners may capture images as confirmation of successful pickup, which may be linked to your transaction record.

1.5 Transaction & Usage Data

• Scrap type, weight, and pricing details for each transaction.
• Payment information: UPI IDs, bank account details (for payouts), or transaction references. We do not store full credit/debit card numbers; payment processing is handled by PCI-DSS compliant third-party gateways.
• Device information: IP address, device ID, operating system, app version, and crash logs to diagnose technical issues and improve performance.

2. How We Use Your Data — Storage & Analytics Purposes

Your personal data, including name, mobile number, address, latitude/longitude, and images, is stored in secure databases operated by Kabadigo or our trusted cloud service providers (AWS/GCP servers located in India). We use this data for the following legitimate business purposes:

• Service delivery & operations: To schedule pickups, assign partners, process payments, and communicate transaction status.
• Analytics & performance improvement: We aggregate and analyse location data, scrap categories, user activity, and images to identify service gaps, optimise partner routing, predict demand, and enhance user experience. Individual-level data is pseudonymised wherever possible for analytics.
• Fraud detection & safety: Analysing geolocation patterns and address history helps detect fake bookings, duplicate accounts, or misuse of referral programs.
• Legal compliance & dispute resolution: Storing images and location timestamps helps resolve disputes between users and Service Partners (e.g., regarding scrap quantity or condition).
• Personalised recommendations: Based on your past scrap types, we may suggest optimal pickup schedules or recycling tips.

Storage period: We retain your personal data for as long as your account is active or as necessary to provide you with services. Even after account deletion, certain data (transaction records, pickup images, location logs) may be retained for up to 7 years to comply with tax, legal, and audit requirements (under Indian Companies Act, GST laws, and IT Act). After the retention period, data is anonymised or securely deleted.

3. Sharing of Information with Third Parties

We do not sell your personal data to third parties for marketing purposes. However, we share your information in the following limited circumstances:

• Service Partners (scrap collectors): Your name, mobile number, address, and latitude/longitude are shared with the assigned partner to enable pickup. Images of scrap are also shared to help partners identify materials.
• Payment gateways & banks: To process payouts or collect payments, we share necessary identifiers (name, UPI ID, bank account).
• Government / law enforcement: If required by law (e.g., court order, investigation under Section 69 of IT Act), we may disclose location, images, and user details to authorities.
• Analytics & cloud infrastructure: We use third-party services (Google Analytics, Firebase, AWS) to store data and generate analytics reports. These vendors are contractually bound to maintain confidentiality and are not permitted to use your data for their own purposes.

4. Security of Your Data — Storage & Encryption

Kabadigo implements industry-standard security measures to protect your data against unauthorised access, alteration, disclosure, or destruction:

• Encryption: All personal data (including images, addresses, and location) is encrypted during transmission using TLS 1.3. At rest, sensitive fields are encrypted using AES-256.
• Access controls: Only authorised personnel and automated systems with a legitimate need can access raw location or image data. Access logs are audited regularly.
• Regular backups: Databases are backed up to geographically redundant storage to prevent data loss. Backups are also encrypted.
• Anonymisation for analytics: For internal analytics and machine learning, we strip direct identifiers (name, mobile number) and replace them with unique tokens. Raw location precision may be reduced to city-level.

While we strive to protect your data, no transmission over the internet is 100% secure. You share data at your own risk. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities as required under Indian law.

5. Your Rights & Choices

Under the Indian Digital Personal Data Protection Act (DPDPA) 2023 (once fully effective) and existing IT Rules, you have the following rights:

• Access & correction: You can view and edit most of your personal information (name, address, mobile number) via the app settings. For other data, contact our Grievance Officer.
• Data portability: You may request a machine-readable copy of your transaction history and stored personal data.
• Withdraw consent: You may withdraw consent for specific processing (e.g., location collection for analytics) by disabling location permissions in your device settings. However, withdrawing essential permissions may affect service functionality (e.g., pickup scheduling).
• Request deletion: You may request deletion of your account and associated personal data. After deletion, we will retain only the minimum data required for legal or fraud prevention purposes.
• Opt-out of analytics: You can opt out of non-essential analytics tracking via the app's privacy settings. Essential analytics for service integrity cannot be disabled.

To exercise these rights, email us at privacy@kabadigo.com. We will respond within 30 days.

6. Specific Disclosure: Latitude & Longitude Collection for Analytics

As explicitly stated, Kabadigo collects precise latitude and longitude of your device at the time of booking, during pickup, and (with permission) for brief periods while the app is in background. This geolocation data is stored in our databases and used for:

• Real-time navigation and ETAs for Service Partners.
• Geographic analytics: We analyse aggregated location data to understand scrap generation hotspots, improve service coverage in underserved areas, and optimise collection routes. Individual user coordinates are anonymised before being used in such analytics dashboards.
• Fraud prevention: Detecting impossible location jumps or fake GPS usage.

You can revoke location permissions at any time from your phone settings. However, without access to your approximate or precise location, we may not be able to assign a Service Partner or complete a pickup booking.

7. Image Processing & Analytics

The images you upload (scrap photos) are stored in our secure data storage and may be analysed using automated computer vision algorithms for the following analytical purposes:

• Automated scrap categorisation: To improve our price estimation engine and reduce manual errors.
• Quality assessment: To detect contamination or prohibited items before pickup.
• Training datasets: De-identified images may be used to train machine learning models that benefit all users. You can opt out of image-based model training by contacting support, though this will not affect service delivery.

Images are retained according to our data retention schedule (up to 7 years for transaction records). You may request deletion of specific images (subject to legal hold).

8. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a user under 18 has provided us with personal data (including name, address, or location), we will delete the information immediately. Parents or guardians who believe a minor has used our platform should contact us.

9. Cookies & Tracking on Website

When you visit our website, we may use cookies and similar technologies to analyse site usage and remember preferences. These are not used to collect precise location (lat/long) unless you explicitly interact with geolocation features. You may disable cookies via browser settings, though some website features may not work optimally.

10. Data Storage Location & International Transfers

Your personal data (including name, mobile number, address, lat/long, images) is primarily stored on servers located in India. In limited cases (e.g., using analytics tools provided by global vendors), anonymised or pseudonymised data may be processed outside India under strict contractual safeguards that meet Indian legal standards. We ensure that any cross-border data transfer complies with applicable data protection laws.

11. Updates & Modifications to This Privacy Policy

We may revise this Privacy Policy from time to time to reflect changes in our data practices, technology, or legal obligations. If we make material changes (e.g., new categories of data collection, expanded sharing), we will notify you via email or in-app notification at least 15 days before the changes become effective. Your continued use of Kabadigo after the effective date constitutes acceptance of the updated policy. The "Last reviewed" date at the top of this document indicates when the policy was last updated.

12. Grievance Officer & Contact Information

If you have any concerns regarding your privacy, data collection (latitude, longitude, address, images, name, mobile number), or wish to report a potential data breach, please contact our Grievance Officer designated under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

13. Your Consent

By using Kabadigo’s platform, you explicitly consent to the collection, storage, and processing of your personal data — including name, mobile number, precise address, latitude/longitude coordinates, and scrap images — for the purposes described in this Privacy Policy, including analytics and service improvement. You also consent to the retention of such data for the periods stated herein. You may withdraw consent as described in Section 5, but withdrawal may impact service availability.