Privacy Policy

Victo Grow ("we", "us", "our") is committed to protecting your privacy. This Policy explains how we collect, store, use, and protect personal data in connection with our platform, which provides digital QR code campaigns, lead capture, loyalty programmes, and business card services to small businesses across India.

This Policy applies to two distinct groups of people: Tenants (businesses and individuals who register and use the Victo Grow platform) and Customers (members of the public who interact with a Tenant's offer page or QR code). Where a section applies only to one group, it is labelled accordingly. We comply with the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000, and applicable TRAI guidelines on unsolicited commercial communications.

A1. Data We Collect From Tenants

• Account information: Business name, owner name, phone number (used for OTP login), email address, business address, and profile image.
• Business content: Offer titles, QR code configurations, loyalty reward structures, template selections, and uploaded images.
• Billing information: Plan tier, payment history, and invoice details. Card or UPI details are processed entirely by Razorpay — we never see or store your payment credentials.
• Usage data: Login timestamps, feature usage, page visit counts on your public site, and API call logs — used only for service improvement and security.
• Support communications: Messages exchanged with our support team via WhatsApp, email, or the in-app widget.

A2. How We Use Tenant Data

• Provision and operation of your Victo Grow account and all associated features.
• Processing payments and issuing invoices through Razorpay.
• Sending transactional communications (OTP, billing alerts, service notices).
• Providing customer support and responding to grievances.
• Improving platform features based on aggregated, anonymised usage patterns.
• Complying with legal obligations under Indian law.

We do not sell, rent, or share Tenant data with advertisers or third-party data brokers.

A3. Tenant Control Over Your Profile

You control what information is publicly displayed on your digital card and offer pages — including which fields, images, and links appear. You may update or remove any publicly visible content at any time from your dashboard.

A4. Tenant Rights Under DPDP Act

• Access: Request a copy of your personal data we hold.
• Correction: Update inaccurate or incomplete data.
• Erasure: Request deletion of your account and associated data (subject to legal retention obligations).
• Consent withdrawal: Withdraw consent for non-essential processing at any time.
• Grievance redressal: Raise a complaint with our Grievance Officer (details in Section C).

To exercise these rights, contact us at the details in Section C. We will respond within 30 days.

B1. What Data Is Collected When You Scan

When you submit your details on a Victo Grow offer page, the following data is collected:

• Name and phone number — required to claim an offer, earn loyalty points, or enter a contest.
• Star rating and written feedback — only if you use a Feedback or Review link and choose to provide them.
• Claimed offer code — the unique or generic code issued to you.
• Consent timestamp and IP address — recorded automatically when you submit the form, as required by the DPDP Act.

B2. Who Controls Your Data

The business whose QR code you scanned (the "Tenant") is the Data Fiduciary for your data — they control how it is used for their marketing and customer service. Victo Grow acts as the Data Processor, storing and providing access to this data on the Tenant's behalf.

For questions about how a specific business uses your data, please contact that business directly. For concerns about Victo Grow's role as processor, contact us at the details in Section C.

B3. How Your Data Is Used

• To deliver the offer, code, loyalty points, or contest entry you requested.
• To allow the business to contact you via WhatsApp or SMS about their offers and services.
• To record your consent to data collection as required by Indian law.

B4. Opting Out of WhatsApp & SMS Messages

Every WhatsApp or SMS message sent by a business through Victo Grow includes a short opt-out link (e.g., grow.victoapp.com/opt-out?…). Clicking this link:

• Immediately records your opt-out preference in our system.
• Prevents that business from sending you further WhatsApp/SMS messages through the Victo Grow platform.
• Does not affect your ability to use the business's services in person.

The opt-out link is cryptographically signed — it can only opt out your own number, and cannot be forged to opt out someone else.

If the business re-enables messaging for your number, you will again receive an opt-out link in every subsequent message. You may also contact the business directly to request that messaging be stopped permanently.

B5. Customer Rights Under DPDP Act

As a data principal, you have the right to:

• Know what data was collected about you and by which business.
• Correct inaccurate personal data.
• Erase your data — contact the business directly, or contact us if the business is unresponsive.
• Opt out of marketing messages as described in Section B4.
• Withdraw consent at any time by contacting the business or us.

C1. Data Storage & Security

• All data is stored on servers hosted by Hostinger (located in the EU/Asia-Pacific regions). Hostinger is our infrastructure sub-processor.
• Payments are processed by Razorpay, a PCI-DSS compliant payment gateway. We do not store card numbers or UPI credentials.
• Passwords are hashed using industry-standard algorithms — we cannot retrieve them.
• Access to personal data is restricted to authorised Victo Grow personnel on a need-to-know basis.
• OTP codes expire within 10 minutes and are never logged.

C2. Data Retention

• Tenant account data is retained for the duration of the account and for 90 days after account deletion (to allow recovery in case of accidental deletion), then permanently erased.
• Customer lead data (name, phone, codes, ratings) is retained for as long as the Tenant's account is active. When a Tenant deletes their account, associated customer data is deleted within 30 days.
• Consent records are retained for 5 years as required by the DPDP Act.
• Opt-out records are retained indefinitely so that opt-out preferences are always honoured, even if re-enabled and then opted out again.
• Payment and billing records are retained for 7 years as required by the Income Tax Act.

C3. Cookies & Local Storage

Victo Grow uses the following browser-side storage:

• Session cookies: Required for secure login and CSRF protection. Deleted when you close your browser.
• localStorage (preferences): Dark mode toggle, text-size setting, and customised message templates are stored locally in your browser. This data never leaves your device and is not transmitted to us.
• We do not use advertising cookies, cross-site tracking cookies, or analytics cookies from third parties.

C4. Sub-Processors

We share data with the following sub-processors only to the extent necessary to provide our service:

C5. Children's Privacy

Victo Grow services are not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child's data has been submitted, please contact us and we will delete it promptly.

C6. Changes to This Policy

We may update this Policy from time to time. We will update the "Last updated" date at the top and notify Tenants via email or in-app notification for material changes. Continued use of the platform after the effective date constitutes acceptance of the revised Policy.

C7. Grievance Officer & Contact

In accordance with the DPDP Act and the IT (Intermediary Guidelines) Rules, we have appointed a Grievance Officer. For any privacy-related questions, requests, or complaints:

• WhatsApp / Call: +91 88481 20375
• Email: support@victoapp.com
• Response time: We aim to acknowledge within 48 hours and resolve within 30 days.

If you are not satisfied with our response, you may escalate to the Data Protection Board of India once it is constituted under the DPDP Act.