Privacy Policy

Last updated: 25 October 2026 · Version 1.0 · Edition: DigiSurvey Enterprise (Mumbai)

1. Who we are

This Privacy Policy describes how Digitaliiisla Technologies Private Limited (“Digitaliiisla”, “we”, “us”) collects, uses, discloses, retains and protects personal data in connection with the DigiSurvey enterprise service made available at digisurvey.co.in (the “Service”). This policy is our notice under section 5 of the Digital Personal Data Protection Act, 2023 (“DPDPA”) and is read with the Information Technology Act 2000 and the rules thereunder.

2. What makes this environment different

The DigiSurvey enterprise environment is a separate Supabase project provisioned in the Mumbai (ap-south-1) region. It has:

• Its own PostgreSQL database, its own authentication tenancy, its own object storage buckets, and its own row-level security policies.
• Zero shared rows with the legacy digitaliiisla.co.in Supabase project (which continues to run in its original Singapore region for pre-existing users).
• Hostname-based routing at the Cloudflare Worker and application layer, so a request to digisurvey.co.in can only ever reach the Mumbai database.
• No cross-project read, no cross-project write, no cross-project migration path. If a user wants to port their work from one environment to the other, they must do so expressly through a documented export / import.

This isolation is a deliberate commercial choice, not a side effect: enterprise customers get a clean, India-resident environment with no pre-existing surveyor data in it.

3. The personal data we collect

3.1 Enterprise account data

• Work email, full name, mobile number, hashed password (bcrypt / argon2 — never stored in plain text).
• Organisation name, insurer company registration or IRDAI licence number (where the user is a Surveyor & Loss Assessor), designation, GSTIN, PAN of the organisation.
• Billing contact, postal address, bank details for enterprise invoicing.

3.2 Survey & claim data uploaded by the user

• Insured’s name, contact, policy number, claim number, vehicle registration, chassis / engine, odometer, place of loss, date of loss.
• Photographs captured on-site, which may contain number plates, VIN plates, damage close-ups, odometer face, driving licence and RC images, cheque leaves and policy copies.
• Optional video recordings of live inspection calls (initiated by the surveyor; not retained by default once the report is finalised).
• GPS co-ordinates and camera timestamp embedded in photo EXIF when the device grants location permission.
• Assessment figures, parts list, repair / replace recommendation, salvage value, and the final signed PDF.

3.3 Transactional & usage data

• Enterprise invoice metadata (invoice ID, amount, GST breakdown). Payments for enterprise plans are reconciled off-platform; we do not store full card or UPI credentials.
• Access logs: IP address, user-agent, time of request, URL path, HTTP status — used for abuse prevention, forensic investigation and DPDPA breach forensics.
• Device install identifier (no advertising ID is collected).

3.4 What we never collect

• Credit / debit card numbers, CVV, UPI PIN, net-banking passwords.
• Biometric templates for identity (we store the photograph you upload; we do not generate a face-print from it).
• Marketing cookies, advertising identifiers, social-media “like” pixels, or third-party ad-network trackers.
• Personal data of minors — the Service is strictly for adult professional users.

4. Legal basis under the DPDPA 2023

• Consent (s. 6) — given at sign-up through a clear, unbundled checkbox. Covers enterprise profile data and any optional analytics.
• Performance of contract (s. 7(b)) — the enterprise Service cannot run without processing survey data uploaded by the user.
• Professional engagement (s. 7(i)) — where an insurer appoints the surveyor and the processing is incidental to that appointment.
• Compliance with law (s. 7(d)) — IRDAI retention, income-tax audit retention, lawful court or regulator orders.

5. Where your data lives

Primary processing of your personal data happens in India. We do not transfer survey data outside India for commercial profiling or model-training purposes.

6. Retention

• Enterprise account data — retained for the life of the engagement and for seven (7) years after the engagement ends, to meet IRDAI and income-tax requirements.
• Survey records — retained per the applicable insurer DPA or, by default, for seven (7) years from report finalisation.
• Access logs — retained for 180 days unless frozen for an active investigation.
• Soft-deleted surveys — kept in an archive bucket for 30 days, then purged, unless legal hold applies.

7. Your rights as a Data Principal

Under the DPDPA 2023 you have the right to:

• Access the personal data we hold about you.
• Request correction, completion or updating of that data.
• Request erasure (subject to statutory retention).
• Nominate another person to exercise these rights in the event of your death or incapacity.
• Withdraw consent that was the basis of the processing, prospectively.
• Raise a grievance with our Grievance Officer and, if unresolved, approach the Data Protection Board of India.

Email grievance@digitaliiisla.co.in to exercise any of these rights. We acknowledge within 72 hours and complete within 30 days.

8. Security

• TLS 1.2+ for data in transit.
• AES-256 at rest for all database storage and object buckets.
• Row-level security on every tenant-scoped table.
• Short-lived, scoped presigned URLs for every photo / PDF read.
• Mandatory 2FA for internal admin consoles.
• Append-only audit log for every destructive action.

9. Sharing & processors

We share personal data only with: (a) the insurer that engaged the surveyor; (b) sub-processors listed in the DPA, under written contract; (c) a regulator, court or law-enforcement authority under a lawful order; (d) a successor entity in a bona-fide merger or acquisition, with equivalent-or-better protections. We do not sell personal data. We do not use survey content to train commercial AI models for third parties.

10. Children

DigiSurvey enterprise is not directed at individuals below 18 years of age. We do not knowingly process personal data of children except incidentally where a child is a nominee or beneficiary in an underlying insurance policy; in such cases we treat the data as sensitive and restrict access accordingly.

11. Changes

Material changes are posted at this URL and announced to enterprise contacts by email at least 15 days before they take effect, except where a shorter notice is required by law or by a regulator.

12. Contact