Privacy & Data Protection Policy

1. Corporate Operating Entity

This Privacy Policy governs the collection, processing, and protection of personal data by Wyntech Labs Private Limited ("Wyntech Labs", "we", "us", or "our"), the developer and operator of the Zinetra mobile application and web portals.

Registered Location: Madhapur, Hyderabad, Telangana, India.

2. Information We Collect

To provide marketplace discovery and seller account management, we collect:

• Account Credentials: Mobile phone number, display name, account identifiers, and encrypted session tokens.
• Seller Profile & Listings: Business name, active product or service listings, descriptions, pricing, and catalog images.
• Location Data: Coarse or precise geolocation (only with explicit user permission) to power localized community feeds and nearby merchant discovery.
• Government KYC Attributes: When sellers apply for Verified Badges, identity credentials are validated via authorized identity gateway providers. Raw identity documents are not permanently stored in plain text.
• Transaction Metadata: Order identifiers, plan durations, timestamps, and settlement statuses from payment gateways (Razorpay). We do not collect or store bank account passwords, UPI PINs, or raw credit/debit card numbers.

3. Identity Verification & One-Person Principle

To prevent fraudulent multi-accounting and protect buyers, Zinetra enforces a One-Person = One-Account integrity rule.

• Cryptographic Fingerprinting: A salted cryptographic hash (HMAC-SHA256) is generated during identity validation to ensure an individual cannot register multiple conflicting seller identities.
• Zero Plaintext Storage: Raw national identity documents are retained only during the active verification session with our certified KYC partner, after which only masked identifiers and verification status are retained.

4. Security & Data Governance

• Encryption in Transit: All web and mobile communications are protected by Transport Layer Security (TLS 1.3 / HTTPS with 256-bit encryption).
• PCI-DSS Compliance: All subscription fee transactions are processed by certified Level 1 PCI-DSS payment aggregators (Razorpay).
• Access Control: Production databases are secured within private cloud VPC subnets with least-privilege role-based access control (RBAC).

5. Data Retention & Account Deletion Rights

Users retain full control over their personal data. You may request account deletion at any time directly through the app settings or via our dedicated Account Deletion Portal.

Upon account deletion confirmation, all profile information, active listings, and session cookies are permanently purged within 30 days, except records legally required for tax, audit, or ongoing dispute resolution.

6. Grievance Officer & Contact

For privacy inquiries, data rectification, or compliance questions, please contact our designated Grievance Officer: