Privacy Policy

Instantatoz ("we", "us", "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains what information we collect, how we use it, with whom we share it, and your rights in relation to your personal data. By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

1. Data We Collect

We collect the following categories of personal data:

1.1 Identity and Contact Data

• Mobile phone number (used as primary identifier and for OTP authentication)
• Full name
• Email address (optional, for communication)
• Profile photograph

1.2 Location Data

• GPS-based real-time location (collected when the app is in use, for matching and navigation)
• Saved addresses (home, work, or job site addresses entered by the User)
• Approximate location derived from IP address

1.3 Device and Technical Data

• Device model, operating system version, and device identifiers
• App version and session data
• IP address, browser type, and access timestamps
• Firebase Cloud Messaging (FCM) tokens for push notifications

1.4 Worker-Specific Data

• Government-issued identity documents (Aadhaar card number, PAN card — subject to applicable law)
• Skill categories and self-declared experience
• Bank account or UPI details for payout purposes
• Verification status and history

1.5 Transaction and Payment Data

• Payment method type (UPI, card, net banking, wallet — not raw card numbers)
• Transaction ID, payment status, and amount
• Order history and job records

1.6 Usage Data

• In-app actions, feature interactions, and search history
• Ratings and reviews submitted
• Support queries and communications with us

2. How We Use Your Data

We use your personal data to:

• Create and manage your Account and verify your identity via OTP authentication.
• Match job requests from Users with available, verified Workers nearby using GPS location data and Google Maps APIs.
• Process payments and disburse payouts to Workers through our integrated payment gateway.
• Send notifications, alerts, and status updates via Firebase Cloud Messaging (FCM).
• Verify Worker documents and manage their verification status on the Platform.
• Resolve disputes, investigate complaints, and enforce our Terms and Conditions.
• Improve our Platform through analytics (Firebase Analytics, Crashlytics).
• Comply with legal obligations, respond to lawful requests from courts or government authorities, and prevent fraud.
• Communicate important policy changes, security updates, or service announcements.

3. Firebase Services

We use Google Firebase, a platform provided by Google LLC, for the following purposes:

• Firebase Authentication: OTP-based mobile number verification and session management.
• Cloud Firestore: Real-time database for storing user profiles, job data, and platform activity.
• Firebase Storage: Secure storage of Worker identity documents and profile photographs.
• Firebase Cloud Messaging (FCM): Push notifications for job updates, confirmations, and alerts.
• Firebase Analytics and Crashlytics: Aggregated, anonymised analytics for improving app performance and stability.

Data processed through Firebase is subject to Google's Privacy Policy (available at policies.google.com/privacy). Firebase infrastructure may process data on servers outside India. We take contractual measures to ensure appropriate data protection standards are maintained.

4. Google Maps

We use the Google Maps Platform APIs to display maps, enable location-based job matching, and provide navigation guidance to Workers. Your location data shared with Google Maps is subject to Google's Terms of Service and Privacy Policy. We use this data solely for service functionality and do not independently store location traces beyond what is required for active Jobs.

5. Payment Providers

Payments are processed through third-party payment gateways integrated with the Platform. These providers handle sensitive financial data (card numbers, bank account details) directly and are compliant with applicable Payment Card Industry Data Security Standards (PCI DSS). Instantatoz does not store raw card numbers, CVVs, or full bank account details on its servers. We store only tokenised payment references and transaction metadata necessary for order management and dispute resolution.

6. Data Sharing

We share your personal data only in the following circumstances:

• Between Users and Workers: Limited profile information (name, photo, rating, general location) is shared between matched parties to facilitate the Job.
• Service Providers: We share data with trusted third-party service providers (Firebase, Google Maps, payment gateways) who act as data processors under our instructions.
• Legal Compliance: We may disclose your data to law enforcement, courts, or regulatory authorities in response to lawful orders or to protect the legal rights of the Company.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to equivalent privacy protections.

7. Data Retention

We retain your personal data for as long as your Account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce agreements. Worker verification documents are retained for a minimum period required by Applicable Law. Upon account deletion, we will delete or anonymise personal data within a reasonable period, except where retention is required by law (e.g., financial records, tax records under the Income Tax Act, 1961).

8. Your Rights

Subject to Applicable Law, including the DPDP Act, you have the following rights:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data, subject to our legal retention obligations.
• Right to Grievance Redressal: File a complaint with our Grievance Officer (see Grievance Redressal Policy).
• Right to Consent Withdrawal: Withdraw consent for processing where consent is the legal basis. This may affect your ability to use the Platform.

To exercise these rights, write to us at support@instantatoz.online. We will respond within 30 days.

9. Account and Data Deletion Requests

You may request deletion of your Account and associated personal data by contacting us at support@instantatoz.online with the subject line "Data Deletion Request". We will process your request within 30 days of receipt, subject to legal retention requirements. Please note that deletion of your Account may render ongoing disputes or pending transactions irresolvable, for which the Company shall bear no liability.

10. Data Security

We implement commercially reasonable technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit (TLS/HTTPS), Firebase security rules, access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure. You are responsible for maintaining the security of your Account credentials and OTPs.

11. Governing Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000, the IT (Amendment) Act, 2008, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act) to the extent it is notified and applicable. Any disputes shall be subject to the exclusive jurisdiction of courts in Bengaluru, Karnataka.

12. Contact and Grievance Officer

For privacy-related queries, complaints, or requests, please contact: