Privacy Policy

Last updated: October 6, 2026

1. Introduction

ProWala ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what data we collect, how we use it, and your rights under the Digital Personal Data Protection Act (DPDP Act), 2023 and other applicable laws.

2. Data Controller

3. Data We Collect

4. How We Use Your Data

• Account & Authentication: Create and manage your account via Auth0.
• Identity Verification: Review Aadhaar BGV documents and profile photos to verify Professional identity during onboarding.
• On-site Visit Safety: Display verified contact details and enable in-chat arrival photos so Customers and Professionals can make informed decisions before in-person meetings. ProWala does not perform automated face matching on these images.
• Payment Processing: Process lead purchases via Razorpay (we store only transaction IDs).
• Lead Matching: Match Customer RFQs with relevant Professionals by category and location.
• Communication: Send notifications via email, WhatsApp, and in-app messages.
• Platform Improvement: Analyze usage patterns to improve features and user experience.

5. Data Sharing

We share data only with the following third-party service providers as necessary to operate the Platform:

6. Data Retention

• Active accounts: Data retained while your account is active.
• Deleted accounts: Personal data deleted within 90 days of account deletion request. Data retained for 180 days post-deletion for law enforcement compliance (IT Act requirement).
• Financial records: Transaction records retained for 8 years (tax law requirement).
• Chat logs & chat attachments: Retained for 1 year after last activity in the relevant chat room (including arrival photos shared in chat).
• Device camera: When a Professional uses Share arrival photo, the browser or app may request camera permission. ProWala does not access your camera except when you actively initiate capture in the Platform.

7. Your Rights (DPDP Act)

As a data principal under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access: Request a copy of the personal data we hold — email privacy@prowala.in and we will respond within 30 days.
• Correction: Request correction of inaccurate or incomplete data — email privacy@prowala.in.
• Erasure: Delete your account directly from your Profile page, or email privacy@prowala.in. Data is permanently removed within 90 days (subject to legal retention obligations).
• Withdraw Consent: Withdraw consent for data processing by emailing privacy@prowala.in with subject "Withdraw Consent". Withdrawal takes effect within 7 business days. Note: withdrawing consent may require account closure as some processing is necessary to operate the Platform.
• Nomination: Nominate a person to exercise your rights in case of death or incapacity — email privacy@prowala.in.

8. Security Measures

• Transport security: All data transmitted over HTTPS / TLS 1.2+.
• Database access: Production data is hosted on Azure Database for MySQL (Flexible Server). Direct database access is limited to authorised infrastructure accounts; the database is not exposed to the public internet.
• Role-based access controls: Only authorised admin staff can access BGV documents, user profiles, and chat logs via the admin panel.
• Authentication: Managed by Auth0 with industry-standard OAuth 2.0 / OIDC security, including token-based session management.
• Document access auditing: Admin view and download of BGV identity documents is logged in our security audit trail (who accessed which document and when).
• BGV documents: Aadhaar identity proof files are stored as binary data in Tbl_BlobFile on Azure Database for MySQL. They are not application-encrypted (admins must review images/PDFs). Protection is via Azure infrastructure encryption at rest, HTTPS in transit, private network access, role-based admin permissions, and audit logging on every view/download.
• Chat attachments: Images shared in chat (including arrival photos) are stored as binary data linked to the chat message. They are visible to participants in that chat room and to authorised admin staff for dispute resolution and policy enforcement.
• Field-level encryption (profile PII): Phone number, GSTIN, company phone, and business addresses are encrypted at rest using AES-256-GCM before storage in Tbl_UserProfile (ENC:: prefix in the database). Values are decrypted only when served to authorised application layers.
• Data we do not field-encrypt: Date of birth, chat messages, chat attachment binaries, lead descriptions, and BGV file binaries are stored in plain form in the database, protected by access controls and transport security rather than column-level encryption. This is an intentional product decision — not an oversight.
• Payment data: No payment card, UPI, or bank account data is stored by ProWala — all payment data remains with Razorpay's PCI-DSS compliant infrastructure.

9. Cookies & Similar Technologies

• Authentication cookies: Required for login session management (Auth0). These are strictly necessary and cannot be disabled while using the Platform.
• Cookie preference: When you first visit, we show a banner with “Accept All” or “Essential Only”. Your choice is saved in localStorage (key: prowala_cookie_consent) and logged in our immutable consent audit table (Tbl_ConsentLog, type CookiePreference) with your IP address and timestamp. If you are not logged in, the log uses an anonymous identifier; after you sign in, we link the choice to your account.
• What we do not use: Third-party advertising, retargeting, or cross-site tracking cookies.

10. Children's Privacy

ProWala is not intended for users under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, please contact us immediately.

11. Data Breach Notification

In the event of a data breach that affects your personal data:

• We will notify affected users within 72 hours.
• We will notify the Data Protection Board of India as required by law.
• We will take immediate steps to contain and remediate the breach.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be notified via email or Platform notification. Continued use of the Platform after the effective date constitutes acceptance.

13. Contact