Legal

Privacy Policy

What we store, why we store it, and how we protect your personal data under the DPDP Act & GDPR.

No cloud AI — by design. We never use your content to train models. The only automated step — the on-device "Detect expiry date" scan — runs in your browser and never sends your documents anywhere.

Private by default

Items, notes and attachments are yours. We never sell your data and never share it with third parties for advertising.

Strong authentication

Passwords are salted and hashed (PBKDF2). Sessions are individually revocable. Resets use single-use, time-limited tokens.

Minimal collection

Only what the product needs: your name, email, phone (for SMS/WhatsApp reminders), and the renewal data you enter.

Export anytime

Take your personal data as JSON anytime for free under statutory DPDP & GDPR rights. Account deletion purges all records.

1. What we collect

Last updated: October 2026

Account data: your name, email address, and optional phone number (for WhatsApp/cellular SMS reminder delivery). Product data: the expiry items, reminder schedules, people profiles (family members/colleagues you track), vehicle/equipment records, and file attachments you upload. Operational data: aggregated request counts and error rates for reliability and abuse prevention. We do not track document content for advertising or profiling.

2. How we use it

To operate the product (scheduling and delivering renewal reminders across email, SMS, and WhatsApp), to secure your account, and to maintain service reliability. We never use your content to train AI models — RenewOS deliberately contains no AI components.

3. Data storage & security

Data is stored with strong access controls and encrypted at rest. Database connections enforce TLS with certificate verification (`sslmode=verify-full`). Attachments live in private cloud object storage and are accessible solely via 15-minute cryptographically signed URLs generated upon authenticated request.

5. Your rights (DPDP Act 2023 & Global Privacy)

RenewOS is fully backed by India's Digital Personal Data Protection Act, 2023 (DPDP Act), providing comprehensive statutory protection for your personal data, alongside full alignment with the EU/UK GDPR and California CCPA/CPRA. You have the statutory right to:

Access & Summary: Download a full machine-readable JSON copy of your personal data at any time for free.
Correction & Erasure: Update or delete any record directly in the app, or permanently erase your account in Settings → Account.
Consent Withdrawal: Withdraw consent for notification channels anytime in your profile settings.
Grievance Redressal: Submit inquiries directly to our designated Grievance & Data Protection Officer under Section 5(2) and Section 13 of the DPDP Act.
Statutory Recourse: Under DPDP Act Section 5(1)(iii), you have the right to register a complaint with the Data Protection Board of India (DPBI), as well as with your relevant regional supervisory authority (such as the UK ICO or EU DPA).

6. Cookies & sessions

We use essential secure session cookies for authentication (`__Host-` prefixed in production). For platform performance and error telemetry, we use Google Analytics with IP anonymization enabled. We do not use cross-site tracking cookies, behavioral ad-targeting cookies, or data-broker profiling networks.

7. Retention & deletion

Soft-deleted items are held in a 30-day recovery window before automatic permanent destruction from both our database and cloud object storage. When you delete your account, your personal data, credentials, and attachment files are immediately and permanently destroyed across all tables and storage buckets.

8. Infrastructure & international transfers

Our primary transactional database and application services run on managed cloud infrastructure (Supabase PostgreSQL, Vercel). Document attachments and encrypted file vaults are held in private object storage (Backblaze B2) with server-side encryption at rest and accessible solely via 15-minute cryptographically signed URLs. Transactional messaging processors (Brevo for email and SMS, Meta Cloud API for WhatsApp) and our Merchant of Record (Dodo Payments) process operational payloads under strict Data Processing Agreements incorporating standard contractual clauses (SCCs) and encryption in transit.

9. Google API data & Limited Use policy

RenewOS's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google Calendar: We access Google Calendar strictly to create, update, and sync renewal reminder events when you connect your calendar. We do not access, collect, or store unrelated calendar events.

Google Drive: We access Google Drive exclusively through the user-facing Google Picker component to allow you to select and attach invoices or warranty documents to your renewal records. We only access files you explicitly select.

No Advertising or Model Training: Google user data is never used for advertising, never shared with third parties or data brokers, and never used to train machine learning or AI models.

10. Grievance redressal & privacy contact

In accordance with Section 5(2) and Section 13 of the Digital Personal Data Protection Act, 2023 (DPDP Act) and international data protection standards, RenewOS maintains a designated Data Protection & Grievance Redressal Officer:

Grievance & Data Protection Team: RenewOS Data Privacy & Compliance Office

Email: [email protected] (or [email protected] / [email protected])

Response Turnaround: Acknowledged within 48 hours; resolved within 30 days.

If your concern is not resolved within the statutory period, you maintain the right to register a complaint with the Data Protection Board of India (DPBI) or your local supervisory authority.