KAVACHकवच
Get Started
KAVACH Privacy Policy

Last updated: 23 December 2025

This Privacy Policy explains how KAVACH, operated by Pipe Dream eSolutions OPC Private Limited (“KAVACH”, “we”, “us”, “our”), collects, uses, shares, and protects your information when you use our websites, web apps, mobile apps, APIs, and related services (together, the “Service”).

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use KAVACH.

1. Who We Are and How to Contact Us

  • Controller / Data Fiduciary: Pipe Dream eSolutions OPC Private Limited (operating the “KAVACH” platform)
  • Contact (general privacy): support@pdesol.in
  • Contact (India DPDP grievances): support@pdesol.in

We are responsible for deciding how and why your personal data is processed in connection with the Service.

2. Scope of This Policy

This Policy applies to:

  • Users (Free, Pro, Studio) who create an account and use KAVACH.
  • Visitors to our marketing website or landing pages.
  • People who contact us (support, partnerships, legal).

It does not cover third party websites, services, or apps that we do not control, even if linked from KAVACH (e.g., Razorpay pages, external reverse image tools, social networks).

3. Information We Collect

We collect information you provide, information collected automatically, and information from third parties.

3.1 Information You Provide Directly

Account Data

  • Name
  • Email address
  • Password (stored hashed)
  • Country, time zone, language
  • Organisation name (for Studio / agency users)

Profile & Preferences

  • Optional profile photo
  • Language and notification preferences

Content You Upload

  • Files and assets: images, designs, photos, documents, audio/video, other creative works.
  • Associated metadata: titles, tags, categories, notes, links to where the work is published.

We treat uploaded Content as your confidential creative material and only process it to deliver KAVACH features (hashing, timestamping, certificates, optional monitoring).

Billing & Payment Information

  • We use Razorpay and/or app stores as payment gateways.
  • We do not store your full card or UPI details on KAVACH servers.
  • We may receive from Razorpay: masked card details (e.g., last 4 digits), card type, tokenised payment IDs, payment status, billing name, billing address, and transaction IDs.

Support & Communication

  • Emails, in app messages, or contact form submissions.
  • Attached screenshots or sample files you choose to share.

3.2 Information We Collect Automatically

Device & Log Data

  • IP address, device type, OS, browser type and version.
  • Date and time of access, pages visited, referring URLs.
  • App version, language, crash logs, and performance metrics.

Usage Data

  • Which features you use (uploads, certificate downloads, plan changes).
  • Number of files uploaded, timestamps, and event logs.
  • General interaction patterns (e.g., clicks, navigation paths), in aggregated or pseudonymised form for analytics.

We collect this mainly via Google/Firebase services and other standard analytics tools, implementing privacy respecting configurations where possible.

3.3 Cookies and Similar Technologies

We use:

  • Session cookies to keep you logged in and secure.
  • Preference cookies to remember settings (language, region).
  • Analytics cookies to understand usage and improve the Service.

For more details and choices, see our Cookie Policy.

3.4 Information from Third Parties

We may receive limited personal data from:

  • Razorpay and other payment partners: payment confirmations, partial billing info, and subscription status.
  • Email providers: delivery status, bounce reports, and spam indicators.
  • Analytics / error tracking vendors: aggregated usage and performance data.

We do not buy marketing lists or sell your personal data.

4. How We Use Your Information

We process your personal data for specific, legitimate purposes, and only when we have a legal basis to do so.

4.1 To Provide and Operate KAVACH

  • Register and manage your account.
  • Let you upload content, generate hashes and timestamps, and obtain proof certificates.
  • Show you your protected works and related metadata in your dashboard.
  • Enforce plan limits (Free, Pro, Studio) and apply quotas.

4.2 To Secure the Service

  • Authenticate logins (email based authentication only).
  • Detect and prevent fraud, misuse, or security incidents.
  • Maintain security logs and audit trails.

KAVACH runs on Google Cloud / Firebase, which provides robust infrastructure security and compliance; we configure and use it in line with our privacy and security commitments.

4.3 To Process Payments and Manage Subscriptions

  • Process subscription fees via Razorpay or app stores.
  • Manage renewals, upgrades, downgrades, cancellations, and refunds where applicable.
  • Provide invoices and transaction confirmations.

4.4 To Communicate with You

  • Transactional emails: account confirmation, security alerts, payment receipts, plan changes, important updates.
  • Support messages: replies to your requests, feedback follow up.
  • With consent or where allowed by law: feature announcements, newsletters, and offers (you can opt out anytime).

4.5 To Improve and Develop KAVACH

  • Analyse aggregated usage to understand which features are used most.
  • Diagnose technical issues, fix bugs, and improve performance.
  • Design and test new features (e.g., better certificate flows, AI assisted tools).

We try to use anonymised or aggregated data where feasible for analytics and product planning.

4.6 To Comply with Laws and Protect Rights

  • Comply with record keeping, tax, and regulatory obligations.
  • Respond to lawful requests from law enforcement or other authorities.
  • Protect the rights, property, and safety of KAVACH, our users, and others.

5. Legal Bases for Processing

Depending on your jurisdiction (e.g., GDPR/UK GDPR, DPDP India), we rely on different legal bases:

  • Performance of a contract: To provide the Service you sign up for (account, uploads, certificates, subscriptions).
  • Legitimate interests: To secure KAVACH, fight fraud, improve features, analyse usage, and communicate necessary updates—balanced against your rights and freedoms.
  • Consent: For certain activities, such as: non essential cookies, marketing communications, and optional AI features. You can withdraw consent at any time; this will not affect processing already performed.
  • Legal obligation: To comply with applicable laws (e.g., tax, accounting, law enforcement requests, DPDP obligations).

For Indian users, our role as Data Fiduciary under the DPDP Act is based on your consent and legitimate uses permitted by the Act.

6. How We Share Your Information

We do not sell your personal data. We share it only when necessary and with safeguards.

6.1 Service Providers (Processors)

We use carefully selected third party service providers to operate KAVACH, including:

  • Google Cloud / Firebase – app hosting, database, storage, authentication, logging, and analytics.
  • Razorpay – payment processing (including card/UPI/tax handling).
  • Email/SMS providers – sending transactional and optional marketing messages.
  • Analytics / error tracking vendors – performance and reliability monitoring.
  • Optional AI / reverse image providers (if/when enabled) – for value add features like monitoring and AI assistance.

These providers process data only on our instructions and under data protection agreements where required.

6.2 Business Transfers

If we are involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of the transaction, subject to applicable laws and with notice where required.

6.3 Legal and Safety

We may disclose information when we reasonably believe it is necessary to:

  • Comply with a law, regulation, legal process, or government request.
  • Enforce our Terms of Use or other agreements.
  • Protect the safety, rights, or property of KAVACH, our users, or the public.

7. International Data Transfers

Because we use global cloud infrastructure (Google/Firebase) and third party providers, your data may be processed in countries other than your own (for example, India, EU, US).

Where required (e.g., under GDPR), we implement appropriate safeguards such as:

  • Standard Contractual Clauses (SCCs) or similar mechanisms.
  • Technical measures (encryption, access controls).
  • Organisational controls and vendor due diligence.

8. Data Retention

We keep data only as long as necessary for the purposes described above, or as required by law.

In general:

  • Account & Billing Data – retained while your account is active and for a reasonable period after closure (e.g., up to 7 years in some jurisdictions for tax/audit).
  • Content & Evidence Records – retained while your account is open, unless you request deletion or law compels us to remove it. Be aware that deleting Content may irreversibly remove evidence you might need later.
  • Logs & Analytics Data – kept for shorter periods (e.g., months to a couple of years) and then anonymised or aggregated where feasible.

We periodically review retention periods to ensure we do not store personal data longer than necessary.

9. Your Rights and Choices

Your rights depend on your jurisdiction, but may include:

  • Right of access – to know whether we process your personal data and obtain a copy.
  • Right to rectification – to correct inaccurate or incomplete data.
  • Right to erasure (right to be forgotten) – to ask us to delete your personal data, subject to legal/contractual limits.
  • Right to restrict processing – in certain circumstances.
  • Right to data portability – to receive your data in a structured, commonly used format and/or transmit it to another controller.
  • Right to object – to some processing (e.g., direct marketing, certain legitimate interest uses).
  • Right to withdraw consent – at any time for processing based on consent (e.g., marketing, certain cookies, optional AI features).

To exercise these rights, contact support@pdesol.in. We may ask for verification of your identity.

9.1 Rights Under India’s DPDP Act

For users in India:

  • You have rights as a Data Principal, including access, correction, erasure (subject to legal duties), and grievance redressal.
  • You can contact our DPDP Grievance Officer via support@pdesol.in.
  • If you are unsatisfied with our response, you may escalate to the Data Protection Board of India as per the Act.

10. Security

We take security seriously and implement measures such as:

  • TLS encryption for data in transit.
  • Encryption at rest for appropriate data categories.
  • Use of secure Google Cloud / Firebase infrastructure with strong access control and logging.
  • Role based access within our team, following least privilege principles.
  • Regular backups and disaster recovery planning.

No system is perfectly secure, and we cannot guarantee absolute security. You play a key role:

  • Use strong, unique passwords for your account and email.
  • Do not share your credentials.
  • Notify us immediately if you suspect any unauthorised access.

If we become aware of a data breach affecting your personal data, we will notify you and relevant authorities where required by law.

11. Children’s Privacy

KAVACH is not intended for children under 13, or the equivalent minimum age in your jurisdiction. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data without appropriate consent, contact us and we will delete it promptly.

12. Cookies and Similar Technologies

We use cookies and similar technologies to:

  • Maintain secure sessions and log ins.
  • Remember language and layout preferences.
  • Analyse usage for improvement and troubleshooting.

You can manage cookies via your browser settings and, where available, our cookie banner. Blocking essential cookies may impact your ability to use the Service. See our Cookie Policy for more details.

13. AI and Automated Tools (If Enabled)

If and when KAVACH includes AI features (e.g., AI chat support, AI drafted certificate texts, AI assisted tagging, or reverse image based monitoring):

  • These features may process some of your Content or metadata to generate responses or suggestions.
  • We configure AI providers such that your data is not used to train public models without explicit opt in, consistent with their documented enterprise/privacy settings.
  • AI outputs are assistance, not legal advice or final decisions. You remain responsible for reviewing and deciding how to use them.

We will clearly describe each AI feature and, where required, ask for your consent.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do:

  • We will update the “Last updated” date at the top.
  • If we make material changes, we will provide additional notice (e.g., via email, in app banner, or pop up) where appropriate.

If you continue to use KAVACH after a revised Policy becomes effective, you are deemed to have accepted it.

15. Contact and Complaints

If you have questions, concerns, or complaints about this Policy or our handling of your data, you can contact us at:

  • Global privacy contact: support@pdesol.in
  • India DPDP grievances: support@pdesol.in

If you are in a jurisdiction with a data protection authority (e.g., EU/UK supervisory authority, India’s Data Protection Board), you may have the right to lodge a complaint with them as well.