Privacy Policy

Last Updated: 15 June 2025 · Effective Date: 1 January 2025

1. Introduction & Who We Are

YuvApps ("YuvApps", "we", "our", or "us") is a technology company registered under the laws of India.

This Privacy Policy governs how we collect, process, store, share, and protect personal data obtained through:

• Our website at www.yuvapps.com (the "Website")
• Our mobile applications developed and maintained by us
• Our service engagements (app development, IT security, cyber security consulting)
• Communications with us via email, phone, WhatsApp, or social media

This Policy is in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

2. Data We Collect

2.1 Data You Provide Directly

• Contact & Identity Data: Name, email address, phone number, company name, designation
• Project Data: Details of your project requirements, briefs, documents shared with us
• Account Data: Username, password (hashed), preferences, if you create an account with us
• Communication Data: Emails, messages, call records (with your consent), and support tickets
• Survey & Feedback Data: Responses to questionnaires, reviews, or testimonials you provide

2.2 Data We Collect Automatically

• Usage Data: Pages visited, time spent, features used, click paths on our Website
• Device & Technical Data: IP address, browser type, operating system, screen resolution, device identifiers
• Location Data: Approximate geographic location derived from your IP address (city/country level only)
• Log Data: Server access logs, error logs, performance metrics
• Cookie Data: See Section 7 (Cookies) for full details

2.3 Sensitive Personal Data (SPDI)

Under the IT Rules 2011, Sensitive Personal Data includes passwords, financial information, health information, biometric data, and similar. We collect financial information (limited to what payment gateways share — see Section 6) only when necessary to process a transaction. We do not collect biometric, health, or other SPDI unless expressly required and with your explicit consent.

2.4 Data from Third Parties

We may receive data about you from LinkedIn, Google (via OAuth login), or referral partners. This data is used only for the purpose for which it was shared and is handled consistently with this Policy.

3. How We Use Your Data

We use your personal data for the following purposes:

• Service Delivery: To provide, manage, and improve the services you have engaged us for
• Communication: To respond to enquiries, send project updates, and provide support
• Payment Processing: To process payments and issue GST-compliant invoices
• Marketing (with consent): To send newsletters, case studies, and promotional offers — only where you have opted in
• Legal Compliance: To fulfil obligations under Indian law, including tax records and CERT-In reporting requirements
• Security & Fraud Prevention: To detect and prevent fraudulent activity, unauthorized access, and misuse of our services
• Analytics & Improvement: To understand how our Website is used and improve user experience
• Research & Development: Aggregated, anonymized data to develop new service offerings

We will not use your data for automated decision-making that produces legal or similarly significant effects without your knowledge and consent.

4. Legal Basis for Processing

We process your personal data on the following grounds:

• Contract: Processing is necessary to perform a contract with you (e.g., delivering a mobile app project)
• Consent: You have given clear, informed consent (e.g., for marketing emails or cookie placement)
• Legal Obligation: We must comply with applicable Indian laws (e.g., maintaining financial records under the Companies Act)
• Legitimate Interest: Processing is in our legitimate business interests and does not override your rights (e.g., fraud prevention, Website analytics)

5. Sharing Your Data

We do not sell, rent, or trade your personal data. We may share it in the following limited circumstances:

• Service Providers: Trusted third-party vendors who help us deliver services (cloud hosting, email delivery, customer support tools, payment gateways). All are contractually bound to handle data securely and in accordance with this Policy.
• Legal Requirements: We will disclose data when required by law, court order, or to comply with government or regulatory authority requests (including CERT-In incident reporting obligations).
• Business Transfer: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you and continue to protect your data.
• With Your Consent: With any other party, but only with your explicit consent.

Sub-processors we currently use include: Amazon Web Services (cloud hosting), Google Analytics (website analytics), Razorpay / PayU (payment processing). This list may be updated from time to time.

6. Payment Data

All payment transactions on our Website or via our invoicing system are processed by RBI-approved payment gateway partners (Razorpay, PayU, or similar). We do not collect, store, or process credit/debit card numbers, CVV codes, or net banking credentials.

When you make a payment, you are transacting directly with the payment gateway's secure environment. The payment gateway may share with us:

• Transaction ID and status (success/failure)
• Masked card details (last 4 digits only)
• Payment amount and date
• Payer's name and email (as provided to the gateway)

This data is stored securely in our accounting system for a minimum of 8 years as required under Indian taxation laws. All payment pages use TLS 1.2+ encryption.

7. Cookies & Tracking Technologies

Our Website uses cookies and similar technologies. A cookie is a small text file stored on your device. We use the following categories:

• Strictly Necessary Cookies: Essential for the Website to function (e.g., session cookies, CSRF tokens). Cannot be disabled.
• Analytics Cookies: Google Analytics — help us understand how visitors use the site. IP anonymization is enabled. You can opt out via Google's opt-out tool.
• Preference Cookies: Remember your choices (e.g., language, cookie consent status).
• Marketing Cookies: Used to show relevant ads if you have consented. We do not run intrusive re-targeting.

On your first visit, we present a cookie consent banner. You may change your preferences at any time by clicking "Cookie Settings" in our website footer or by adjusting your browser settings. Note: blocking strictly necessary cookies may affect Website functionality.

8. Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected:

• Client project data: Duration of engagement + 5 years (for dispute resolution)
• Financial / invoice records: 8 years (as required by Indian tax law)
• Marketing consent records: Until consent is withdrawn + 2 years
• Website analytics: 14 months (Google Analytics default)
• Security logs: 90 days (operational) + 1 year (archived)
• Contact form submissions: 3 years from last communication

After the applicable retention period, we securely delete or anonymize your data.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest on our servers
• Role-based access controls — minimum privilege principle
• Multi-factor authentication for all internal systems
• Regular vulnerability assessments and penetration testing
• Security awareness training for all team members
• Incident response plan aligned to CERT-In guidelines

In the event of a personal data breach that is likely to result in a risk to your rights, we will notify you and the relevant authorities in accordance with applicable law (within 6 hours of knowledge of the breach, per CERT-In Directions 2022).

10. Your Rights

Under the Digital Personal Data Protection Act, 2023, and applicable regulations, you have the following rights:

• Right to Information: Know what data we hold about you and how it is processed
• Right to Access: Obtain a copy of your personal data
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal retention obligations)
• Right to Withdraw Consent: Withdraw consent at any time where consent was the basis for processing
• Right to Grievance Redressal: Raise a complaint with our Grievance Officer (see Section 14)
• Right to Nominate: Nominate another person to exercise your rights in the event of your death or incapacity

To exercise any of these rights, email us at [email protected]. We will respond within 30 days. No fee is charged for reasonable requests.

11. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a minor without parental consent, we will delete it promptly. If you believe we hold data about a child, contact us immediately at [email protected].

12. International Data Transfers

Your data is primarily stored on servers located in India (AWS Mumbai Region). In some cases, it may be processed by our sub-processors in other countries. We ensure all international transfers are protected by appropriate safeguards, including contractual clauses that mirror Indian data protection standards.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by:

• Posting the new Policy on this page with an updated "Last Updated" date
• Sending an email notification to registered users or active clients

We encourage you to review this Policy periodically. Your continued use of our services after changes are posted constitutes acceptance of the updated Policy.

14. Contact & Grievance Officer

For any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact:

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once constituted under the DPDP Act, 2023.