Privacy Policy

1. Introduction: This Privacy Policy explains how [Legal Entity Name] ("Creveto Pro", "we", "us") collects, uses, stores, shares and protects personal data when you use the Creveto Pro platform, website and QR verification pages (the "Service"). It is published in accordance with the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 ("DPDP Act").

2. Who This Policy Covers:

• Tenants and their Authorized Users (brands and companies using Creveto Pro).
• End Users who scan a QR code generated through Creveto Pro to verify a product.
• Visitors to our website.

3. Our Role:

• For Tenant account data (names, emails, billing details), Creveto Pro is the Data Fiduciary.
• For Scan Data of End Users collected through a Tenant's QR codes, the Tenant is the Data Fiduciary and Creveto Pro acts as Data Processor. Creveto Pro also independently processes limited Scan Data to prevent fraud, secure the Service and detect counterfeit or cloned QR codes, for which Creveto Pro acts as Data Fiduciary.

4. Data We Collect:

• From Tenants: name, business name, email, phone, GSTIN, billing address, login credentials (hashed), uploaded product data, batch numbers, brand assets, invoices and usage logs.
• From End Users when a QR is scanned: Scan time and the QR/product identifier scanned; IP address, browser, device and operating system type; Approximate location derived from IP; Precise location (GPS) only if you grant permission through your browser or device; Any information you voluntarily submit (e.g., complaint form, feedback, contact details).
• Automatically: cookies, log files, error and performance data.

We do not knowingly collect sensitive personal data such as health, financial account or biometric data from End Users, and we ask Tenants not to configure the Service to do so.

5. Purposes of Processing: To provide QR generation, product authentication and inventory features; show Tenants scan analytics (total, unique, repeated, high-risk and fake scans) and aggregated location insights; detect cloning, counterfeiting, fraud and abuse; manage accounts, billing, GST invoicing and support; maintain security, backups and platform performance; comply with legal obligations and enforce our Terms; and improve the Service using anonymised or aggregated data.

6. Legal Basis and Consent: We process personal data on the basis of consent (e.g., GPS permission, cookies, marketing), performance of the contract with Tenants, compliance with legal obligations, and legitimate uses permitted by the DPDP Act (such as fraud prevention). Consent may be withdrawn at any time through browser/device settings or by writing to us; withdrawal does not affect processing done before withdrawal.

7. Sharing of Data: We do not sell personal data. We may share data with: The relevant Tenant (for scan analytics of their own products); Service providers / sub-processors (cloud hosting and storage e.g. AWS, Cloudinary, SMS, WhatsApp, email providers, payment gateways, analytics and mapping services) under confidentiality obligations; Authorities and courts where required by law; and Successors in a merger, acquisition or restructuring.

8. Cross-Border Transfers: Data may be processed on servers located outside India only to the extent permitted by the DPDP Act and applicable government notifications, with reasonable safeguards.

9. Retention Schedule:

10. Security & Data Breach: We use encryption in transit, hashed passwords, role-based access, strict tenant data isolation, access logging and regular backups. In case of a personal data breach, we will notify affected Tenants and the Data Protection Board of India in the manner prescribed by law.

11. Your Rights & Children: Subject to the DPDP Act, you may request a summary of your data, correction, erasure, withdraw consent, or nominate another person. The Service is not directed to children under 18.

12. Grievance Officer & Governing Law:
Name: [Name] | Email: grievance@creveto.in | Address: [Address, Raipur, Chhattisgarh].
Acknowledgement within 48 hours; resolution within 15 days. Governed by the laws of India, with exclusive jurisdiction of courts at Raipur, Chhattisgarh.