Privacy Policy

1. Data Fiduciary & Contact Details

1.1 Data Fiduciary Information

• Entity Name: SETUP SUPER NETWORK PRIVATE LIMITED
• Registered Address: 89 Narayanan Assan Road, Chalikkavattom, Ponnurunni, Vyttila, Kochi, Kerala - 680028, India.
• Corporate Website: https://setupsupernetwork.com

1.2 Dedicated Contact Channels

• Data Privacy & Subject Rights Requests: privacy@setupsupernetwork.com
• General Platform Support & Inquiries: info@setupsupernetwork.com
• Identity & Account Management: superid@setupsupernetwork.com
• Customer Support Line: +91 8129952899

1.3 Grievance Officer

In accordance with the Information Technology Act, 2000, and the DPDP Act, 2023, the details of our designated Grievance Officer for handling data protection complaints and privacy concerns are:

• Attn: Grievance Officer
• Entity: Setup Super Network Private Limited
• Address: 89 Narayanan Assan Road, Chalikkavattom, Ponnurunni, Vyttila, Kochi, Kerala - 680028, India
• Email: privacy@setupsupernetwork.com
• Phone: +91 8129952899

2. User Categories & Account Architecture

Setup operates on a Unified Account Model. A single user profile can seamlessly activate consumer, creator, or merchant features across the ecosystem.

3. Information We Collect

We collect personal data directly from you, automatically through your device interactions, and from verified compliance partners.

3.1 Personal Data Provided Directly by You

• Account Registration: Full Name, Email Address, Phone Number (for OTP verification), Date of Birth, Preferred Username/Handle, Profile Picture, and Primary Address.
• Know Your Customer (KYC) Data: Permanent Account Number (PAN), Aadhaar details (verified via DigiLocker / Officially Valid Documents), and Liveness/Selfie verification for financial services.
• Merchant & Business Verification Data: Goods and Services Tax Identification Number (GSTIN), Business Registration Certificates, Business Address, and Corporate Bank Account details.
• Payment & Settlement Details: Unified Payments Interface (UPI) IDs, Bank Account numbers, saved card payment tokens, and public cryptographic/Virtual Digital Asset (VDA) wallet addresses. (Note: Setup does not store raw credit or debit card numbers; payments are processed through RBI-authorized payment aggregators).
• User-Generated Content (UGC): Text posts, uploaded photos, videos, audio messages, product listings, reviews, comments, and direct chat interactions.
• Surveys & Contests: Voluntary responses, feedback submissions, and contest entry details.

3.2 Information Collected Automatically

• Technical & Device Information: IP Address, Device ID / IMEI, Operating System version, device model, mobile network provider, browser type, and system timestamps.
• Usage & Behavioral Telemetry: App navigation paths, features used, pages viewed, clicks, duration of activity, and performance crash logs.
• Cookies & Identifier Technologies: Session tokens, local storage objects, and analytics tags.

4. Device Permissions & How We Collect Data

When using our mobile application, specific runtime permissions are requested only when required to execute corresponding features:

• Camera: Used for KYC selfie verification, scanning QR codes for wallet payments, taking product photos for Super Store, and media uploads.
• Microphone: Used for voice input commands within Oru Setup AI and sending audio messages.
• Location: Used to present localized deals on Super Store, fulfill regional delivery constraints, and detect fraudulent or unauthorized account access.
• Gallery / Media Storage: Required to upload profile avatars, social media attachments, and seller inventory images.
• Contacts (Optional): Requested strictly upon explicit opt-in to help you locate existing friends or contacts on the Setup network.

5. Purposes & Legal Basis for Processing Personal Data

We process your personal data for clear, specific, and lawful purposes:

1. Account Creation & Authentication: Verifying your identity via phone/email OTP and managing your unified profile.
2. Financial Services & Wallet Management: Facilitating INR transactions, cryptographic/VDA transfers, UP Token reward conversions, and Super Breaks shared funds in compliance with PMLA, FIU-IND, and RBI guidelines.
3. E-Commerce & Order Fulfillment: Processing store orders, facilitating merchant sales, facilitating logistics delivery, and resolving consumer disputes.
4. Oru Setup AI Interactions: Delivering automated conversational responses, personalized app navigation assistance, and contextual recommendations.
5. Platform Security & Fraud Prevention: Detecting multi-account abuse, malicious activity, automated bot usage, and illegal transactions.
6. Regulatory & Statutory Compliance: Fulfilling tax obligations (TDS reporting), responding to lawful government mandates, and maintaining required audit trails under Indian law.

6. Data Sharing & Third-Party Processors

Setup shares personal data only with trusted third-party service providers bound by formal Data Processing Agreements (DPAs) that enforce strict privacy and security standards.

• Cloud Infrastructure Providers: Primary databases and servers are hosted locally in India on Amazon Web Services (AWS - Mumbai region) and Google Cloud Platform (GCP - Delhi region).
• Payment Aggregators: RBI-authorized payment gateways (such as Cashfree and Razorpay) process all INR transactions under PCI-DSS compliant tokenization frameworks.
• Identity & KYC Verification Vendors: Digitized onboarding partners and government-authorized repositories (e.g., DigiLocker) process identity documents for legal verification.
• Logistics & Delivery Partners: Merchants and independent courier providers receive delivery addresses and contact information exclusively to fulfill physical store orders. Map services (e.g., Google Maps API) assist in address validation.
• Messaging & Communication Gateways: Authorized SMS and messaging providers (such as Twilio, Kaleyra, and WhatsApp Business API) process phone numbers strictly to dispatch transactional notifications and 2FA authentication codes.
• Enterprise AI Infrastructure Providers: Strategic AI infrastructure processors (such as OpenAI Enterprise and Google Cloud Vertex AI) execute session prompts under zero-data-retention and non-training contractual terms.

7. Cookies & Analytical Technologies

Setup utilizes functional cookies, local browser storage, and performance tools (including Google Analytics, Firebase, and Mixpanel) to improve platform stability, user experience, and navigational flows.

• Essential Cookies: Necessary for core platform operation, security authentication, and session persistence. These execute automatically.
• Analytical Cookies: Used to evaluate platform interaction metrics and crash reports. These are deployed subject to your consent via our DPDP-compliant cookie banner.
• Third-Party Ad Tracking: Setup does not integrate third-party ad tracking pixels (such as Meta Pixel) for third-party targeted behavioral advertising.

8. Web3 & Blockchain Technology Disclosures

Setup operates as a Web3-enabled ecosystem. You acknowledge the following technological characteristics regarding public blockchain technology:

• Immutable Distributed Ledgers: Transactions involving cryptographic tokens, UP Token conversions, Setup Coin swaps, or public VDA ledger records are permanently recorded on public decentralized blockchains (such as the Polygon network). Due to the immutable nature of blockchain technology, data written to on-chain ledgers cannot be modified, overwritten, or erased.
• Off-Chain Personal Identifiers: Setup mitigates privacy risks by keeping all personally identifiable information (PII)—including real names, KYC records, email addresses, and phone numbers—strictly off-chain in deletable databases. Public blockchain entries are limited exclusively to anonymous public wallet addresses and transaction hashes.

9. Artificial Intelligence (Oru Setup AI)

Our conversational AI assistant, Oru Setup AI, processes user inputs to provide context-aware responses and platform assistance.

• Data Processed: Text prompts, voice recordings, chat history, uploaded document/image inputs, and contextual app activity.
• Model Training & Fine-Tuning: User interaction data used for training or fine-tuning Setup's internal proprietary AI models is strictly anonymized, de-identified, and unlinked from user identity records prior to processing. You may opt out of AI model training data usage at any time through your account settings.
• Third-Party AI Endpoint Safeguards: Prompts routed through third-party enterprise LLM providers (e.g., OpenAI Enterprise, Google Cloud Vertex AI) are protected under enterprise agreements prohibiting third parties from retaining or training on your data.
• Automated Decision-Making Oversight: Automated risk scoring models flag suspicious financial or account activity for human compliance officer review. Oru Setup AI does not execute legally binding or financial determinations without manual oversight or explicit confirmation.

10. Shared Funds & Joint Accounts (Super Breaks)

The Super Breaks feature enables couples, families, or group members to manage shared relationship funds.

• Mutual Consent Requirement: Linking an account or financial feed with another user requires a mutual two-way invitation. Both parties must explicitly accept the shared disclosure terms before any joint financial activity, balance, or transactional data becomes accessible to either user.
• Unlinking: Either participant may decouple their profile from a joint Super Breaks account at any time, which immediately revokes joint feed updates.

11. Minor & Children's Data Protection

Setup is intended primarily for adult users. In compliance with Section 9 of the DPDP Act, 2023:

• Minors (individuals under 18 years of age) may access the Platform only with explicit, verifiable parental or legal guardian consent.
• Minors are prohibited from conducting independent KYC verification or executing standalone financial wallet features. Any minor account must be linked directly to a verified parent or legal guardian's account.

12. Data Retention & Account Lifecycle

12.1 Retention Periods

Personal data is retained for as long as your account remains active or as needed to provide you with platform services.

12.2 Statutory Retention Overrides (PMLA Compliance)

Under India's Prevention of Money Laundering Act (PMLA) and applicable financial/tax regulations, all financial transaction records, wallet activity logs, and associated KYC verification documents must be legally retained for a mandatory minimum of five (5) years following a transaction or account closure. This statutory retention requirement takes precedence over user account deletion requests for covered records.

12.3 Deactivation vs. Permanent Deletion

13. Data Security & Incident Protocols

Setup implements technical and organizational safeguards designed to protect personal data against unauthorized access, loss, alteration, or disclosure:

• Encryption Standards: Data in transit is secured using Transport Layer Security (TLS 1.3), and sensitive data at rest is protected using AES-256 bit encryption.
• Access Controls: Strict Role-Based Access Control (RBAC) protocols and Multi-Factor Authentication (MFA / OTP) govern internal system access.
• Security Audits: Regular vulnerability assessments and penetration testing are conducted on system infrastructure.
• Incident Response Framework: In the event of a verified data breach involving personal information, Setup will notify the Computer Emergency Response Team - India (CERT-In), the Data Protection Board of India, and impacted users within statutory response windows.

14. Your Data Subject Rights

Under the Digital Personal Data Protection Act, 2023, you have the following rights regarding your personal data:

1. Right to Access & Summarization: Request a summary of your personal data processed by Setup and the identity of third parties with whom it has been shared.
2. Right to Correction & Erasure: Request the correction of inaccurate or incomplete data, or the deletion of non-statutory personal data.
3. Right to Withdrawal of Consent: Withdraw your consent for non-essential processing (such as marketing communications or AI model training) at any time.
4. Right to Nominate: Nominate an individual to exercise your data protection rights in the event of death or incapacity.
5. Grievance Redressal: Submit complaints regarding data processing directly to our Grievance Officer or escalate to the Data Protection Board of India if unresolved.

To exercise any of these rights, submit a written request to privacy@setupsupernetwork.com. We will process requests within statutory response timelines.

15. Communication Preferences

• Promotional Communications: You may opt out of receiving promotional emails, marketing SMS messages, or non-essential push notifications at any time using the unsubscribe links provided in emails or via the in-app notification toggles.
• Mandatory Operational Communications: You cannot opt out of essential transactional messages, account security alerts, order updates, wallet status notifications, or legal updates while maintaining an active account.

16. Cross-Border Data Transfers

Your personal data is primary stored and processed within India. In limited instances where international processing is required—such as utilizing global enterprise AI APIs—transfers are conducted strictly under binding Data Processing Agreements ensuring equivalent protection, encryption, zero-retention mandates, and compliance with the DPDP Act.

17. Changes to This Privacy Policy

Setup reserves the right to update or modify this Privacy Policy as our platform evolves or legal requirements change. When updates are made, we will revise the "Last Updated" date at the top of this policy and provide noticeable notification within the app or via email for material changes. We encourage you to review this Privacy Policy periodically.