We collect the following types of information:

1.1 Personal Information

• Identity Data: Full name, email address, phone number.
• Account Data: Login credentials (stored as bcrypt-hashed passwords), account type (Consumer, Tenant, Employee, Captain).
• Order Data: Delivery address, landmark, city, pincode, order history, uploaded document filenames and content.
• Payment Data: We use Razorpay as our payment processor. We do not store your card numbers, CVV, or full bank account details. Razorpay collects and processes payment data under its own privacy policy and is PCI-DSS compliant.
• Location Data: Delivery address and, with your consent, approximate geographic location to find the nearest print shop.

1.2 Technical Data

• Device type, browser, IP address, and session identifiers for security and fraud prevention.
• Log data including pages visited, time spent, and error reports.

1.3 Documents Uploaded

Files you upload for printing are stored securely on Amazon S3 (AWS) servers. Documents are used solely to fulfill your print order and are automatically purged after order completion. We do not read, analyze, or share your document content with third parties.

We use your information to:

• Process and fulfill print orders and manage delivery logistics.
• Send order status updates, OTPs for login, and security alerts via email.
• Assign the nearest print shop partner for faster delivery.
• Process payments through Razorpay and manage refund requests.
• Prevent fraud, detect unauthorized access, and maintain platform security.
• Send promotional communications (only with your consent; you may opt out at any time).
• Comply with our legal obligations under Indian law.

Legal Basis (IT Act 2000, Section 43A): We collect and process sensitive personal data only with your informed consent, which is provided when you create an account and place an order on our platform.

All online payments on Zippi are processed by Razorpay Software Private Limited, a company registered in India and authorized by the Reserve Bank of India (RBI) as a Payment Aggregator.

• We do not store your credit/debit card details, net banking credentials, or UPI PINs on our servers.
• Razorpay is PCI-DSS Level 1 compliant — the highest level of payment security certification.
• Transaction records (amount, order ID, payment status) are stored by us to manage your order and provide refunds where applicable.
• For Cash on Delivery (COD) orders, we collect only the information necessary to confirm delivery.

By using our payment services, you also agree to Razorpay's Privacy Policy.

We do not sell, rent, or trade your personal information. We share data only with:

• Print Shop Partners (Tenants): Your name, phone number, delivery address, and document details are shared with the assigned shop to fulfill your order.
• Delivery Captains: Your name, phone, and delivery address are shared for the purpose of delivery.
• Razorpay: Payment processing data as described above.
• Amazon Web Services (AWS): Document file storage on S3.
• Law Enforcement: If required by Indian law, court order, or government authority under the IT Act 2000 or other applicable legislation.

• Order data is retained for 3 years for legal and tax compliance purposes.
• Uploaded documents are deleted after order fulfillment (maximum 30 days).
• Account data is retained as long as your account is active. You may request deletion at any time.
• Payment transaction records are retained for 7 years as required by Indian financial regulations.

Under Indian data protection law and our policies, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and personal data (subject to legal retention obligations).
• Withdraw Consent: Withdraw consent for marketing communications at any time.
• Grievance Redressal: Lodge a complaint with our Grievance Officer (details below).

To exercise any of these rights, contact us at support@brunx.fit.

We implement industry-standard security measures including:

• HTTPS/TLS encryption for all data in transit.
• Bcrypt hashing for stored passwords.
• RSA-OAEP encryption for password transmission.
• Single-device session enforcement to prevent unauthorized access.
• Security login alerts sent to your email on each new login.

Despite our best efforts, no system is 100% secure. In the event of a data breach, we will notify affected users within 72 hours as required by applicable law.

We use essential session cookies for authentication purposes only. We do not use third-party advertising or tracking cookies. You may disable cookies in your browser settings, but this may affect the functionality of the platform.

Our services are not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such data, please contact us immediately.

As required under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have appointed a Grievance Officer:

We may update this Privacy Policy from time to time. Material changes will be notified to registered users via email. Continued use of the platform after changes constitutes acceptance of the updated policy.