DPDP Act Compliance

GeoWatch is operated by Geowatch India ("we", "us", "our"), acting as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") for the personal data we process across geowatch.in and its subdomains.

This page explains what we collect, why we collect it, how long we keep it, and how you can exercise your rights as a Data Principal.

Account data — your name, email address, optional phone number, and a bcrypt-hashed copy of your password (plaintext is never stored).

Licence data — your trial or paid licence key, activation date, plan type, and expiry.

Usage data — login timestamps, pages viewed, saved searches, bookmarks, and alert rules you configure.

Technical data — IP address, browser type, and device information, collected for security, rate limiting, and abuse prevention.

• Create and manage your account
• Deliver the GeoWatch service — the map, AI Co-Pilot, alerts, and daily intelligence reports
• Send transactional emails (trial credentials, security notifications, service changes)
• Prevent fraud, abuse, and unauthorised access
• Comply with legal and tax obligations

We do not sell your personal data, and we do not use it for advertising. There are no third-party trackers on GeoWatch.

We process your personal data on the basis of your consent, given at signup after you were shown this notice. You have the right to withdraw consent at any time — see §8 below.

Certain processing is also permitted under legitimate uses specified in the DPDP Act, such as compliance with legal obligations and prevention of fraud.

• Account data — retained while your account is active. After a deletion request, purged from primary systems within 30 days; residual backups within 90 days.
• Login and security logs — 90 days from the event.
• Licence and payment records — retained for the period required by Indian accounting and tax laws.

We share personal data only with sub-processors who help deliver the service — our cloud hosting provider, our transactional email provider, and our payment processor (when you become a paid user). These sub-processors act only on our written instructions and are bound by confidentiality and data-protection terms.

We do not share personal data with advertisers, data brokers, or analytics companies.

We may disclose data when required by law, court order, or a lawful request from a government authority.

Under the DPDP Act you have the right to:

• Access — a summary of the personal data we hold about you, and the identities of the Data Fiduciaries with whom it has been shared.
• Correction and erasure — correct inaccurate data, or request deletion of your account and its data.
• Grievance redressal — raise a grievance with us first, with a right to escalate to the Data Protection Board of India if unresolved.
• Nomination — nominate another individual to exercise your rights in the event of death or incapacity.
• Withdraw consent — at any time, without affecting the lawfulness of prior processing.

Email privacy@geowatch.in from the address associated with your account, with the subject line "Withdraw consent" or "Delete account".

We confirm receipt within 7 days and complete the request within 30 days, subject to our legal obligation to retain payment records.

GeoWatch is not intended for anyone under 18. We do not knowingly collect personal data of children. If we learn that a child has provided us personal data, we delete it promptly.

Passwords are hashed with bcrypt (cost factor 12). All traffic is encrypted with TLS. Authentication endpoints are rate-limited. Internal systems use least-privilege access. We do not store secrets in plaintext.

In the event of a personal data breach, we notify the Data Protection Board of India and affected Data Principals in accordance with the DPDP Act and the Rules made under it, as promptly as required.

Personal data is processed on servers operated by our cloud hosting provider. Where data is transferred outside India, we ensure the transfer complies with Section 16 of the DPDP Act and any restrictions notified by the Central Government.

For any question, concern, or complaint about how we handle your personal data:

• Email: privacy@geowatch.in
• Response time: within 7 days of receipt
• Resolution: within 30 days, as required by the DPDP Act

If your grievance is not resolved within 30 days, you may escalate to the Data Protection Board of India.

We update this page when our practices change. Material changes are emailed to active users at least 14 days before they take effect. Continued use of the service after the effective date constitutes acceptance of the updated notice.

• Privacy Policy — full data-handling policy
• Terms of Service — contractual terms