1. Privacy Overview & Scope

This Privacy Policy explains how PennyGrade (“We”, “Us”, or “Our”), operating via the website pennygrade.in, collects, processes, stores, and protects your personal information when you purchase or use our physical membership cards, access our digital verification screens, or enroll as a partner merchant in Daltonganj, Palamu, and across Jharkhand, India.

We process personal data in strict compliance with applicable Indian data protection laws, including the Digital Personal Data Protection Act, 2023 (DPDPA 2023) and the Information Technology Act, 2000 read with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2. Personal Data We Collect

We collect only the minimum data strictly required to deliver our membership services:

4. Purpose & Lawful Grounds for Processing

We process personal data only for lawful, legitimate business purposes:

• Service Delivery: Issuing physical cards, activating valid subscriptions, and calculating eligible discounts at partner counters.
• Fraud Prevention: Preventing duplicate redemptions, screenshot forgery, and unauthorized commercial redistribution of membership benefits.
• Account History: Permitting Members to review their aggregate lifetime savings and past discount visits.
• Partner Reconciliation: Aggregating non-personally identifiable visit counts to audit partner performance.
• Statutory Compliance: Maintaining audit trails required under Indian tax, corporate, and digital intermediary laws.

5. Data Sharing & Infrastructure Providers

We never sell your personal data to data brokers or third-party advertisers. Data is shared only with trusted infrastructure partners under strict confidentiality:

• Database & Cloud Infrastructure: We utilize Supabase (PostgreSQL) hosted in SOC 2 Type II compliant secure data facilities for database storage and secure authentication.
• Web Hosting: Our web application is deployed via high-performance cloud hosting networks providing edge caching and enterprise SSL/TLS encryption.
• Legal & Law Enforcement: We may disclose data if legally required by an order issued by a competent Indian court, regulatory body, or law enforcement authority under applicable legislation.

6. Cookies & Tracking Technologies

PennyGrade maintains a clean, private browsing experience:

• No Third-Party Advertising Pixels: We do NOT employ Meta/Facebook Pixel, Google AdSense, or invasive commercial tracking scripts.
• Essential Operational Cookies: We only utilize strictly necessary, encrypted session cookies required for administrator login sessions and secure route authorization.

7. Data Protection & Security Safeguards

In compliance with Section 43A of the Information Technology Act, 2000, we implement reasonable security practices and procedures:

• Cryptographic Identifiers: Membership PenCodes are generated using cryptographically strong random generation (gen_pen_code()), preventing sequential enumeration attacks.
• Row Level Security (RLS): Authoritative database tables enforce PostgreSQL Row Level Security policies so unprivileged actors cannot query member records.
• Transport Layer Security: All data transmitted between your browser and our servers is encrypted in transit using industry-standard TLS 1.3 / HTTPS.

8. Data Retention Policy

We retain personal data only for as long as necessary to fulfill the operational purposes set forth herein:

• Active Memberships: Data is retained throughout your active membership term and for a reasonable period (up to 3 years) following expiration to facilitate renewals, audit verifications, or dispute resolutions.
• Verification Logs: Retained for auditing and accounting reconciliation, after which logs may be permanently anonymized for analytical trends.

9. Rights of Data Principals (DPDPA 2023)

Under the Digital Personal Data Protection Act, 2023, you are recognized as a Data Principal and enjoy the following statutory rights:

• Right to Access: You may request a summary of the personal data collected about you and details of processing activities.
• Right to Correction & Erasure: You may request correction of inaccurate data or deletion of your account information, subject to statutory retention obligations.
• Right of Grievance Redressal: You have the right to register complaints regarding data processing with our designated Grievance Officer.
• Right to Nominate: You may nominate an individual to exercise your privacy rights in the event of death or incapacity.

To exercise any of these rights, please submit a written request to pennygradebusiness@gmail.com with your registered mobile number and PenCode.

10. Children's Privacy

The PennyGrade membership platform is designed for individuals who are 18 years of age or older (including university students and working adults). We do not knowingly collect personal information directly from children under 18 years of age without parental or guardian consent. If you believe a child has provided us with personal information without parental consent, please contact us for immediate removal.

11. Grievance Officer & Contact Information

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, the contact details of our designated Data Protection & Grievance Redressal Officer are as follows:

12. Policy Updates & Version History

We reserve the right to amend this Privacy Policy periodically. Any modifications will be posted to this page with an updated “Last Updated” timestamp. We encourage you to review this policy periodically.