Privacy Policy & Notice

1. Introduction & Data Fiduciary Overview

PushPostVault (“ByteVault”, “we”, “our”, or “us”) respects your privacy and is dedicated to protecting your personal data. This Privacy Policy acts as our statutory Privacy Notice pursuant to Section 5 of India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

This notice outlines what personal data we collect, why we collect it, how long we retain it, who we share it with, and your statutory rights regarding your information.

2. Personal Data We Collect

We only collect personal data necessary to provide and secure our cloud storage and high-speed file transfer services:

• Account & Profile Data: First name, last name, and email address when you register.
• Authentication & Security: Hashed passwords (via bcrypt), two-factor authentication (TOTP) configurations, and active session tokens.
• Uploaded Files & Storage Data: Names of uploaded files, MIME types, file sizes, folder structures, and storage keys.
• Device & Telemetry Data: IP addresses, browser user-agent, device identifiers, and Firebase Cloud Messaging (FCM) tokens for web notifications.
• Billing & Transaction Identifiers: Razorpay order IDs, subscription IDs, and payment verification signatures. We never store credit/debit card numbers or CVVs on our servers.

3. Purpose of Processing & Lawful Basis

We process your personal data solely for specific, legitimate purposes based on your explicit consent:

• Service Delivery: Uploading, storing, encrypting, and transferring files at your direction.
• Account Management: Authentication, multi-factor verification, and password resets.
• Billing & Subscriptions: Provisioning storage quotas (5GB Free tier or upgraded tiers) and processing renewals via Razorpay.
• Security & Abuse Prevention: Rate limiting, bot mitigation, egress bandwidth tracking, and ensuring system vitals stability.
• Statutory Compliance: Maintaining cybersecurity incident logs and consent records as required by CERT-In and Indian law.

4. Third-Party Data Processors

We do not sell, rent, or trade your personal data. We engage contracted third-party processors under strict security standards:

5. Data Retention & “Delete When Done”

In alignment with the DPDP principle of storage limitation (“Delete when done”), we only retain personal data as long as your account remains active or as required by law.

You can permanently erase your account at any time via Settings > Data & Privacy. Account deletion immediately cascades: your database records are removed, stored files are permanently deleted from Cloudflare R2 storage, active sessions are invalidated, and recurring subscriptions are cancelled.

Note: System security logs and audit trails are retained for a minimum of 1 year in accordance with CERT-In directions and the DPDP Rules 2025.

6. Your Rights Under the DPDP Act, 2023

You have the following enforceable statutory rights:

• Right to Access / Summary: You can request a summary of the personal data we hold and export your data in structured JSON format via Settings.
• Right to Correction & Updating: You can edit your profile information in Settings at any time.
• Right to Erasure: You can permanently delete your account and all associated cloud files.
• Right to Withdraw Consent: You can withdraw optional consents (e.g., marketing communications, optional telemetry) without affecting core service access.
• Right to Nominate: You have the right to nominate another individual who, in the event of death or incapacity, may exercise your data rights.
• Right to Grievance Redressal: You can submit a complaint to our Grievance Officer and receive acknowledgement within 48 hours.

7. Children's Data (Under 18)

PushPostVault is intended solely for users aged 18 and older. We do not knowingly collect personal data from minors. During account registration, users must confirm that they are at least 18 years of age. If we learn that personal data of an individual under 18 has been collected without verifiable parental consent, we will promptly purge the data and terminate the account.

8. Grievance Officer & Dispute Redressal

In compliance with Section 8(9) of the DPDP Act, 2023 and Rule 5(9) of the IT Rules, 2011, you may direct any privacy questions, rights requests, or data grievances to our designated Grievance Officer: