Privacy Policy

This Privacy Policy (“Policy”) describes how GNUFOX PRIVATE LIMITED (“GNUFOX”, “we”, “us”, or “our”), the owner and operator of the Wasty platform (the “Services”), collects, uses, stores, shares, and protects personal data. It also explains your rights and how to exercise them.

The Services include, without limitation: (a) the Wasty customer mobile application (Android package identifier com.mywasty.app and any successor package); (b) the Wasty Partner collector mobile application; (c) this website and related public pages (including wasty.in and our Amplify / hosting domains); (d) the Wasty Admin / operations console; and (e) APIs, dashboards, SMS / OTP, maps, payments, and support channels that power waste collection, marketplace, rewards, and municipal reporting in India.

By creating an account, verifying a phone number, using the apps or website, or otherwise providing personal data to us, you acknowledge that you have read this Policy. Where Indian law requires consent for a particular processing activity, we will seek that consent in a clear manner at the relevant point of collection.

Important: This Policy is written for transparency and store-compliance (including Google Play and Apple App Store). It is not a substitute for independent legal advice. If you do not agree with this Policy, please do not use the Services.

1. Data Fiduciary / Controller

For personal data processed in connection with the Services, the Data Fiduciary (controller) is:

GNUFOX PRIVATE LIMITED
Brand / product: Wasty
Website: https://wasty.in
Privacy & data requests: privacy@wasty.in
General info: info@wasty.in
Support: support@wasty.in
Phone: +91 72053 19320
Grievance / authorised contact for privacy queries: grievance@wasty.in / +91 72053 19320

Where we engage cloud or messaging providers to process data on our behalf, they act as Data Processors under our instructions, as described in Section 8.

2. Scope and who this Policy applies to

This Policy applies to:

Customers / households / businesses who schedule pickups, use bags/QR codes, buy from the marketplace, redeem rewards, or contact support;
Partners / collectors / drivers who register, complete KYC, go online, accept jobs, upload proof, and request payouts;
Staff / admin users authorised to use the operations console;
Website visitors who browse public pages, including this Privacy Policy and Terms; and
Government / municipal stakeholders who receive aggregated or authorised operational reports where such programmes are enabled.

This Policy does not apply to third-party websites, stores, payment apps, or maps providers that have their own policies. Links to those services are for convenience only.

3. Categories of personal data we collect

We collect only what is reasonably necessary for the Services. Depending on your role and features you use, this may include:

3.1 Identity and contact data

Full name or display name
Mobile phone number (including country code; typically Indian +91 numbers)
Email address (if provided)
Account identifiers / user IDs generated by our systems
Profile preferences (language, notification settings, avatar selections)

3.2 Authentication and security data

One-time passwords (OTPs) sent for login/verification (stored hashed / time-limited)
Session tokens / JWTs and device push tokens
Login timestamps, approximate device/app version, and security-related logs
Admin authentication credentials or identity tokens for console access

3.3 Location and address data

Pickup / delivery addresses, landmarks, pin codes, and map pins (latitude / longitude)
Approximate or precise device location when you grant permission (e.g., to confirm service area or pin a spot)
For Partners: live / last-known location while marked Online, on shift, or on an active job, used for dispatch, ETA, and operational safety

3.4 Service, transaction, and operations data

Pickup schedules, waste types, bag counts / bag QR codes, job status history
Orders, cart contents, payment method labels, invoices / order history
Rewards points, redemptions, coupons, wallet-like balances
Sell-waste / buy-back requests and related rates or estimates
Support tickets, chat messages related to jobs, SOS / incident notes
Partner KYC documents and metadata (e.g., ID, driving licence, vehicle registration — only as submitted for onboarding)
Vehicle details, service zone, availability, ratings, payout requests and settlements
Photos / images you capture for QR scanning, waste context, or collection proof

3.5 Device, diagnostics, and technical data

Device model, OS version, app version, crash / performance diagnostics
IP address, approximate network info, and request logs for security and reliability
Cookies or similar technologies on the website/admin console (session, preference, and security cookies). See Section 12.

3.6 Data we do not intentionally collect

We do not require microphone audio recording for core QR / proof features described in our store listings.
We do not knowingly collect personal data of children under 18 (see Section 14).
We do not sell personal data (see Section 9).

4. How we collect personal data

Directly from you — registration, OTP login, profile forms, addresses, KYC uploads, support messages, camera captures you initiate.
Automatically — when the apps/website run (device logs, approximate location if permitted, usage events needed to operate jobs and security).
From Partners / Customers about each other — only what is needed to complete an assigned job (e.g., pickup address shared with the assigned Partner; job status shared with the Customer).
From processors — e.g., SMS delivery status from OTP providers; map geocoding responses; cloud storage metadata.
From authorised operators — admin users may enter or update operational records (assignments, settlements, catalog) in the console.

5. Purposes of processing (why we use your data)

We process personal data for the following purposes:

Account creation and authentication — verify phone numbers via OTP, maintain sessions, prevent account takeover.
Service delivery — schedule pickups, match Partners, navigate to pins, track job lifecycle, complete collections, and show history.
Marketplace and rewards — fulfil orders, manage stock, calculate points, redeem rewards/coupons.
Partner operations — KYC review, availability, routing, proof of collection, payouts and disputes.
Customer support and safety — respond to tickets, SOS / incidents, quality and contamination notes.
Communications — transactional SMS/OTP, in-app or push notifications about pickups, orders, and account security (you may control non-essential pushes in settings where available).
Compliance and reporting — municipal / ESG / chain-of-custody reporting where programmes are enabled; tax, accounting, and legal obligations.
Security, fraud prevention, and abuse detection — protect users, Partners, and infrastructure.
Product improvement — diagnose crashes, measure feature reliability, improve maps/dispatch accuracy (using aggregated or de-identified insights where practicable).
Legal claims — establish, exercise, or defend legal rights.

6. Legal bases / grounds for processing (India)

Depending on the activity, we process personal data on one or more of the following grounds under applicable Indian law (including the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and rules, as they apply over time):

Consent — e.g., precise location permission, camera access, optional marketing communications, certain KYC document uploads.
Legitimate uses permitted by law — e.g., providing the service you requested (pickup / order fulfilment), employment-like Partner engagement records, medical emergencies / safety where applicable under law, employment of security measures, compliance with law or court orders, and other legitimate uses recognised under the DPDP Act.
Contractual necessity — to perform our agreement with you (Terms of Service) and related transactions.

Where processing is based on consent, you may withdraw consent with ease comparable to how it was given (for example, by disabling a permission in device settings, turning off a notification category, or contacting us). Withdrawal does not affect processing already lawfully completed, and may limit our ability to provide related features (e.g., without location we cannot pin your pickup accurately).

7. Device permissions (mobile apps)

Store listings and runtime prompts may request:

Location — pin pickup addresses; Partner live tracking while Online / on job; service-area checks.
Camera — scan bag/bin QR codes; capture collection or waste-related photos you choose to take.
Notifications — pickup reminders, job updates, order status, security alerts.
Network / storage — operate the app, cache content, upload images you submit.

You can revoke permissions in your device settings. Some features will stop working without the related permission.

8. Processors, subprocessors, and infrastructure

We use carefully selected service providers to operate Wasty. Categories include:

Cloud hosting & database — e.g., Amazon Web Services (API Gateway, Lambda, DynamoDB, S3, related services), typically with primary processing oriented to India / Asia regions where configured.
Authentication / backend tooling — Google Firebase services where configured for identity, storage, or related features.
SMS / OTP delivery — transactional SMS providers (e.g., Fast2SMS or similar) and/or telecom fallbacks for login codes.
Maps & geolocation — map tile providers and/or Google Maps Platform for maps, geocoding, and navigation context.
Push notifications — Expo / platform push services when you enable notifications.
Payments — payment service providers / UPI or card gateways if and when online payments are enabled (those providers process payment credentials under their own terms; we typically receive limited payment status metadata).
Analytics / crash reporting — only if enabled, to improve stability.
Customer support tooling — email and ticketing systems.

Processors are bound by contracts / terms requiring them to process personal data only on documented instructions and to implement appropriate security. A current list of key subprocessors can be requested at privacy@wasty.in.

We share personal data only as needed:

Between Customer and assigned Partner — name/phone as needed, pickup address, waste type, bag info, and live job status so the job can be completed.
With authorised GNUFOX / operator staff — ops, support, finance, and compliance roles with access controls.
With processors — as in Section 8.
With municipal / government programmes — where you or your city participates and disclosure is required or authorised (often aggregated; sometimes job-level chain-of-custody data).
Corporate transactions — if we undergo a merger, acquisition, reorganisation, or asset sale, personal data may transfer subject to continuing confidentiality and notice where required.
Legal requirements — to comply with law, regulation, legal process, or enforceable governmental request; to protect rights, safety, and property of GNUFOX, users, Partners, or the public.

We do not sell personal data. We do not share personal data for third-party cross-context advertising of the type associated with “sale” / “share” under certain foreign privacy laws, because our core model is operational waste services—not ad brokerage.

10. International / cross-border transfers

Our primary intent is to process and store Service data in India or regions serving Indian users. Some processors (global cloud, maps, push, SMS) may process or back up data in other countries. Where cross-border transfer occurs, we take steps consistent with applicable Indian law and vendor contracts (including contractual safeguards and security requirements). By using the Services, you understand that such transfers may be necessary to operate global infrastructure components.

11. Retention

We retain personal data only as long as needed for the purposes above, including:

Account profile — for the life of the account, then deleted or anonymised after closure subject to legal holds.
OTP records — short-lived (minutes), then expired / deleted.
Partner live location history — short TTL for routing (often minutes to hours); last-known position may remain on the Partner profile while active.
Jobs, orders, payouts, proof photos — typically up to 24 months, or longer if required for disputes, audits, tax, municipal compliance, or legal claims.
Security logs — for a limited period appropriate to investigate abuse.
KYC documents — for as long as the Partner relationship continues and thereafter as required by law or fraud prevention.

When retention ends, we delete, irreversibly anonymise, or aggregate data so it no longer identifies you, unless law requires otherwise.

12. Cookies and similar technologies (website / admin)

On websites and the admin console we may use:

Strictly necessary cookies — authentication, security, load balancing.
Preference cookies — language or UI preferences.
Analytics cookies — only if enabled, to understand traffic and improve pages.

You can control cookies through your browser settings. Blocking necessary cookies may break login.

13. Security

We implement reasonable security safeguards designed to prevent personal data breaches, including measures such as: encrypted transit (HTTPS/TLS), access controls and role-based permissions, credential hashing for OTPs, least-privilege cloud IAM, monitoring and logging, and vendor due diligence. No method of transmission or storage is 100% secure; you are responsible for keeping OTP codes and devices confidential.

If a personal data breach occurs that requires notification under applicable law, we will notify affected users and/or authorities as required.

14. Children

The Services are intended solely for individuals who are 18 years of age or older. We do not knowingly collect personal data from children. If you believe a minor has provided personal data, contact privacy@wasty.in and we will take steps to delete it promptly.

15. Your rights (Data Principal rights)

Subject to the DPDP Act and other applicable law, you may have the right to:

Access a summary of personal data being processed and the processing activities.
Correction and completion of inaccurate or incomplete personal data.
Erasure of personal data when it is no longer necessary for the stated purpose or when consent is withdrawn (subject to legal retention exceptions).
Data portability of personal data provided by you, where applicable under law / product capability.
Withdraw consent where processing is consent-based.
Grievance redressal — complain to us, and thereafter to the Data Protection Board of India as provided under the DPDP Act.
Nominate another individual to exercise rights in the event of death or incapacity, where the law provides.

How to exercise rights: email privacy@wasty.in from your registered contact where possible, or use in-app Profile / account deletion flows. We may verify your identity before fulfilling requests. We will respond within timelines required by law (and otherwise within a reasonable period).

Account deletion: Customers may request deletion from Profile where the feature is enabled, or by emailing us. Partners and admin users should contact support. Deletion may be delayed or partial where we must retain records for payouts, fraud prevention, municipal compliance, or legal obligations.

16. Grievance officer / contact for complaints

For privacy grievances related to the Services, contact:

Grievance contact — GNUFOX PRIVATE LIMITED
Email: grievance@wasty.in
Phone: +91 72053 19320

Please include your name, registered phone/email, description of the issue, and any job or order reference. We aim to acknowledge and address grievances in a timely manner. If unsatisfied after our response, you may escalate to the Data Protection Board of India as provided under applicable law.

17. Automated decision-making

We may use automated systems for matching available Partners, ETA estimates, fraud signals, catalog ranking, or routing suggestions. These systems support operations; significant account actions (e.g., KYC rejection, suspension) involve human review processes where required by our policies. You may contact us to seek clarification about outcomes that materially affect you.

18. Third-party links and app stores

Google Play, Apple App Store, payment apps, and map apps are governed by their own terms and privacy policies. When you download Wasty or complete a payment outside our direct card capture, those platforms may process data independently.

19. Changes to this Policy

We may update this Policy to reflect product, legal, or operational changes. We will revise the “Last updated” date and, where changes are material, provide additional notice (in-app, website banner, or email/SMS) as appropriate. Continued use after the effective date constitutes acknowledgement of the updated Policy, except where consent is legally required for a new processing purpose.

20. Governing law

This Policy is governed by the laws of India. Without prejudice to mandatory consumer or data-protection rights, disputes relating to privacy practices may be subject to the mechanisms in our Terms of Service and applicable law.

21. Contact us

GNUFOX PRIVATE LIMITED
Product: Wasty
Privacy: privacy@wasty.in
Support: support@wasty.in
Info: info@wasty.in
Phone: +91 72053 19320
Grievance: grievance@wasty.in
Terms of Service: /terms

For Google Play / App Store listings, the canonical public Privacy Policy URL for Wasty is the Privacy page hosted on our official website / Amplify deployment linked from the homepage footer.