Privacy policy and your data

1.Who we are and what this covers

bluedrop.in is a care platform for water purifiers in Odisha, India. It is run by UTKAL SERVICES, Third Floor, Shop No - 302(B), Hetel Pal Heights, Shopping Arcade, Plot No - J/7, Nandan Kanan Road, Jayadev Vihar, Bhubaneswar, Khordha, Odisha 751013. In this policy “we” means that team, and “you” means anyone who uses our website, our iPhone or Android app (the customer app, or the partner app for BlueDrop Experts, Zone Managers and Promoters), or is recorded in our systems as a customer or partner.

For personal data we are the “data fiduciary” under the Digital Personal Data Protection Act, 2023 (the DPDP Act), and a “body corporate” under the Information Technology Act, 2000 and its Reasonable Security Practices Rules, 2011. We act under those laws. Links from our pages to other websites are not covered by this policy; read their policies too.

2.What we collect

We collect it from you directly, from your device automatically, from your Expert when a visit is recorded, and from Google or Apple when you sign in with them. Only what each part of the service needs:

When	What we collect
You sign in	Your name, email address and profile photo from your Google account, or the name and (possibly private-relay) email address from Sign in with Apple where it is offered. We never see your Google or Apple password.
You set up your profile	Your phone number, preferred language, notification choices, and one or more addresses with PIN code. If you tap “use my location” we also record the coordinates your device gives us.
You register a purifier	Brand, model, serial number, installation details, and a copy of the purchase invoice. Photos of the machine if you add them.
A visit happens	Who attended, when, what was done, water readings (TDS and pH), parts used, and photos. On the first scheduled visit your Expert checks the invoice and serial number and takes a photo at your home as part of that verification.
You ask for help	Complaints and service requests with your description and any photos, and any dispute you raise.
You pay	Which plan or visit you paid for, the amount, the date and the payment reference. Card, UPI, wallet and bank details go straight to our payment provider, Razorpay; we never see or store them.
We message you	Your WhatsApp number (usually your phone number) and a record of the messages we send you and whether they were delivered or answered.
You refer someone	Your referral code and the fact that a person joined or paid through it.
You work with us as a partner	Your name, phone, photo, address and zone, qualifications and vehicle type, your PAN (number and copy) and your Aadhaar (copy and number), which we need to verify who you are and to pay you lawfully. See “How long we keep it” for what happens to the Aadhaar copy.
You use the apps or website	Technical data: the device model, operating system and app version, the pages you open and how fast they load, and your approximate location from your IP address. On the apps we also keep a push-notification token for your device so we can reach it. Analytics strips ids, codes and query strings from page addresses before they are recorded.

If you give us someone else’s details (for example another person’s address for a visit, or the new owner when you transfer a machine), please make sure you are allowed to.

3.Why we use it

We process your data with your consent, which you give when you create an account and choose your settings, and for the “legitimate uses” the DPDP Act allows, such as giving you a service you asked for and meeting our legal duties. Specifically:

To run your care plan: schedule visits, send an Expert to the right address, record what was done and keep your machine’s service history.
To confirm it is really you and really your machine: the verification at the first visit, the one-time code that closes each visit, and the two-code check when a machine changes owner.
To take payment, issue receipts and keep the records the tax laws require.
To remind you: visits coming up, filters due, payment and verification notices, by WhatsApp, push notification or email according to your notification settings.
To pay our partners correctly, including tax deducted at source.
To keep the service safe: prevent fraud, resolve disputes and keep an audit trail of who changed what.
To improve it: fix errors and see which pages are slow. This uses aggregated technical data, not your records.

We do not use your data for advertising, we do not sell it, and we do not make decisions about you by computer alone that have legal effect on you. We do not send an offer or promotion on any channel you have switched off.

Only people and services that need it for the job.

Your BlueDrop Expert. Once a visit is assigned to them, the Expert sees your name, phone, address, machine and its history. You see their name and phone before they arrive.
Your Zone Manager and the State Head. They oversee visits, complaints and disputes for your zone and the platform, and can see the records they manage.
The person who referred you, if you joined through a referral link or code (a BlueDrop Expert, Zone Manager or Promoter). They see your name, phone number and email, when you signed up, and whether you have made your first payment. They do not see your address, machine or visit history.
Service providers that process data for us, under contract and only on our instructions:
- Supabase: our database, sign-in and file storage (photos, invoices, documents), hosted in Mumbai, India.
- Vercel: runs the website and the apps’ servers (in Mumbai) and delivers pages quickly, and provides privacy-friendly page-speed analytics.
- Razorpay: processes your payments and refunds. It is PCI DSS certified. It also has duties of its own under banking and anti-fraud rules and keeps payment records under its own privacy policy.
- A WhatsApp Business Solution Provider approved by Meta (ODIV Engage, engage.odivend.com), which sends our WhatsApp messages. WhatsApp (Meta) then delivers them, and Meta’s own terms and privacy policy apply to your WhatsApp account.
- Google (and Apple, where offered): sign-in. Google’s Firebase and Apple’s notification services carry push notifications to your phone if you turn them on.
- OpenStreetMap: map images load from its servers when you open a map, which can see your IP address and the area shown.
Apple and Google as app stores. If you got the app from the App Store or Google Play, the store tells us how many people installed it and gives crash reports, under its own privacy policy. We do not receive your store payment details, because plans are paid to us through Razorpay.
Authorities and courts, when the law or a valid order requires it, and professional advisers (accountants, lawyers) bound by confidentiality.

Some of these providers run global networks, so data can pass through or be processed outside India. We choose providers with appropriate security commitments and contracts, and we do not transfer data to any country the Government of India has restricted.

5.Our iPhone and Android apps: permissions

The apps ask your phone for permission before they use any of the following. You can say no, and you can change your mind at any time in your phone’s settings; the part of the service that needs it then works another way, or not at all.

Permission	What it is for	If you say no
Camera	Photographing your invoice, your machine, or a problem; and for Experts, photographing the work done.	Pick a photo from your gallery instead.
Photos and files	Choosing an existing photo or invoice to upload. We can only see the files you choose.	Take a new photo with the camera.
Location, only while the app is open	Filling in your address from where you are, so an Expert can find you. We do not track your location in the background.	Type your address and PIN code.
Notifications	Telling you about a visit, a filter that is due, a payment, or a one-time code.	You still get the same messages by WhatsApp or email, if you have those on, and in the app’s activity feed.

The apps do not read your contacts, messages, call history, microphone, or other apps.

6.WhatsApp, push notifications and email

We message you on WhatsApp only after you have given us your number and agreed to it in the app. You can say STOP in the chat, or turn WhatsApp off in your notification settings, at any time.
In your profile you choose, for each kind of message, whether you get WhatsApp, push or email. Service and security messages (a one-time code, a visit confirmation) are part of the service and are not marketing.
A message you send us on WhatsApp is also kept as part of our service record. Please do not send passwords or card details in it.

7.How we protect it

Everything travels over encrypted connections and is encrypted at rest.
Access is by role. A customer sees only their own records, an Expert only the visits assigned to them, a Zone Manager only their zone.
Staff access is limited to named people and every change is written to an audit log.
Partner identity documents sit in private storage that only authorised staff can open, and Aadhaar is handled as described below.

No system is perfectly secure. If a breach puts your personal data at risk, we will tell the Data Protection Board of India and the people affected, as the law requires.

8.How long we keep it

We keep data only as long as it is needed for the reason we collected it, then delete or anonymise it. Uninstalling the app does not delete your account or your data; see Delete your account.

Data	How long
Your profile, addresses, location and preferences	While your account is open. Deleted or anonymised within 30 days of a verified deletion request.
Machine records and service history	While your account is open. A machine’s history belongs to the machine and travels with it to its next owner, so on deletion we keep the technical record (brand, serial, what was serviced) and remove your name and details from it.
Payments, receipts, credits and invoices	As long as tax and company law require, up to 8 years. We cannot delete these on request.
Complaints, disputes and the audit log	Until the matter is closed and any legal limitation period has passed, normally up to three years.
Partner Aadhaar copy	Deleted within 7 days after we verify it. We keep only the last 4 digits of the number and irreversibly scramble the rest, so we can still tell you which Aadhaar was checked.
Partner PAN (number and copy) and payout records	While you work with us, and afterwards for as long as the income-tax rules require, up to 8 years.
Push-notification token and device details	Until you sign out, turn notifications off, or delete your account.
Message logs (what we sent you and whether it was delivered)	Up to 12 months, then deleted.
Server and security logs	A short rolling period, normally under 30 days.
Backups	Encrypted copies are overwritten on a rolling schedule, normally within 35 days. A deleted record can sit in a backup until then, and is not restored to the live service.

9.Your rights

Under the DPDP Act you can:

ask for a summary of the personal data we hold about you, what we do with it and who we share it with;
have inaccurate or incomplete data corrected or updated;
have your data erased, unless the law says we must keep it (see the table above);
withdraw a consent you gave. Withdrawing is as easy as giving it, but if the service needs that data we may no longer be able to provide it;
name another person to exercise these rights for you if you die or cannot act for yourself;
have a complaint dealt with (see “Complaints”).

To use any of them, write to hello@bluedrop.in from the email address on your account, and say what you want. We may ask a question to make sure it is you before we act. We reply within 48 hours and finish within 30 days. If we cannot do something, we tell you what and why. Most of what you can see you can also change yourself in the app under your profile.

10.Cookies and what stays on your device

We use a sign-in cookie (on the apps, the equivalent stored sign-in) that keeps you signed in and keeps your account safe, and your device’s storage for your light or dark theme and so the app opens quickly, even offline. These are essential and are not used for tracking. We do not use advertising identifiers or cross-site tracking. Page-speed analytics are cookie-less and record only aggregated, anonymised measurements.

11.Children

bluedrop.in is for adults. You must be 18 or older to hold an account. We do not knowingly collect personal data of a child. If you think we have, tell us at hello@bluedrop.in and we will delete it.

12.Changes to this policy

If we change how we use your data we will update this page and its date. For a material change we will tell you in the app or by email at least 15 days before it takes effect. The version in force is always the one on this page, and the privacy details on our App Store and Google Play listings follow it.

13.Complaints and the Grievance Officer

If you have a concern about your data, write to our Grievance Officer, Bandana Senapati, at hello@bluedrop.in. We acknowledge it within 48 hours and resolve it within 30 days.

If you are not satisfied after that, you may complain to the Data Protection Board of India. For help with a visit or plan, write to support@bluedrop.in.