Privacy Policy

Effective Date: 2026-05-04 Applies To: Users of the Pawgloo-Partners Service Application ("Partners" or "Service Providers").

The Bottom Line Up Front (BLUF): At Pawgloo, we take your privacy seriously. We are compliant with the Digital Personal Data Protection (DPDP) Act, 2023. This policy explains what data we collect (professional profile, KYC, location), how we store it securely using enterprise-grade cloud providers, and your rights regarding your data, including details on sensitive data handling and retention.

1. Introduction and DPDP Act Compliance

NEXEL PLATFORMS PRIVATE LIMITED, which operates the Pawgloo platform ("Company," "we," "us," or "our"), acts as a Data Fiduciary under the Digital Personal Data Protection (DPDP) Act, 2023. This policy comprehensively outlines the methodology by which we collect, store, process, and securely transfer your personal and professional data across our cloud infrastructure. By utilizing the Pawgloo-Partners application, you provide explicit, informed consent for the processing of your data as defined within this policy.

2. Data Collection and Flow Architecture

We operate a strictly segmented data architecture to ensure data minimization and purpose limitation. Data is routed and isolated securely:

Professional Profiles: Your specialty, biography, and scheduling data are stored in a dedicated service-provider database to connect you with pet parents.
Verification Documents (KYC): Sensitive identity documents (e.g., Aadhaar, PAN, Veterinary Licenses) are uploaded directly to encrypted, private cloud object storage. Access is restricted via strict Identity and Access Management (IAM) policies to authorized compliance personnel only.
Service Telemetry: We record transactional metadata, including appointment timestamps and the duration of audio/video calls, to ensure auditable, accurate payout calculations.
Geospatial Data: To connect you with geographically proximate service requests, we process your device's location. This data is utilized dynamically for matching and tracking active bookings (e.g., dog walks) but is expressly not archived to track historical movements outside of service slots.

3. Third-Party Data Processors (Sub-Processors)

To operate the platform efficiently, we securely transmit limited data subsets to the following categories of enterprise-grade infrastructure partners:

Cloud Hosting & Infrastructure Providers: Our primary backend databases and object storage are hosted on secure, localized cloud servers to ensure strict adherence to Indian data localization mandates.
Real-Time Communication Platforms: For in-app chat and video consultations, we securely pass temporary tokens to our communication providers. We expressly do not record, store, or archive raw video streams of your consultations on our servers.
Notification & Messaging Services: For transactional communications (e.g., booking confirmations, OTPs), your contact details and device tokens are transmitted securely to our notification infrastructure partners.
Regulated Payment Aggregators: All financial transactions and payouts are processed via RBI-authorized payment gateways. We do not store your bank account numbers or UPI PINs on our primary databases.

4. Temporary Caching and System State Management

To maintain application performance and prevent concurrent booking conflicts, we employ an in-memory caching layer.

Idempotency & Concurrency Locks: When a booking is initiated or modified, a temporary reservation lock is generated in the cache. This lock contains minimal identifier data and automatically self-destructs after a short period.
Non-Persistence: Our caching infrastructure is strictly utilized for transient state management and is never used for the persistent archiving of personally identifiable information (PII).

5. Data Retention and Deletion (The Right to be Forgotten)

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy or as required by applicable Indian law.

Account Deletion: Partners may request complete account deletion via the application settings. Upon verification, profile data in our primary databases and associated media in cloud storage will be permanently soft-deleted and subsequently hard-deleted within 30 days.
Regulatory Retention: To comply with the Income Tax Act, 1961, and the Prevention of Money Laundering Act (PMLA), 2002, transactional records, ledger entries, and Partner KYC metadata may be securely archived in a restricted state for up to eight (8) years following account termination.

6. Data Security and Internal Access Controls

Encryption: All data transmitted between your device and our backend APIs is secured using modern TLS/SSL protocols. Data at rest within our databases and cloud storage is encrypted utilizing industry-standard key management services.
Role-Based Access Control (RBAC): We enforce the principle of least privilege. Customer support personnel can only view booking statuses and cannot access private chat histories or financial ledgers. Raw database access is restricted to authorized engineering personnel via secure, audited jump hosts.

7. User Rights and Grievance Redressal

Under the DPDP Act, 2023, you possess the right to:

Access & Nominate: Request a summary of your personal data and nominate an individual to exercise your rights in the event of incapacity.
Correction: Rectify inaccurate or incomplete profile information directly within the application.
Grievance Redressal: If you have concerns regarding our data practices, please contact our designated Data Protection Officer (DPO) at privacy@pawgloo.com. We are committed to resolving grievances promptly in accordance with statutory timelines.

Sensitive User Data & Financial Privacy Policy

This section details the handling of sensitive personal data and financial information.

1. Scope of Sensitive Personal Data or Information (SPDI)

This policy strictly governs the collection, transmission, tokenization, and processing of "Sensitive Personal Data or Information" (SPDI), as defined under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, read alongside the Digital Personal Data Protection (DPDP) Act, 2023.

Within the context of the Pawgloo-Partners ecosystem, SPDI specifically encompasses:

Financial Account Instruments: Bank Account Numbers and associated IFSC Codes.
Payment Identifiers: Unified Payments Interface (UPI) IDs (Virtual Payment Addresses / VPAs).
Government-Issued Identifiers (KYC): Unique identification documents, including Aadhaar, Permanent Account Numbers (PAN), and statutory Veterinary/Professional Licenses.

2. Strict Non-Storage Policy (The "Air-Gap" Architecture)

Pawgloo operates on a foundational principle of financial data air-gapping and zero-knowledge architecture. We explicitly do not store, record, archive, or otherwise maintain raw, unencrypted sensitive financial data on any of our proprietary cloud servers, databases, or object storage environments.

To guarantee maximum security and ensure absolute compliance with regulations issued by the Reserve Bank of India (RBI), data is transmitted dynamically via secure, end-to-end encrypted API tunnels directly to our RBI-authorized Payment Aggregator and Identity Verification partners.

3. Partner Application: Pay-Outs and Statutory KYC

To facilitate the lawful disbursement of professional earnings and comply with the Prevention of Money Laundering Act (PMLA), 2002, Pawgloo is statutorily obligated to verify the Partner's identity and banking credentials.

A. Beneficiary Creation & Mandatory Verification When a Partner inputs their Bank Account or UPI ID, our Partner-backend acts solely as a secure conduit, transmitting the SPDI instantly to our Payment Aggregator to instantiate a "Beneficiary" profile. We utilize secure identity verification suites to execute a Penny Drop verification (remitting a nominal ₹1). The payment partner returns the verified bank name status, which our algorithms compare against the Partner's registered profile to substantiate ownership and mitigate financial fraud.

B. Post-Verification Data Scrubbing Upon the successful confirmation of verification, Pawgloo executes an automated routine to immediately and permanently scrub the raw account number and IFSC code from its memory caches. We retain only non-sensitive, operational routing identifiers:

A system-generated, encrypted beneficiary reference issued by our payment aggregator.
The binary verification status (verified / failed).
Masked display strings (e.g., last 4 digits of the account number, partial IFSC) strictly for your recognition within the app dashboard.

C. Archival of Government Identifiers Government-issued identifiers (Aadhaar/PAN) required for statutory KYC and Section 194-O TDS compliance are subjected to advanced encryption protocols and stored in an isolated, access-restricted cloud storage environment. Access is governed by strict Identity and Access Management (IAM) policies, limited exclusively to the designated Grievance/Compliance Officer for the sole purposes of statutory auditing, tax reporting, and dispute resolution.

Because our Payment Aggregator partners execute all sensitive financial processing, nodal account settlement, and identity validation on behalf of Pawgloo, their operations are governed by independent, RBI-audited security protocols.

Explicit Consent: By submitting payout credentials through the Pawgloo-Partners application, you hereby acknowledge and provide explicit, affirmative consent for the secure transmission of your SPDI to our regulated payment partners.
Review of Partner Protocols: Users are strongly advised to review the official security architecture and privacy practices of our regulated payment aggregators as linked during the onboarding process.

5. Security Incident Response Protocol (CERT-In Mandate)

While Pawgloo does not retain raw financial data, we maintain rigorous, tamper-evident logging of all API requests. In the unlikely event of a cybersecurity incident, unauthorized access, or data breach affecting our retained operational routing data, Pawgloo is bound by the following mandatory response protocol:

Reporting Mandate: We will notify affected users and report the incident to the Indian Computer Emergency Response Team (CERT-In) within six (6) hours of identifying the anomaly, in strict adherence to the directives issued under subsection (6) of section 70B of the Information Technology Act, 2000.

Data Retention & Deletion Policy

This section outlines Pawgloo’s data lifecycle management practices, including retention schedules and the right to data erasure.

1. Purpose and Statutory Alignment

This policy articulates the data lifecycle management practices of NEXEL PLATFORMS PRIVATE LIMITED. It defines the specific durations for which varying categories of personal and operational data are retained, our automated purging cycles, and the mechanisms through which users may exercise their right to data erasure (the "Right to be Forgotten") pursuant to the Digital Personal Data Protection (DPDP) Act, 2023.

2. Dynamic Data Retention Schedules

We adhere to the principle of data minimization. Data is retained strictly for the duration necessary to fulfill its operational purpose or to comply with statutory mandates:

Active Account Data: Profile information, professional dossiers, and scheduling preferences are retained in our primary databases for the continuous duration of your active account status.
Media and Object Storage: Profile pictures and uploaded chat attachments are retained while the account is active.
Ephemeral State Data (In-Memory Cache): Transient operational data is strictly ephemeral and is permanently flushed from our caching layer within 10 minutes to 7 days.
Customer Support & Grievance Logs: Communications directed to our support or Trust & Safety teams are retained for a period of two (2) years.

3. Mandatory Legal Retention (The Immutable Ledger)

To comply with stringent Indian financial and taxation frameworks, Pawgloo is legally prohibited from expunging data integral to financial reconciliation.

Financial Ledgers & Transactional Invoices: All data recorded within our double-entry accounting architecture (including transaction records, ledger entries, and payout batches) must be retained for a mandatory minimum period of eight (8) years.
Cryptographic Anonymization: Upon the successful execution of an account deletion request, the user's profile is "soft-deleted." However, the financial metadata linked to historical bookings, automated payouts, and TDS deductions remains preserved.
Partner KYC Archival: Statutorily mandated identity verification logs (Aadhaar/PAN) and corresponding tax deduction histories are archived in an isolated, encrypted, and access-restricted vault for eight (8) years post-account termination.

4. Data Erasure Protocol (The Right to be Forgotten)

Subject to the exceptions outlined in Section 5, users possess the statutory right to request the permanent erasure of their personal data.

A. Initiation of the Erasure Request:

Navigate to the Settings interface within the Pawgloo-Partners application.
Access Account Security > Delete Account.
Alternatively, a formal, verifiable data erasure mandate may be transmitted via email to privacy@pawgloo.com.

B. The Erasure Execution Lifecycle: Upon the authentication of a deletion request, and contingent upon the absence of pending financial settlements:

Immediate Action (0-7 Days): The account is instantly deactivated, authentications are revoked, and you are immediately delisted from search indexing and partner directories.
Database Purge (30 Days): Personally Identifiable Information (PII) is permanently scrubbed or irreversibly hashed from the primary operational databases. All associated media assets are subjected to a hard delete.
Ledger Preservation: As articulated in Section 3, numeric transaction logs are preserved solely for statutory tax audits, fully decoupled from the user's identity.

5. Legal & Trust Holds (Exceptions to Erasure)

Pawgloo explicitly reserves the right to deny, suspend, or delay a data erasure request under the following circumstances:

Active Litigation or Disputes: The existence of an unresolved dispute, active insurance claim, or pending litigation involving the account.
Financial Delinquency: The account owes an outstanding refund or financial penalty to the platform or a counterparty.
Trust & Safety Violations: If the account has been permanently suspended for severe breaches of the Terms of Service (e.g., violating the Anti-Circumvention Policy).
🐾 Find your pet's perfect match on Pawgloo
Join the community of thousands of pet parents in India. Play dates, tele-vet access, and verified dog walkers-all in one app.
Download Pawgloo

On this page