Privacy Policy
Disclaimer: SAMANVAY is developed and published by Vinkura. It is not an official government application and does not represent any government entity.
This Privacy Policy explains how personal data is collected, used, stored, and protected when you use the SAMANVAY Android application (the “App”), a productivity / workplace collaboration companion for authorised workplace users. We process personal data in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and applicable rules.
1. Data Fiduciary / Controller
For purposes of the DPDP Act, the Data Fiduciary for App-related processing described here is Vinkura (publisher of SAMANVAY). Contact for privacy matters:
- Email: privacy@vinkura.in
- Website: https://samanvay.vinkura.in
2. Who this App is for
SAMANVAY is intended only for authorised workplace users with provisioned accounts. It is not a public consumer app. Unauthorised use is prohibited.
3. Categories of personal data
3.1 Account & profile
- Authentication identifiers (email / ID-linked credentials via Supabase Auth)
- Profile fields such as name, role/rank, ID, unit/district, display ID (stored in Supabase, e.g.
officer_profiles) - DPDP consent timestamp recorded at login when you accept the consent checkbox
3.2 Location (optional, weather)
- Approximate device location may be requested to show local weather / situational context
- Location is used for App functionality; it is not sold or used for advertising
3.3 Notifications
- Firebase Cloud Messaging (FCM) token / device identifiers needed to deliver push alerts
- Notification permission is requested on supported Android versions
3.4 On-device credentials
- Portal login credentials you choose to save for autofill are stored encrypted on the device
- These credentials are not uploaded to Vinkura/Supabase for storage as clear text
3.5 App content & operational data (Supabase)
- Alerts, news, carousel/services configuration, and related operational content served from Supabase
- App activity events (e.g. login, portal open, alert read) for operational insights
- Account deletion requests submitted from the App
4. Purpose of processing
We process personal data only for:
- Authentication and authorising access to the App
- Delivering workplace alerts, notices, and service links
- Facilitating access to organisation web portals (including optional autofill)
- Weather / location-based helpers where you grant permission
- Security, abuse prevention, and troubleshooting
- Complying with law and organisational policy
Marketing communications are opt-in and off by default. We do not sell personal data.
5. Legal basis / consent (DPDP)
Processing for App functionality is based on your consent (recorded in-app) and/or legitimate use for employment / workplace facilitation as applicable under the DPDP Act and your organisation’s instructions. You may withdraw consent or request erasure as described below; some processing may still be required for legal or security obligations.
6. Sharing & processors
- Supabase — backend (auth, database, related APIs)
- Google Firebase / FCM — push notification delivery
- Your organisation’s administrators — operational administration of user accounts and content
We do not share personal data with third parties for advertising. Data may be disclosed if required by law or lawful authority.
7. Retention
Account and profile data are retained while you remain an authorised user and the account is active. After a verified deletion request, we erase or anonymise personal data within organisational timelines, except where retention is required by law, audit, or security.
On-device encrypted credentials remain until you clear app data or uninstall; logout ends the session but may leave local vault data until cleared per device behaviour.
8. Security
- Transit: HTTPS / TLS for network calls
- Auth: session tokens managed via Supabase Auth
- On-device: portal credentials stored with device encryption / secure storage APIs
- Access controls and role-based policies on backend tables
No method of transmission or storage is 100% secure; report suspected incidents to the contacts below.
9. Your rights
Subject to the DPDP Act and organisational process, you may request:
- Access to personal data we hold about you in the App
- Correction of inaccurate data (e.g. display ID via Profile)
- Erasure / account deletion (see Account deletion)
- Withdrawal of consent where processing is consent-based
- Grievance redressal (Section 10)
10. Grievance officer (DPDP)
Grievance Officer (DPDP): [Name / designation — TBD]
Email: grievance@vinkura.in
Privacy / deletion email: privacy@vinkura.in
Postal / office address: [Vinkura address — TBD]
You may also escalate unresolved grievances as provided under the DPDP Act and rules notified by the Government of India.
11. Children’s data
The App is not directed at children. It is for authorised adult workplace users only.
12. Changes
We may update this Policy. The “Effective date” above will change when we do. Material changes may also be notified in-app or via organisation channels.
13. Contact
- Privacy: privacy@vinkura.in
- Grievance: grievance@vinkura.in
- Support page: https://samanvay.vinkura.in/support