Privacy Policy

This Privacy Policy ("Policy") governs the collection, use, storage, disclosure, and protection of personal data by Policy Niketan ("Policy Niketan", "we", "our", "us") through the web application accessible at https://policyniketan.com and any associated services (collectively, the "Platform"). The Platform is a policy record-management tool that enables licensed insurance agents ("Agents", "you", "your") to record, organize, and track policyholder and policy data.

By creating an account, accessing, or using the Platform, you acknowledge that you have read, understood, and agree to the collection and processing practices described in this Policy. If you do not agree with any provision of this Policy, you must discontinue use of the Platform immediately.

This Policy applies to Data Principals whose personal data is processed by the Platform, which includes (a) registered Agents who use the Platform directly, and (b) policyholders and other individuals ("Clients") whose data is entered into the Platform by an Agent in the course of managing insurance records. Where the Platform processes personal data of Clients, the Agent who enters that data acts as the Data Fiduciary in respect of that data under the DPDP Act, and Policy Niketan acts as a processor providing the underlying infrastructure, as further described in Section 6.

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
• "Sensitive Personal Data" means Personal Data that, under applicable law, requires a heightened standard of care, including government-issued identifiers (Aadhaar, PAN) and financial account information.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, alignment, disclosure, or erasure.
• "Data Fiduciary" means the person who determines the purpose and means of processing Personal Data.
• "Data Processor" means a person who processes Personal Data on behalf of a Data Fiduciary.
• "Data Principal" means the individual to whom the Personal Data relates.
• "Consent" means the free, specific, informed, unconditional, and unambiguous indication of a Data Principal's agreement to the processing of their Personal Data.

In order to provide policy record-management functionality, Policy Niketan collects and stores the following categories of data, whether entered directly by you or on behalf of a Client:

• Identity data: full name, father's/mother's/spouse's name, date of birth, gender, address, occupation
• Government identifiers (Sensitive Personal Data): Aadhaar number and Permanent Account Number (PAN)
• Financial data (Sensitive Personal Data): bank account number, IFSC code, bank and branch name
• Contact data: email address and Aadhaar-linked mobile number
• Policy data: current and previous policy numbers, plan and term, sum assured, premium mode and amount, servicing branch, due and payment history
• Account credentials: login email address and password, the latter stored exclusively as a salted one-way cryptographic hash (bcrypt) and never in reversible or plain-text form
• Transaction data: subscription plan, payment status, and payment identifiers generated by our payment processor (Razorpay) — we do not receive, process, or store full card, UPI, or net-banking credentials
• Earlier referral records (Agents who took part before the referral program was suspended): referral relationships, reward amounts and wallet transaction history recorded on your account, and any UPI ID or bank account you saved for payouts. We no longer collect new referral data or ask for payout details. Saved payout details remain stored with field-level encryption, and you may ask us to delete them, or other earlier referral records, at any time (see Section 9)
• Technical and log data: IP address, browser/device metadata, authenticated session identifiers, and application error diagnostics captured automatically for security and reliability purposes

We process Personal Data on the following legal bases recognized under the DPDP Act and applicable contract law:

• Consent: where you or your Client has provided specific, informed consent for the processing of their data for policy record-keeping purposes.
• Performance of a contract: processing necessary to provide the account, subscription, and record-management services you have signed up for.
• Legitimate use / legal obligation: processing necessary for fraud prevention, security monitoring, and compliance with applicable law, including recordkeeping obligations under insurance regulation where relevant.

We do not process Personal Data for behavioral advertising, do not sell or rent Personal Data to third parties, and do not use Client data collected through the Platform for any purpose other than enabling the Agent's own record-management activity and the operation of the Platform itself.

Records are stored in a MongoDB database instance provisioned for the Policy Niketan backend. We implement the following technical and organizational security measures, consistent with the "reasonable security practices and procedures" standard under the Information Technology Act, 2000 and associated rules:

• Transport-layer encryption (HTTPS/TLS) for all data in transit between your browser and our servers
• Stateless authentication via signed JSON Web Tokens (JWT) with defined expiry
• One-way password hashing using bcrypt; passwords are never stored or logged in plain text
• HTTP security headers, including a Content Security Policy, and cross-origin resource sharing (CORS) restrictions limiting which origins may interact with the API
• Request rate-limiting to mitigate brute-force and denial-of-service attempts
• Role-based access control distinguishing Agent, Admin, and Super-Admin privileges, with a further permission-based gate (below) restricting which Admin accounts may view decrypted Sensitive Personal Data
• Field-level encryption at rest (AES-256-GCM) for Aadhaar number, PAN, bank account number, IFSC code, and UPI ID — these fields are never stored as plain text in the database
• Automated application error monitoring (Sentry) to detect and remediate faults, configured to avoid intentional capture of Sensitive Personal Data in error payloads

Permission-gated access to Sensitive Personal Data: your own Aadhaar, PAN, bank, and UPI details are decrypted for you whenever you view your own records. For platform administration, decryption of these fields is restricted to Super-Admin accounts and to Admin accounts individually granted a specific "view sensitive data" permission; an Admin without that permission sees these fields in their encrypted form and cannot read their contents. A narrow exception applies to the specific permission that lets an Admin manually verify a UPI ID for payout processing (a function that is not currently in use), which necessarily requires seeing that one field in order to perform the verification.

No method of electronic transmission or storage is completely secure. While we implement the measures described above, we cannot guarantee absolute security and are not liable for unauthorized access resulting from circumstances outside our reasonable control, including compromise of your own account credentials.

We engage the following categories of sub-processors to operate the Platform. Each processes data solely to the extent necessary to perform its function and is contractually or technically restricted from using the data for independent purposes:

• Hosting — frontend: Vercel Inc., for delivery of the web application
• Hosting — backend: Render, for hosting the application server and API
• Database: MongoDB Atlas, for encrypted-at-rest cloud database infrastructure
• Payments: Razorpay, for processing subscription payments
• Transactional email: our configured SMTP provider, for account verification, password reset, and due-date reminder emails
• Error monitoring: Sentry, for automated capture of application exceptions and stack traces to support reliability

We do not permit any sub-processor to use Personal Data processed through the Platform for advertising, profiling, or any purpose unrelated to the service it provides to us.

Certain sub-processors identified in Section 6 may store or process data on servers located outside India, depending on their respective regional hosting configuration at the time of processing. Where Personal Data is transferred outside India, we take reasonable steps to ensure such transfers are made only to entities that maintain a standard of protection consistent with this Policy and applicable law, subject to the Central Government's power under the DPDP Act to restrict transfers to specific jurisdictions.

Personal Data is retained for as long as your account remains active and the corresponding record has not been deleted. We do not currently apply an automatic deletion schedule to inactive records; retention continues until you delete a record, close your account, or submit a verified erasure request as described in Section 9. Certain limited data, including transaction and audit logs, may be retained for a longer period where necessary to comply with legal, accounting, or fraud prevention obligations.

Subject to applicable law, you have the right to:

• Access a summary of the Personal Data we hold about you and the processing activities carried out
• Correct and update inaccurate or incomplete Personal Data through your account settings or the relevant record
• Erasure of Personal Data that is no longer necessary for the purpose it was collected, subject to legal retention requirements
• Withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal, understanding that withdrawal may limit or disable your ability to use the Platform
• Grievance redressal through the Grievance Officer designated in Section 13, and, where unresolved, escalation to the Data Protection Board of India as constituted under the DPDP Act
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity, in accordance with the DPDP Act

Individual policy records can be deleted directly from the View Records page. To exercise any other right listed above, including full account and data deletion, contact us using the details in Section 15.

The Platform uses strictly necessary session storage and authentication tokens required for you to remain logged in and for the application to function securely. We do not currently deploy third-party advertising or cross-site tracking cookies. Should this change, this Policy will be updated to describe the categories of cookies used, their purpose, and your options for managing them.

The Platform is intended for use by adults acting in a professional capacity as licensed insurance agents. It is not directed at, and we do not knowingly collect Personal Data from, individuals under the age of 18. Where Client data pertains to a minor (for example, a policy taken on behalf of a minor), such data is entered and managed under the responsibility and verifiable consent of the Agent acting as Data Fiduciary for that record, in accordance with Section 9 of the DPDP Act.

In the event of a Personal Data breach that is likely to result in a risk to the rights of affected Data Principals, we will take reasonable steps to contain and remediate the breach and, where required under applicable law, notify the Data Protection Board of India and affected Data Principals within the timelines prescribed under the DPDP Act and its rules.

In accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the DPDP Act, we have designated a Grievance Officer to address complaints or concerns regarding the processing of Personal Data:

Grievance Officer: Mr. Shashank Shekhar Pandey
Email: support@policyniketan.com

We will acknowledge grievances within a reasonable time and endeavor to resolve them within the period prescribed under applicable law.

We may amend this Policy from time to time to reflect changes in our data-processing practices, the Platform's functionality, or applicable law. Material changes will be reflected by updating the "Last updated" date above, and, where the change is significant, we will provide additional notice through the Platform or by email. Continued use of the Platform after a revised Policy is published constitutes acceptance of the revised terms.

For questions about this Policy, to exercise a right described in Section 9, or to raise a grievance, contact us at support@policyniketan.com, or through the Help & Support page. You can also request a call back; the name, mobile number, topic and reason you enter are used only to return your call and handle your request, and are visible only to authorised members of our support team.