Privacy Policy
This policy explains what personal data Civyx collects, why we collect it, who we share it with, how long we keep it and the rights you have over it. It is written to meet India’s Digital Personal Data Protection Act, 2023 and the rules made under it.
The short version
- We never sell or rent your personal data.
- We do not show advertising and do not use analytics or tracking tools.
- We store personal data in India wherever possible.
- Students in school programmes are assessed as classes or groups, never individually.
- Personal certificates are only issued if you choose to take part.
- You can ask to see, correct or delete your data at any time.
1. Who we are
Civyx is operated by Civyx Softech Private Limited (CIN U62099UW2026PTC257588), a company registered in India. In this policy, “Civyx”, “we” and “us” mean Civyx Softech Private Limited. We decide how and why your personal data is processed, which makes us the Data Fiduciary under Indian law.
This policy covers the website at civyx.in, the Civyx app on mobile and web, and the programmes, verification and certification services we run with schools, colleges, workplaces, resident welfare associations, NGOs and other partners (together, “the Service”).
2. What we collect
We only collect what we need to run the Service. What we collect depends on how you use it.
| Type | What it includes | When we collect it |
|---|---|---|
| Account details | Mobile number, name, username and, if you add them, a profile photo and short bio. Staff of partner institutions may also give a work email address and password. | When you sign up or set up your profile |
| Reports and content | Photos, descriptions, category, comments and the location of the issue you report. | When you file a report, comment or upload evidence |
| Programme and certificate records | The programmes and drives you take part in, the evidence submitted, review outcomes and any certificate issued. | When you or your institution take part in a programme |
| Location | The location of a report or activity, from your device’s GPS or a place you choose on the map. | Only when you give location permission or pick a place yourself |
| Technical information | Device type, operating system, app version, IP address, error logs and, if you turn on notifications, a notification token. | Automatically, when you use the app or website |
| Messages to us | Your email address and whatever you write to us. | When you email or contact us |
What we do not collect: we do not collect IMEI numbers, MAC addresses or advertising identifiers, we do not read your contacts, and we do not track you across other apps or websites.
This website: civyx.in has no sign-up forms, no analytics and no tracking cookies. Contact buttons open your own email app, and you decide whether to send the message. Our hosting provider keeps standard technical logs, such as IP addresses, to run and protect the site.
3. How we use your data
- To create and run your account and let you sign in securely.
- To receive, route, track and verify civic reports.
- To run programmes, assess institutions and issue certificates.
- To send you updates about your reports, programmes and account.
- To answer your questions and handle complaints.
- To keep the Service secure and prevent fraud, misuse and fake reports.
- To fix problems and improve the Service, using combined data that does not identify you wherever possible.
- To meet our legal obligations.
We do not use your data for advertising, and we do not build profiles of you for marketing.
4. Consent
We ask for your consent at clear points, such as when you create an account, allow location or camera access, or join a certificate programme. We tell you what the data is for at that point. Simply visiting the website is not treated as consent.
You can withdraw your consent at any time through the app’s settings or by writing to contact@civyx.in. Withdrawing consent does not affect anything done before you withdrew it, but some features may stop working. For example, we cannot accept a report without a location.
We may process some data without separate consent where the law allows it, such as to comply with a court order or to respond to a medical emergency.
5. Children and students
Anyone under 18 is treated as a child under Indian law. A child can only have a Civyx account with the verifiable consent of a parent or lawful guardian, which we obtain before the account is created.
In school programmes, students take part through their school and are assessed as classes or groups. We never score students individually, and we never track children’s behaviour, build profiles of them or direct advertising at them.
6. Content that becomes public
Some content is designed to be seen by others. A civic report, including its photo, description and the location of the issue, may be visible to other users and to the people responsible for fixing it. Before a photo is stored, we remove the hidden data embedded in the image file, such as the GPS position and camera details.
Please do not include other people’s faces, vehicle numbers or personal details in your photos and reports unless they are needed to describe the issue. Personal certificates are only shown publicly if you choose to share them.
7. Who we share data with
We never sell or rent your personal data, and we do not share it with advertisers. We only share it in these situations, and only as much as is needed:
- Public authorities responsible for an issue. Where Civyx works with a government body under a formal agreement, reports in its area are shared with the department responsible. Data created under such an agreement is owned by that government body. Civyx never files a complaint in an official grievance system on your behalf; you do that from your own account.
- Your institution. If you take part through a school, college, workplace or housing society, that institution can see the participation records for its own programme.
- Programme partners. If you join a drive run by an NGO or supported by a partner organisation, they receive the details needed to run that drive.
- Verifiers. Trained reviewers who check reports and evidence see what they need to do that check.
- Service providers. Companies that host our servers, store photos, send SMS codes, emails and notifications act only on our instructions, under contract, and may not use your data for their own purposes.
- Legal requirements. When the law, a court or an authorised government agency requires it, or to protect someone’s safety.
We may publish combined statistics, such as the number of issues resolved in a ward, that cannot identify any individual.
8. Where your data is stored
We store personal data on servers located in India wherever possible. Some service providers, such as the Google and Apple services that deliver app notifications, may process limited data outside India. When that happens, we send only what is needed, never include report text or exact locations in notifications, and never transfer data to any country restricted by the Government of India.
9. How long we keep data
We keep personal data only for as long as it is needed for the purpose it was collected for, then delete it or make it anonymous.
| Data | How long we keep it |
|---|---|
| Account details | While your account is active. Deleted within 90 days of you closing your account. |
| Civic reports and photos | 3 years after the report is closed, to identify repeat problems at the same place. |
| Certificates and verification records | For as long as the certificate is valid, plus 3 years, so it can still be checked. |
| Server and security logs | 180 days. |
| Emails you send us | 2 years. |
| Data held under a government agreement | As set out in that agreement. |
If an account has not been used for 3 years, we will notify you at least 48 hours before deleting it, so you can keep it by signing in. We may keep data longer where the law requires it, or where it is needed for an open dispute or investigation, and only for as long as that lasts.
10. Security
We protect personal data with encryption in transit, access limited to people who need it, role-based permissions, audit logs that cannot be altered, and regular security reviews. No system is completely secure, so please keep your sign-in codes and devices safe and tell us at once if you suspect misuse of your account.
If a personal data breach happens, we will inform the people affected and the Data Protection Board of India as the law requires, explaining what happened, what it means for you and what we are doing about it.
11. Your rights
- Access: ask for a summary of the personal data we hold about you and who we have shared it with.
- Correction: ask us to correct or complete inaccurate data. You can also edit most profile details yourself in the app.
- Erasure: ask us to delete your data, unless we must keep it by law.
- Withdraw consent: at any time, as explained in section 4.
- Nominate: name someone to exercise these rights on your behalf if you die or become unable to do so.
- Grievance: complain to our Grievance Officer, and if you are not satisfied, complain to the Data Protection Board of India.
To use any of these rights, email contact@civyx.in from the address or mobile number linked to your account. We may need to confirm your identity first. We respond to requests within 30 days.
12. Grievance Officer
If you have a concern or complaint about how your personal data is handled, contact our Grievance Officer:
Ritu Sharma
Grievance Officer, Civyx Softech Private Limited
Email: contact@civyx.in (please use the subject line “Privacy grievance”)
Address: Twin Tower, Agra 282001, Uttar Pradesh, India
We acknowledge complaints within 24 hours and aim to resolve them within 15 days.
13. Other websites
The Service may link to websites and services run by others, such as Gmail. Their own privacy policies apply when you use them, and we are not responsible for how they handle your data.
14. Changes to this policy
We will update this policy when our Service or the law changes. The effective date at the top shows when it last changed. If a change significantly affects how we use your data, we will tell you in the app or by email before it takes effect and, where needed, ask for your consent again.