Privacy & Data

Privacy Policy

Version: 1.0•Last updated: October 2026•Data Fiduciary: Shivion Solutions

1. Introduction & Data Fiduciary Overview

This Privacy Policy describes how Shivion Solutions (“Karmup”, “we”, “our”, or “us”) collects, uses, processes, stores, and protects digital personal data when you access our website at https://karmup.in or the Karmup mobile application.

Our privacy framework is structured in accordance with India's personal data framework, including the Digital Personal Data Protection (DPDP) Act and the Information Technology Act, 2000. Under this framework, Shivion Solutions acts as the Data Fiduciary determining the purpose and means of processing personal data.

2. Information We Collect

We only collect digital personal data necessary to provide our matchmaking and coordination services:

  • Identity & Profile Data: Display name, mobile phone number (verified via OTP), email address, and uploaded profile photograph.
  • Self-Declared Gender (Private): Self-declared gender (Woman, Man, Other, Prefer not to say). This is strictly private, never displayed on public user profiles, and used solely for contextual task matching.
  • Task & Acknowledgement Data: Titles, descriptions, category tags, images of items, scheduling preferences, and electronic pre-acceptance consequence acknowledgement logs ("What if I don't do this task after accepting it?"), including timestamp and policy version.
  • Location Information: Approximate device location (GPS/Wi-Fi derived) for radius matching, and specific address landmarks provided for pickup/drop tasks.
  • Communications Data: In-app chat messages, multi-person group chat conversations, offer notes, and coordination messages exchanged between users.
  • Helper Payment Records & Private Earnings Visibility: UPI ID or VPA (where configured by helpers for direct peer payment receipt). Total earnings is visible only to the helper and is labelled "based on agreed task amounts" because payment is direct between users and Karmup cannot independently verify it.
  • Strike & Moderation Records: Community warnings, no-show strike logs (which expire after 90 days), reported dispute records, and moderation review outcomes.
  • Community Feedback: Ratings, reviews, and feedback. Public helper profiles show tasks completed, tasks cancelled, and rating.
  • Technical & Log Data: IP addresses, browser types, device identifiers, app crash logs, and security audit timestamps.

3. Lawful Grounds for Processing (Consent & Legitimate Uses)

In accordance with Sections 4, 6, and 7 of the DPDP Act, we process personal data strictly under established lawful grounds:

  • Clear & Affirmative Consent (Sections 4 & 6): Prior to account onboarding, we provide an itemized, clear consent notice available in English and Eighth Schedule Indian languages (including Hindi) specifying data collected, operational purposes, and withdrawal instructions.
  • Certain Legitimate Uses (Section 7(b)): Processing personal data voluntarily provided by the Data Principal strictly necessary for fulfilling a specific peer assistance task requested by the user.
  • Specific Operational Purposes:
    • Creating and authenticating user accounts via SMS OTP and secure phone verification.
    • Matching requesters with relevant nearby helpers based on proximity, skills, and availability.
    • Facilitating secure, contextual communication via in-app chat without sharing private contact numbers.
    • Preventing fraud, spam, academic cheating, and prohibited activities.
    • Investigating community disputes and moderating reported safety incidents.
    • Complying with valid legal notices, court orders, and applicable IT Rules.

4. Location Privacy and Graduated Sharing Stages

Location data is critical for neighbourhood assistance, but privacy is strictly maintained through graduated stages:

Stage 1: Discovery & Search (Approximate Only)

During initial browsing and task matching, only your approximate neighborhood or radial distance (e.g. "400m away" or "Indiranagar") is visible. Exact street addresses, flat numbers, and pin locations are hidden.

Stage 2: Acceptance & Task Active (Exact Landmark Sharing)

Exact address details or pickup points are only shared with the specific chosen helper once a task request has been formally accepted by both parties in the product flow.

Users can revoke device location permissions at any time through their operating system settings; doing so may limit automatic proximity matching.

5. In-App Chat and Message Handling

Karmup provides in-app messaging to allow parties to coordinate task instructions safely without exposing personal phone numbers.

  • Chat messages are stored securely on our servers to enable communication history and offline message delivery.
  • Messages may be accessed and processed by authorized moderation personnel strictly for safety reviews, abuse prevention, dispute investigation, or statutory compliance.
  • Security Warning: Never share sensitive financial credentials, banking passwords, payment OTPs, debit card numbers, or unnecessary personal secrets over in-app chat.

6. Security Safeguards & Technical Measures (DPDP Sections 8(4), 8(5) & Rule 6)

Under Sections 8(4), 8(5) of the DPDP Act and Rule 6 of the DPDP Rules, 2025, Shivion Solutions implements reasonable security safeguards and technical measures to protect personal data:

  • Data Encryption: All personal data in transit is encrypted using industry-standard TLS 1.3 protocols, and resting records are protected with AES-256 encryption in secure databases.
  • Role-Based Access Controls: Administrative access to backend databases is strictly restricted to authorized personnel on a need-to-know basis with multi-factor authentication (MFA).
  • Data Processor Binding Contracts (Section 8(2) & Rule 6(1)(f)): Any third-party Data Processors engaged by Karmup (such as SMS OTP gateways or cloud infrastructure) operate solely under written data processing contracts with confidentiality and security terms equivalent to Karmup.
  • Data Accuracy Obligations (Section 8(3)): We maintain reasonable measures to ensure personal data used in matchmaking or platform interactions remains accurate, complete, and consistent.

7. Personal Data Breach Notification Protocol (DPDP Section 8(6) & Rule 7)

In compliance with Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, 2025, our structured protocol for personal data breaches entails:

  • Prompt Intimation to Data Principals: In the event of a personal data breach, Karmup will notify each affected Data Principal without undue delay, detailing the nature of the breach, affected data categories, potential consequences, and remedial measures.
  • Statutory Notice to the Board within 72 Hours: As prescribed under Rule 7 of the DPDP Rules, 2025, formal notice of a confirmed personal data breach will be submitted to the Data Protection Board of India (DPBI) within 72 hours of becoming aware of the incident.

8. Data Retention & Erasure Schedule (DPDP Section 8(7) & Rule 8)

Under Section 8(7) of the DPDP Act and Rule 8 of the DPDP Rules, 2025, personal data is retained strictly as long as necessary to satisfy the purpose for which it was processed:

  • Active Account Profile: Profile information is retained during active account tenure and purged upon verified account erasure requests.
  • No-Show Strike Records: No-show strikes expire automatically 90 days after occurrence and are purged from active calculation tables.
  • Task Acknowledgement Logs: Pre-acceptance consequence acknowledgement logs (timestamp and policy version) are retained for 180 days post task completion for audit verification.
  • Inactive Accounts (Rule 8): Accounts demonstrating zero activity or logins for 36 consecutive months are flagged with advance notice, following which associated personal data is scheduled for permanent erasure.
  • Statutory Exceptions: Records required to be maintained under applicable Indian tax, financial reporting, or IT Act intermediary compliance statutes are preserved strictly for the mandated statutory periods.

9. Protection of Children's Personal Data (DPDP Section 9 & Rules 10, 12)

In accordance with Section 9 of the DPDP Act and Rules 10 and 12 of the DPDP Rules, 2025, our platform enforces strict safeguards regarding minors:

  • Strict Age Restriction (18+ Only): Karmup is strictly intended for individuals aged 18 and older. We do not knowingly permit account creation by minors.
  • No Behavioral Tracking or Targeted Ads: Karmup does not undertake tracking, behavioral monitoring, or targeted advertising directed at children.
  • Immediate Remedial Purge: If we identify that digital personal data belonging to an individual under 18 has been collected without verifiable guardian consent, we take prompt action to terminate the account and purge the data.

10. Your Statutory Rights as a Data Principal

Under Chapter III (Sections 11 through 14) of the DPDP Act, you possess the following statutory rights regarding your personal data:

  • Right to Access & Summary (Section 11): You have the right to obtain a summary of personal data being processed by Karmup, description of processing activities, and identities of Data Processors with whom data has been shared.
  • Right to Correction, Updating & Erasure (Section 12): You have the right to correct inaccurate data, complete incomplete details, update profile fields, and request erasure of personal data that is no longer necessary.
  • Right to Nominate (Section 14 & Rule 14(4)): You have the statutory right to nominate another individual who, in the event of death or incapacity of the Data Principal, shall be authorized to exercise your data rights. Nomination requests can be submitted to support@karmup.in.
  • Right to Withdraw Consent (Section 6(4)): You may withdraw consent for data processing at any time through account controls or written communication. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.
  • Right of Grievance Redressal (Section 13): You have the right to readily accessible grievance redressal handled by our designated Data Protection & Grievance Officer within 30 days (statutory ceiling: 90 days).

11. Consent Manager Integration (DPDP Sections 6(7)-(9) & Rule 4)

Under Sections 6(7)-(9) of the DPDP Act and Rule 4 of the DPDP Rules, 2025, Data Principals may provide, manage, review, or withdraw consent through certified Consent Managers registered with the Data Protection Board of India (DPBI). As certified Consent Manager networks become interoperable, Karmup supports integration with authorized Consent Managers.

12. Cross-Border Data Transfers (DPDP Section 16 & Rule 15)

Karmup's primary servers and user databases are hosted within the territory of India. Any cross-border transmission strictly adheres to Section 16 of the DPDP Act and Central Government notifications restricting transfers to notified countries or territories.

13. Escalation to Data Protection Board of India (DPBI)

If you remain dissatisfied with the resolution of our Grievance Officer or if a grievance is not resolved within the published timeframe, you possess the statutory right under Sections 18 and 27 of the DPDP Act to file a complaint before the Data Protection Board of India (DPBI).