Privacy Policy
Last modified on October 16, 2026
1. Introduction and Legal Framework
This Privacy Policy constitutes a legally binding document published in accordance with the provisions of the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023 (DPDPA). It explicitly governs the collection, processing, storage, and transfer of data by Geophrase Web Services LLP ("we", "us", "our") through the Geophrase platform, APIs, and related infrastructure (the "Service").
In this Privacy Policy, “you” means any person who accesses or uses the Service, including businesses that hold a Geophrase account (“Client”), their team members and delivery agents, and customers and visitors who use a Geophrase store link, address picker or order link. By accessing or utilizing the Service, you explicitly consent to the data practices described herein. If you do not agree with any provision of this Privacy Policy, your sole recourse is to immediately terminate your use of the Service.
2. Explicit Designation of Fiduciary and Processor Roles
To the maximum extent permitted by Indian law, our liability regarding data processing is strictly defined by our role:
Client Data (Data Fiduciary): For information related to your business account (e.g., admin names, billing details, API logs), we act as the Data Fiduciary.End-User and Agent Data (Data Processor): For data routed through our Service regarding your end-customers (addresses, phone numbers, orders) and your delivery agents (locations at delivery events, names, OTPs, photo proofs), we act as a Data Processor, and you, the Client, are the Data Fiduciary. The exceptions are customer profiles in Geophrase store links and address pickers (section 4) and delivery agents’ App accounts and identity verification (see our App Privacy Policy at geophrase.com/app-privacy), for which Geophrase is the Data Fiduciary.
The Client explicitly warrants that it has established a lawful basis and obtained unambiguous, verifiable consent from its end-customers and delivery agents prior to transmitting their data to our servers. We bear absolute zero liability for any legal claims, penalties, or damages arising from the Client’s failure to obtain lawful consent under Section 6 of the DPDPA.
3. Information We Collect and Process
We collect and process the following categories of data:
Account & Financial Data: Entity names, contact numbers, email addresses, and wallet transaction histories.Logistics & Location Data: Customer delivery addresses, spatial coordinates, and physical GPS coordinates of your delivery agents captured when a delivery is marked delivered or failed, when a photo proof is replaced, or when a planned route is requested.Verification Data: One-Time Passwords (OTPs) and associated delivery event timestamps.Automated Telemetry: IP addresses, user-agent strings, device identifiers, and API interaction logs used for security monitoring and rate-limiting.Delivery Proof Data: Photo proofs and notes recorded by delivery agents or uploaded by your team.Store Link Data: Order requests sent by customers through your store link, and the catalogue images you upload.Order Links: Each order gets a short link (gphr.in/…) that shows the delivery address and map location to anyone who has the link, for a limited period.Payment Data: Wallet payments are processed by Razorpay. We receive the payment status and reference, not your card or bank details.Delivery Agent Data: Data collected through the rider app, including identity verification, as described in our App Privacy Policy at geophrase.com/app-privacy.Sign-up Source Data: How you first found our website (the referring website's domain, the source tag in the link if there is one, and the first page you visited), recorded in your browser on your first visit and stored with your account when you sign up, together with your optional answer to how you heard about us.
4. Customers Using a Geophrase Store Link or Address Picker
When you sign in to a Geophrase store link or address picker with your mobile number, Geophrase stores your mobile number, the addresses, contact names and map locations you save, and your recent map searches, so you can reuse them with any business that uses Geophrase. For this profile, Geophrase is the Data Fiduciary. When you place an order or share an address with a business, that business becomes the Data Fiduciary for that order and its delivery data. To delete your saved addresses or profile, email support@geophrase.com.
5. Utilization of Data
Data processed through our Service is utilized strictly for the following purposes:
To execute our obligations as a Data Processor as per your API calls and dashboard configurations.To maintain the integrity, security, and operational stability of the Geophrase infrastructure.To aggregate and anonymize data for internal analytical purposes, system optimization, and routing intelligence. Once anonymized, such data ceases to be personal data and is not subject to this policy.To prevent fraud, investigate malicious API usage, and enforce our Terms and Conditions.
Website and Dashboard Analytics: We use third-party analytics services, including Google Analytics and Microsoft Clarity, to understand how visitors and users interact with our website and dashboard, identify usability issues, and guide improvements to our services for all users. These services may collect interactions such as clicks, scrolling, and page navigation to create heatmaps and session replays, and may use cookies and similar technologies where permitted. Page content, including personal or business information displayed outside masked fields, may be collected and transmitted to these analytics providers for processing. This behavioral analytics is separate from the aggregated and anonymized analytics described above. For more about how Microsoft collects and uses data, see the Microsoft Privacy Statement at https://privacy.microsoft.com/privacystatement.
6. Mandatory Disclosures and Law Enforcement
We maintain a strict policy against selling or unauthorized sharing of personal data. However, we may disclose your data, your agents' data, or your customers' data without your prior consent under the following conditions:
To comply with a lawful order, subpoena, or request from Indian law enforcement, cyber-security agencies (e.g., CERT-In), or judicial authorities.To third-party service providers (e.g., cloud hosting, SMS and email gateways, Razorpay for payments, Google Maps, Sentry for error monitoring, Cashfree for identity verification, Firebase for push notifications, and Google Analytics and Microsoft Clarity for analytics) bound by strict confidentiality agreements, solely to facilitate the Service. Some of these providers may process data outside India.To defend Geophrase Web Services LLP against legal claims or liability.To a successor entity in a merger, acquisition or sale of all or part of our business.
7. Security and Disclaimer of Liability
While we implement robust, industry-standard security protocols to protect data at rest and in transit, no internet-based system is completely invulnerable.
Disclaimer: You explicitly acknowledge that you are solely responsible for the security of your API keys, login OTPs, email accounts, and the devices used by your managers and delivery agents. We accept absolutely no liability for data breaches, leaks, or unauthorized access resulting from compromised Client credentials, insecure API integrations on your end, or negligence by your staff.
8. DPDPA Rights and "Pass-Through" Protocol
As a Client (Data Fiduciary), you may access, correct, or request the erasure of your business data by contacting us.
End-User Requests: Except where Geophrase is the Data Fiduciary (sections 2 and 4), we act merely as a Data Processor regarding your customers and delivery agents, so any requests from them to view, correct, or erase their data under the DPDPA must be directed to YOU. If Geophrase receives a data rights request directly from your end-customer or agent, we will not fulfill it. We will redirect the request to you, for example to your designated notification contact’s email. It is your sole legal responsibility to respond to the request. Where it requires a change to data held in the Service, you may instruct us by email at support@geophrase.com, and we will act on your documented instructions as your Data Processor, subject to section 9.
9. Data Retention and Audit Ledgers
We retain your Account Data for as long as your account remains active.
Immutable Audit Logs: You explicitly acknowledge and agree that specific operational data, including but not limited to delivery agent assignment histories, delivery event ledgers, GPS timestamps, OTP verifications, and system error logs, constitute critical audit records. To protect against financial fraud, resolve logistical disputes, and ensure compliance with Indian law, these operational audit logs may be subject to a "soft-delete" protocol and retained in our secure databases for as long as necessary for audit, dispute-resolution and fraud-prevention purposes, as permitted or required by law, even following account termination or a data erasure request.
10. Unilateral Modifications
We reserve the absolute right to modify, amend, or update this Privacy Policy at our sole discretion, without prior notice. Any modifications will take effect immediately upon publication on the Geophrase website. Your continued integration with our APIs or use of the dashboard constitutes irrevocable acceptance of the modified Privacy Policy.
11. Jurisdiction and Grievance Redressal
This Privacy Policy is governed exclusively by the laws of India, and any disputes shall be subject to the sole jurisdiction of the courts in Guwahati, Assam.
In accordance with the DPDPA, 2023, and IT Rules, 2011, the designated Grievance Officer can be contacted at support@geophrase.com. Grievances will be acknowledged and addressed within the mandatory statutory timeframes.
How can you contact us about this notice?
If you have any questions or concerns about the privacy policy, please contact us at support@geophrase.com.