Data & Privacy

Privacy Policy

Last updated: March 1, 2026

Your privacy matters to us. This policy explains what data we collect, how we use it, and your rights under the Digital Personal Data Protection (DPDP) Act. Handovr is committed to protecting your personal information.

1. Information We Collect

Account Information

  • Email address — required for passwordless OTP-based authentication.
  • Name and phone number — provided during profile setup for order and delivery coordination.
  • Government ID — optionally uploaded for seller trust verification. Stored with AES-256 encryption and never shared with other users.

Listing & Transaction Data

  • Device details (brand, model, IMEI, storage, cosmetic condition, diagnostic reports, photos).
  • Order history, transaction amounts, and payment method metadata.
  • Communication between buyers and sellers via in-app chat.

Automatically Collected Data

  • Device type, browser, operating system, and screen resolution.
  • IP address and approximate location (city-level in Delhi NCR).
  • Pages visited, session duration, and interaction patterns.
  • Essential functional and analytics cookies (see our Cookie Policy).

2. How We Use Your Data

Authentication

To verify your identity via email OTP and maintain secure sessions.

Order Processing

To facilitate listings, payments, physical verification, and doorstep handover.

Trust & Safety

To calculate trust scores, detect fraud, and prevent scams.

Communication

To send order updates, inspection notifications, and support responses.

Analytics

To understand platform usage and improve user experience.

Legal Compliance

To meet regulatory requirements and resolve disputes under Indian law.

3. Data Sharing

We do not sell or rent your personal data to third parties. We share data only in these limited operational scenarios:

  • Payment processing — Razorpay receives necessary payment details to process transactions securely in compliance with RBI regulations.
  • In-house verification & delivery agents — Handovr agents receive delivery address and phone number exclusively for the purpose of completing the physical inspection and doorstep handover.
  • Legal requirements — Disclosed only if mandated by an applicable court order, law enforcement investigation, or statutory authority in India.
We never share your phone number, government ID, or exact home address with the other marketplace party.

4. Data Security

  • All data is transmitted over HTTPS with TLS 1.3 encryption.
  • Passwords are never stored — we use passwordless OTP-based authentication with cryptographically signed JWT sessions.
  • Government IDs are encrypted at rest and accessible only to authorised verification officers.
  • Payment data is handled by Razorpay's PCI-DSS compliant infrastructure — we never store credit/debit card numbers or CVVs.
  • Database access is strictly restricted with Row Level Security (RLS) policies.

5. Data Retention

  • Account data — retained for the lifetime of your account plus 6 months after requested deletion.
  • Transaction & tax invoices — retained for 7 years for tax and legal compliance under Indian law.
  • Chat messages — retained for 1 year after the transaction is completed.
  • 16-Point Inspection photos — retained for 1 year for dispute resolution and warranty tracking.
  • Cookies — see our Cookie Policy for specific expiration periods.

6. Your Rights (DPDP Act 2023)

Under the Digital Personal Data Protection Act, you have the right to:

  • Access & Summary — Request a copy and summary of all personal data processed by Handovr.
  • Correction & Updating — Update or correct inaccurate or incomplete information in your profile.
  • Erasure / Deletion — Request deletion of your account and personal data (subject to statutory record-keeping requirements).
  • Grievance Redressal — File a grievance with our designated Data Protection Officer.

To exercise any of these rights, email us at privacy@handovr.in or grievance@handovr.in.

7. Third-Party Infrastructure

We rely on the following industry-standard infrastructure providers:

  • Supabase — Cloud database and authentication infrastructure.
  • Razorpay — Secure RBI-licensed payment gateway.
  • Vercel — Web hosting and CDN delivery.

8. Children's Privacy

Handovr is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.

9. Grievance Officer & Contact

In compliance with the Information Technology Act 2000 and DPDP Act 2023, the details of the Grievance Officer are:

  • Name: Bilal Choudhary
  • Designation: Grievance Officer
  • Entity: Handovr Technologies
  • Email: grievance@handovr.in
  • Support Email: support@handovr.in
  • Address: Delhi NCR, India