Privacy Policy — BTConexa

This Privacy Policy governs the collection, storage, use, and disclosure of personal information by BTConexa ("BTConexa", "we", "our", or "us") through the BTConexa mobile application and related services (collectively, the "Service").

BTConexa operates a multi-tenant Vehicle QR Code SaaS platform that enables vehicle owners to register their vehicles, subscribe to plans, and connect with potential callers through privacy-protected communication links — all powered by a secure, cloud-based backend and a mobile-first experience.

This policy is intended to comply with applicable Indian data protection laws including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023, as well as the requirements of the Google Play Developer Program Policies.

We collect information in the following categories to provide and improve the Service:

2.1 Account & Identity Information

• Mobile Number: Used as your primary identifier for OTP-based authentication.
• Name & Profile Details: Provided voluntarily during registration or profile updates.
• Email Address: Optional, used for account communication.
• MPIN: A device-level PIN you set for secure in-app access (stored in hashed form).

2.2 Vehicle & RC Information

• Vehicle Registration Number (VRN): Used to identify and link your vehicle to your account.
• RC Verification Data: When you opt to verify your vehicle's Registration Certificate (RC), we collect the RC number and query our KYC partner (Surepass) to fetch ownership details such as owner name, address, vehicle type, engine number, and chassis number. This is used solely for verification and your account safety.

2.3 QR Code & Subscription Information

• QR codes assigned to your vehicle, activation status, scan timestamps, and subscription plan details.
• Transaction history including Razorpay order IDs, payment IDs, amounts, and payment status.

2.4 Emergency Contacts

• Mobile numbers and names of emergency contacts you choose to save in the app.
• These contacts are used solely for the emergency alert feature and are never shared for marketing or external purposes.

2.5 Location Information

• We collect approximate or precise location data when you use location-based features such as finding nearby service centers or submitting a support ticket that requires location context.
• Location access requires your explicit permission through your device's permission dialog.

2.6 Technical & Device Information

• Device type, operating system version, app version, and unique device identifiers.
• IP address, timestamps, and API request logs for security and debugging.
• Crash reports and error logs to improve app stability.

2.7 Communication Data

• When a person scans your vehicle's QR code and initiates a call, we log the call metadata (caller number masked, duration, timestamp) through our IVR partner (MyOperator). The actual caller number is never shared directly with the vehicle owner.
• SMS OTPs sent to your registered mobile number for login and verification.

2.8 Support & Ticket Data

• Messages, attachments, and conversation history within the in-app support ticket system.
• Referral codes and referral-related transaction records.

We use the information collected for the following purposes:

We do not use your personal data for behavioural advertising, sale to third parties, or any purpose not listed above without your prior consent.

BTConexa does not sell your personal information. We share data only in the following limited circumstances:

4.1 Service Providers (Data Processors)

• Surepass (KYC / RC Verification): We send your RC number to Surepass to retrieve vehicle ownership data. Surepass processes this solely on our behalf under a data processing agreement.
• Razorpay (Payment Gateway): Transaction details required to create and verify orders. Razorpay is PCI-DSS compliant and processes payment data under their own privacy policy.
• AmazeSMS (SMS Gateway): Your registered mobile number is transmitted to send OTP and transactional SMS messages.
• MyOperator (IVR / Call Masking): Call metadata is processed by MyOperator to facilitate privacy-protected communication. Caller identity is masked from the vehicle owner.
• Cloud Hosting / Server Infrastructure: Data is stored on secured servers. Access is restricted to authorised personnel only.

4.2 Tenant / Business Partners

If you are a vehicle owner registered under a specific business tenant (e.g., a dealership or fleet operator), that tenant may access data related to your vehicle and subscription within their authorised scope on the platform. Personal contact information is not shared with tenants beyond what is necessary for the service.

4.3 Legal Obligations

We may disclose your information to government authorities, regulators, courts, or law enforcement agencies when required by applicable law, court order, or to protect the rights, property, or safety of BTConexa, our users, or the public.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred to the successor entity. We will notify you via in-app notice or email before such transfer takes effect.

BTConexa implements industry-standard technical and organisational security measures to protect your personal data from unauthorised access, loss, alteration, or disclosure.

• Encrypted Transmission: All API communication is carried over HTTPS/TLS.
• JWT Authentication: Mobile sessions are secured using signed JSON Web Tokens with expiry controls.
• OTP-Gated Login: Account access requires a one-time password sent to your registered mobile number, preventing unauthorised logins.
• MPIN Protection: Your in-app MPIN is stored as a secure cryptographic hash; it is never stored in plain text.
• Rate Limiting: All API endpoints are protected by configurable rate limits to prevent brute-force attacks and abuse.
• Session Timeout: Inactive sessions are automatically terminated after 30 minutes.
• Audit Trail: All critical data changes are logged with user identity and timestamp for accountability.
• Access Controls: Role-based access control (RBAC) ensures that staff and tenants can only access data within their authorised scope.

We retain personal data only for as long as necessary to fulfil the purposes described in this policy or as required by applicable law.

After the retention period expires, data is securely deleted or anonymised in accordance with our data deletion procedures.

As a user of BTConexa, you have the following rights with respect to your personal data:

• Right to Access: You may request a copy of the personal data we hold about you.
• Right to Correction: You may update or correct inaccurate information through your in-app Profile settings or by contacting us.
• Right to Deletion: You may request deletion of your account and associated personal data, subject to legal retention requirements.
• Right to Data Portability: You may request a machine-readable export of your personal data.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., RC verification, location access), you may withdraw consent at any time via app settings or by contacting us.
• Right to Object: You may object to processing based on legitimate interests in certain circumstances.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Data Protection Board of India or other relevant supervisory authority.

Account Deletion

You can request account deletion directly within the app under Settings → Delete Account or by emailing us. Upon deletion, your personal account data will be permanently removed within 30 days, except where legal retention obligations apply (e.g., payment records).

The BTConexa Service is not directed to children under the age of 18 years. We do not knowingly collect personal data from minors. Vehicle ownership and driving licences in India are restricted to individuals aged 18 and above, and our Service is designed exclusively for such individuals.

If we become aware that a child under 18 has provided us with personal information, we will promptly delete such data. If you believe a minor has registered on our platform, please contact us immediately at bhavtiteche@gmail.com.

Our Service integrates with the following third-party providers. Each operates under its own privacy policy, and we encourage you to review them:

BTConexa is not responsible for the privacy practices of these third-party providers. Data shared with them is limited to what is strictly necessary for the corresponding service.

The BTConexa mobile application does not use browser cookies. However, we use the following equivalent technologies:

• JWT Tokens: Stored securely on your device to maintain your authenticated session. These tokens expire automatically and can be invalidated via logout.
• Local Storage / Shared Preferences: Used to store your MPIN hash, app preferences, and cached data for offline usability.
• Firebase / Crash Analytics (if applicable): Anonymous diagnostic data to detect app crashes. No personally identifiable information is included in crash reports.

Our web panels and QR scan landing pages may use minimal anonymous session tracking to prevent replay attacks and ensure secure one-time interactions.

BTConexa reserves the right to update or revise this Privacy Policy at any time. When we make significant changes, we will:

• Post the updated policy on this page with a revised "Last Updated" date.
• Send a push notification or in-app alert to notify you of material changes.
• Where required by law, seek your fresh consent before processing data under the new terms.

Your continued use of the BTConexa application after the effective date of the revised policy constitutes your acceptance of the changes. We encourage you to review this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please reach out to our dedicated privacy team: