Privacy

Draft of 22 October 2026 · AptroGo, India

The short version

We collect what is needed to send a checked person to a stated address at a stated time, to let you see that it happened, and to bill you for it. We do not sell personal data, we do not share it for advertising, and we keep the location of our Partners for hours rather than for history.

The people in this policy

This product has an unusual shape and the privacy consequences follow from it: the person who pays is usually not the person who is visited.

• The customer — you. You hold the account, you book, you pay, and you receive the reports.
• The beneficiary — the person actually visited, often a parent. They frequently do not hold an account and did not fill in any form.
• The Partner — the person who does the visit, who has their own account and their own data in our systems.

Data about someone who is not you

When you add a beneficiary you are giving us another living person’s name, age, address, and often something about their health. You are telling us you are entitled to do that. We hold it on the basis that you are acting for them, and we keep it to the minimum that makes a visit possible — there is no field in our system for a diagnosis, a prescription or a medical record, and that absence is deliberate.

A beneficiary can write to [email protected] and ask what we hold about them, ask us to correct it, or ask us to stop. We will act on that even though they are not the account holder, and we will tell the account holder we have done so.

What we collect

From customers

• Your phone number, which is how you sign in, and your name.
• An email address if you give us one, used for receipts and visit reports.
• The beneficiaries you add, and the addresses visits happen at.
• What you booked, when, what it cost, and what the Partner wrote afterwards.
• Your device’s timezone, so that every time in the app can be shown on your clock as well as theirs.

From Partners

• Identity documents — Aadhaar and PAN — and the results of our six checks.
• A police verification, which we hold on file.
• Local references, and our notes from calling them.
• The hours they said they were available, and the visits they did.
• Their location. This is the sensitive one and it has its own section below.

Automatically

Ordinary technical records: app version, device model, operating system, crash reports, and the IP address a request came from. We keep system failure records so that something going wrong can be diagnosed rather than guessed at.

Location, and the limits on it

What the customer app collects

One location, once, and only while the app is open — used to place a pin on the address being visited. The customer app is built so that it cannot read your location in the background: the permission is explicitly blocked in the app’s manifest rather than merely unused.

What the Partner app collects

The Partner app reports location continuously while a Partner has opened a working day, including when the app is in the background and the phone is in their pocket. This is disclosed to the Partner on a screen they must accept before it begins, it runs with a notification visible the whole time, and a Partner can end the day or withdraw the permission at any point.

We keep no trail. A Partner’s position is stored as a single row that is overwritten by the next reading and expires on its own. There is no history of where a Partner went, because a product that stores one would eventually be asked for it.

What the customer can see

The Partner’s live position on a map, from the moment the visit starts until the moment it ends. Not before, not after.

Phone numbers and calls

Calls between a customer and a Partner are bridged through our telephony provider in both directions. Neither party is shown the other’s real number and neither ends up with it in their call log. We keep a record that a call was placed, when, and how long it lasted. We do not record the audio of calls.

Payments

Card and UPI details are handled by our payment provider and never reach our servers. We hold the amount, the status, the provider’s reference, and the GST invoice we issued against it. Invoices are kept for the period Indian tax law requires, which is longer than the rest of your data.

Who we share with

We use a small number of processors and nothing beyond them:

• A cloud host and database provider, to run the service.
• A payment provider, to take payment.
• An email provider, to send receipts and reports.
• A crash-reporting provider, to find out why something broke.

Phone numbers, and what we do not yet do

So that a Partner at your door and the person who booked the visit can reach each other, we share your phone number with them, and theirs with you. Both sides see a real number and keep it after the visit ends. The apps say so on the screen before a call is placed.

We would rather this were not the case, and it is temporary. The service is built for masked calling — where each side dials a number that belongs to us, works only for that visit, and stops working afterwards — and we will move to it once an Indian telephony provider is in place. We would rather tell you what happens today than describe what we intend to do as though it were already true.

Phone numbers are only exchanged for a visit that is actually going ahead, and only from the point the Partner sets off. If somebody contacts you outside that, tell us and we will act on it.

We also share what we must when a law or a court requires it. We do not sell personal data and we do not share it with advertisers or data brokers. If we are ever party to an acquisition, the obligations in this policy transfer with the data.

How long we keep things

• Partner location — a single current position, expiring on its own within hours. No history.
• Bookings and visit reports — while your account is open, and then for as long as a dispute could reasonably arise from them.
• Invoices and tax records — as long as Indian tax law requires.
• Partner verification records — while they are on our roster, and after they leave for as long as we could be asked to show that somebody we sent was checked.
• System logs — weeks, not years.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to erase it, or withdraw a consent you gave. Write to [email protected]. We will answer within thirty days and we will tell you if there is something we are required to keep and why.

Closing your account does not automatically erase a beneficiary’s records or an invoice, for the reasons in the table above. Ask us and we will tell you exactly what remains.

Children

Our services are not sold to anyone under 18 and accounts may not be opened by them. A visit may involve a child in a household; we do not collect data about them beyond what a Partner needs to do the job.

Security

Data is encrypted in transit. Access to customer and Partner records by our own staff is restricted by role and written to an audit log, including the reason it was opened. Staff who look at an account can be asked why afterwards, because we recorded it at the time.

Changes

When this policy changes materially we will tell account holders rather than quietly updating the date at the top.

Contact

[email protected]. A postal address and the name of our Grievance Officer will be published here before launch, as the DPDP Act requires.