Introduction
- SPINTag is a camera-based geostamping, registration and audit-support application. We collect the data necessary to operate the Platform, including account information, email, date and time information, image and video data and associated metadata, location data, audit data, device and technical information, and support information, as described in this Privacy Policy.
- SPINTag enables Users to capture images and videos and associate them with geographic and time information, including latitude, longitude, altitude, DigiPIN and timestamps. The Platform may use DIGIPIN and ESRI geospatial technologies, where applicable, to support location-related and mapping functionality. Such information may be used to generate a geostamp overlay and saved image or video information, and to create or maintain associated registration and audit records.
- When a User is signed in and a network connection is available, SPINTag may upload or synchronize Audit Data only (not image or video files) with its servers and cloud infrastructure. Image and video files, and associated geographic and time information (including latitude, longitude, altitude, DIGIPIN, address and capture timestamps), remain on the User’s device and are not stored on SPINTag’s cloud servers. Audit Data may include cryptographic hashes or fingerprints, device and App IDs that do not directly identify the User, randomly generated device IDs, signatures and, where applicable, optional device public keys used to sign capture manifests. Where a server record is created, ordinary server processing timestamps (for example record created-at time) may also be stored; these are not capture timestamps.
- The App can also be used offline. Where network connectivity is unavailable, images, videos, metadata and associated information may remain stored in the App's storage on the device until Cloud Audit Data synchronization becomes available.
- SPINTag does not claim ownership of image or video content or metadata that a User lawfully owns. Such content and metadata may nevertheless be stored, processed, reproduced, transmitted and otherwise used as reasonably necessary to provide the Platform and its audit, registration, geostamping, integrity-verification and administrative functions, in accordance with the SPINTag Terms and Conditions.
- SPINTag does not continuously access or process your location in the background. Location information is processed only when you grant the relevant device permission and use a feature that requires location information.
- SPINTag does not sell personal data to third parties and does not collect advertising identifiers for advertising purposes.
Delete Request
- You may uninstall the App at any time; however, uninstalling the App does not delete your account.
- Account Deletion Pathways: Users may request account deletion through:
- In-App: Where available, through Settings → Delete Account. Following verification, the account will be disabled and account-related Personal Data will be deleted or anonymised in accordance with this Privacy Policy and applicable law.
- Web: Where available, via https://spintag.iittnif.com/delete-account/index.html.
- Email Request: If you cannot access the App, you may email software@iittnif.com. We may request reasonable information to verify your identity.
- Deletion Processing: Verified deletion requests will generally be processed within approximately 30 days.
- Following a verified deletion request, account-related cloud information will generally be deleted or anonymised, including:
- Account profile information, such as name, email address, phone number, and role;
- Login information, including password and password-reset information;
- Cloud Audit Data, including hashes, signatures, device and App identifiers, and related audit linkage information;
- Device public keys associated with the account; and
- Support records linked to the account, where stored.
- Cloud Audit Data and related account-linked audit records may be retained where lawfully permitted or required or where reasonably necessary for integrity verification, administrative review, security, fraud prevention, dispute resolution, legal compliance or another continuing lawful purpose. Photograph and video files are not stored on SPINTag’s cloud servers and are not retained there after account deletion; media remaining on the User’s device are under the User’s device storage controls.
- Backup copies may remain for up to approximately 90 days as part of ordinary backup and disaster-recovery processes before being removed in accordance with applicable backup procedures, subject to any legal preservation requirement.
- This Privacy Policy should be read together with the SPINTag Terms and Conditions. The Terms and Conditions govern the contractual terms applicable to your use of the Platform, including account use, image and video capture, geostamping, user content, cloud audit data, audit and registration workflows, prohibited conduct, suspension and termination, intellectual property and other Platform rules.
- This Privacy Policy governs the collection, use, disclosure, retention, deletion and protection of Personal Data by SPINTag.
Who we are
- This Privacy Policy explains how IIT Tirupati Navavishkar I-Hub Foundation (IITTNiF), an entity incorporated in India with its registered office in Andhra Pradesh (“SPINTag”, “we”, “us” or “our”), collects, uses, shares, stores and protects personal data through the SPINTag mobile application and related services (the “App” or “Platform”).
- SPINTag provides geostamping, registration, audit, integrity-verification, cloud synchronization and administrative-review functionality.
- A User may provide information required to create and maintain an account and to associate the User with relevant registration and audit records.
- Where required under applicable law, we will publish the details of our Grievance Officer, Data Protection Officer or other designated privacy contact.
Definitions
- For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:
- “App” means the SPINTag mobile application, including its updates, features and related services.
- “Platform” means the App, software, servers, databases, cloud infrastructure and related services operated or made available by SPINTag.
- “Service” means the image and video capture, geostamping, registration, audit, integrity-verification, synchronization, administrative-review and related functionalities provided through the Platform.
- “User” means an individual who accesses, registers for or uses the App.
- “User Content” means images, videos and other content captured or stored by a User through the Platform, as further governed by the SPINTag Terms and Conditions.
- “Audit Data” means information generated or associated with a image, video, submission, or registration workflow for audit, registration, integrity-verification, security or administrative-review purposes.
- “Location Data” means latitude, longitude, altitude, DIGIPIN and other geographic information associated with an image, video, submission or registration workflow.
- “Cloud Audit Data” means Audit Data uploaded or synchronized to SPINTag’s servers or cloud infrastructure. It does not include image or video files, Location Data, address information or capture timestamps, which remain on the device.
- “Personal Data” shall have the meaning assigned to it under applicable data protection law, including the Digital Personal Data Protection Act, 2023, as applicable.
What data we collect
- We collect personal data and other information reasonably necessary to provide, maintain, secure and operate the App.
- Depending on how you use the App, we may collect:
- 1. Account and personal information, such as your name, email address, password, phone number if provided, role, account information and authentication information.
- Such information may be associated with the User account for account administration, authentication, account security.
- Passwords are stored in hashed form on the server and are not stored as plain-text passwords.
- 2. Images and videos captured through the App are stored locally on the User’s device and are not uploaded to or stored on SPINTag’s cloud servers. We may, however, process associated metadata available on the User’s device, including the date and time of capture, geostamp/location information, timestamps, and other related metadata.
- 3. Location information, including latitude, longitude, altitude, DIGIPIN and other geographic information associated with captures and registration workflows.
- Such information may be used for geostamping, saved image or video information, registration records, audit records, integrity verification and administrative review.
- SPINTag does not continuously access Location Data in the background. Location Data is accessed when the relevant permission has been granted and a feature requiring Location Data is being used.
- 4. Audit Data, including cryptographic hashes or fingerprints, App identifiers, randomly generated device IDs, signatures and other information associated with the integrity, registration or audit status of a photograph or submission record. Capture timestamps remain on the device; where Cloud Audit Data is stored, ordinary server processing timestamps may apply.
- Where applicable, SPINTag may also process optional device public keys used to sign capture manifests or support capture-integrity verification.
- 5. Cloud synchronization information, meaning Cloud Audit Data only (for example hashes, signatures, device and App identifiers and optional device public keys), uploaded when you are signed in and a network connection is available. This does not include image or video files, Location Data, address information or capture timestamps.
- 6. Device and network information, such as connectivity status and checks, App version, device and application configuration information, network information, technical logs and device or application identifiers where required for the operation, security or maintenance of the Platform. The mobile App does not currently integrate dedicated crash-reporting or advertising analytics SDKs; where diagnostics tooling is introduced later, this Policy will be updated.
- 7. Support and feedback information, including optional bug reports, screenshots, technical descriptions and other information that you voluntarily submit through the App or our support channels.
- 8. Device Permissions, including access to the camera, storage/photos, location and other device functions where required for specific App features. The App accesses these device functions only when required for the applicable feature and subject to the permissions granted by you.
How we use your data
- We use personal data and other information to:
- Create and manage User accounts;
- Authenticate Users and secure the App;
- Enable Users to capture and store images and videos on the device;
- Generate geostamp overlays and saved image or video information;
- Associate photographs and videos with geographic and time information;
- Create and maintain registration and audit records;
- Generate and verify cryptographic hashes and fingerprints;
- Synchronize and Audit Data;
- Conduct integrity verification and administrative review;
- Maintain the security and integrity of the Platform;
- Prevent fraud, misuse, manipulation and unauthorised activity;
- Maintain, troubleshoot and improve the App;
- Respond to support requests and bug reports;
- Maintain backups and disaster-recovery systems;
- Comply with applicable legal and regulatory requirements; and
- Establish, exercise or defend our legal rights where necessary.
- Where images, videos or Audit Data contain Personal Data or information associated with an identifiable User, such information will be processed in accordance with this Privacy Policy.
Consent and permissions
- Before accessing or using features requiring device permissions, SPINTag may request permission to access the camera, storage/photos, location or other device functionality required for the relevant App feature.
- By approving the relevant permissions through your device, you permit SPINTag to access the applicable functionality for the purposes described in this Privacy Policy.
- Camera: to capture images and videos that you choose to take through the App;
- Microphone: to capture audio as part of a video recording you start, while that recording is in progress (not continuous background recording).
- Storage/Photos: to store photographs within the App, save photographs where supported, or access photographs or files selected by you where the relevant feature permits such access;
- Location: to obtain latitude, longitude, altitude and other geographic information when required by an App feature, including geostamping, capture, registration and audit functionality (within the app); and
- Other device functionality: where required for a specific App feature and subject to the applicable device permission.
- Granting a permission does not mean that SPINTag will continuously access the relevant information. Access will occur only when required for the applicable feature.
- You may withdraw or change device permissions through your device settings. Doing so may limit features that require the relevant permission. Withdrawal does not affect lawful processing already carried out or processing otherwise permitted or required by applicable law.
Image and Video Submission, Geostamping and Audit System
- A User may use the App to capture an image or video on the device and associate it with geographic and time information.
- Depending on the applicable feature, SPINTag may process latitude, longitude, altitude, DIGIPIN and timestamp information associated with the captured image or video to generate a geostamp overlay and saved footer.
- These information may also be associated with cryptographic hashes or fingerprints, device and App identifiers, signatures and other Audit Data.
- SPINTag processes images, videos and associated information for purposes including geostamping, capture and registration, integrity verification, administrative review, security and fraud prevention.
Cloud Audit and Synchronization
- When you are signed in and a network connection is available, SPINTag may upload or synchronize Cloud Audit Data with its servers and cloud infrastructure. Depending on the applicable workflow, such information may include: cryptographic hashes or fingerprints; device and App identifiers; signatures; randomly generated device IDs; and optional device public keys used to sign capture manifests. Image and video files, Location Data, address information and capture timestamps remain on the device and are not uploaded to SPINTag’s cloud servers.
- The App can also be used offline. Where network connectivity is unavailable, images, videos and metadata may remain stored locally on the device until connectivity is restored and Cloud Audit Data synchronization becomes available.
User Content and Platform Rights
- Users may capture and store photographs, videos and other User Content on the device. Where signed in and online, associated Cloud Audit Data may be synchronized; photograph and video files are not uploaded to SPINTag’s cloud servers.
- SPINTag does not claim ownership of images or videos that a User lawfully owns. The ownership and intellectual property rights in such images or videos remain with the User or the respective rights holder, as applicable.
- The contractual rights granted to SPINTag in relation to User Content, including the rights necessary to process User Content on-device and to store, host, process, transmit and synchronize related Cloud Audit Data for operation and provision of the Platform, are governed by the SPINTag Terms and Conditions.
- The processing of Personal Data contained in or associated with User Content is governed by this Privacy Policy.
Device Storage and Gallery
- Images and videos captured through the App may be stored in the App's storage on the device and may also be saved to the device's gallery where supported by the device and where the applicable system permission is granted. Images and videos stored on the device may contain geographic information, including altitude, address information, timestamps, geostamp information and other metadata.
- SPINTag does not control the storage, backup, synchronization or processing of photographs and videos after they are saved outside the App.
Information That May Be Retained After Account Deletion
- Account deletion concerns the cloud account and Cloud Audit Data. It does not necessarily result in immediate deletion of every Cloud Audit Data record that SPINTag is entitled or required to retain, and it does not delete photograph or video files stored only on the User’s device.
- Cloud Audit Data and related account-linked records may be retained where reasonably necessary for:
- registration or verification;
- integrity verification;
- administrative review;
- security and fraud prevention;
- legal compliance;
- dispute resolution; or
- backup and disaster recovery.
- Where such information is retained, SPINTag will retain it only for the applicable lawful purpose and for the period reasonably necessary for that purpose.
- Where reasonably practicable, retained information that no longer needs to remain associated with an active account may be anonymised or de-linked from the User's identifying account information.
Sharing and Disclosure of Information
- SPINTag processes Personal Data primarily for the purposes described in this Privacy Policy.
- We do not sell, rent, trade or otherwise disclose your Personal Data to third parties for their independent commercial use.
- Cloud Audit Data and other Personal Data may be processed by third-party technical and cloud service providers acting on behalf of SPINTag where reasonably necessary to operate the Platform. Photograph and video files are not uploaded to SPINTag’s cloud infrastructure for ordinary capture synchronization.
- We may disclose Personal Data where required by applicable law, court order, lawful governmental request or other legal obligation, or where reasonably necessary to protect the rights, safety, security or integrity of SPINTag, its Users or the Platform.
- Where disclosure is legally required, we will disclose only the information reasonably necessary for the relevant purpose and in accordance with applicable law.
Security and Incident Response
- We use reasonable technical and organisational safeguards designed to protect Personal Data and Cloud Audit Data (and, on the device, photographs, videos and related local metadata processed by the App), including, where appropriate, access controls, authentication mechanisms, encryption in transit, encryption at rest where appropriate, secure infrastructure, access restrictions, logging and monitoring, integrity-verification mechanisms and review of security events.
- No electronic system is completely secure, and we do not guarantee absolute security.
- If we become aware of a personal data breach or qualifying cybersecurity incident, we will take reasonable steps to contain, investigate and mitigate the incident and notify affected Users and relevant authorities where required under applicable law. Where applicable, cybersecurity incidents will also be handled in accordance with CERT-In directions and other applicable legal requirements.
Retention
- We retain Personal Data only for as long as necessary to fulfil the purposes described in this Privacy Policy, operate and maintain the Platform, maintain registration and audit records, conduct integrity verification, maintain security, prevent fraud and misuse, resolve disputes and comply with applicable legal requirements.
- Cloud Audit Data may be retained for as long as reasonably necessary for the applicable audit, integrity-verification, administrative or other lawful purpose. Image and video files are not stored on SPINTag’s cloud servers.
- Backup copies may remain for up to approximately 90 days as part of ordinary backup and disaster-recovery processes before being removed in accordance with applicable backup procedures, subject to any legal preservation requirement.
Data Rights and Grievance Redressal
- Subject to applicable law, you may request access to your Personal Data, correction or updating of inaccurate or incomplete Personal Data, and deletion of Personal Data where it is no longer necessary and is not required to be retained for a lawful purpose.
- You may also withdraw consent where the relevant processing is based on consent and raise a grievance concerning the processing of your Personal Data.
- You may exercise your privacy rights or submit a privacy-related request by contacting us at software@iittnif.com, preferably from the email address associated with your account, with the subject line “Attention Grievance Officer – [brief issue description]”.
- We may request reasonable information to verify your identity before processing your request.
- Requests relating to the removal of an individual image, video or other User Content may require sufficient information to identify the relevant information.
- A request for deletion does not necessarily require SPINTag to delete information that is required to be retained for an ongoing audit, integrity verification, legal compliance, security, fraud prevention, dispute resolution, backup or another continuing lawful purpose.
- We will process and respond to your request within the timeframe prescribed under applicable law. If you are not satisfied with our response, you may exercise any further rights or remedies available to you under applicable law.
Children
- The App is intended for general audiences and is not designed for or directed to children under the age of 13 years. We do not knowingly collect Personal Data from children under 13 in violation of applicable law.
- If you are a parent or guardian and believe that a child under 13 has provided Personal Data through the App, please contact us at software@iittnif.com and we will take appropriate steps to address the matter, including deletion of the information where required by applicable law.
- Users who are 13 years of age or older but have not reached the age of legal majority in their jurisdiction should use the App with appropriate parental or guardian involvement where required or appropriate under applicable law.
SDKs and Third-Party Services
- SPINTag may use third-party technologies and services for hosting, authentication, security, infrastructure, mapping and other technical functions necessary to operate the App. Ordinary capture synchronization does not upload photograph or video files to cloud storage. The mobile App does not currently use dedicated crash-reporting or advertising analytics SDKs.
- These services may process device information (including randomly generated IDs), network information, technical logs and other technical data as necessary for the App’s functionality, security and performance.
- Where applicable:
- Esri World Imagery may provide satellite imagery for geostamp mini maps and satellite layers.
- OpenStreetMap may provide street map tiles on the Photo Map screen.
- Map attribution details may be available under Settings → Map Credits. Use of third-party services is subject to their applicable terms, licences and policies. SPINTag does not use Personal Data collected through the App for advertising or targeted advertising.
Digipin And Government Information
- DIGIPIN (Digital Postal Index Number) is a geo-coded addressing system developed by the Department of Posts, India Post. Where applicable, SPINTag may use the publicly available DIGIPIN specification to generate or display a DIGIPIN based on geographic coordinates associated with the device or a captured image or video.
- Any DIGIPIN displayed through SPINTag is generated or processed by the App based on the applicable technical specification and is not issued, certified, verified or endorsed by India Post or the Government of India through the App.
- Image and video integrity verification, digital signature verification and audit features provided through SPINTag are technical features of the Platform only and do not constitute government verification, certification, endorsement or legal proof.
Cookies and Tracking Technologies
- Where SPINTag operates related websites, it may use cookies or similar technologies, where applicable, for authentication or session security. SPINTag does not currently use cookies on the mobile App for advertising or analytics.
- The mobile App may use technical mechanisms necessary for authentication, security and Cloud Audit Data synchronization and other core functionality.
- SPINTag does not currently use advertising identifiers for advertising purposes.
- Where cookies or similar tracking technologies are introduced or materially changed, we will update this Privacy Policy and, where required, provide appropriate disclosures or consent mechanisms.
Changes to this Policy
- We may update this Privacy Policy from time to time. The updated version will show a revised “Last Updated” date and will be made available through the App and/or our official website.
- Changes may be made where new features are introduced, existing features are modified, our data practices change, our technical infrastructure changes, cloud or technical service arrangements change, or applicable laws or regulatory requirements change.
- Where required by applicable law, we will provide additional notice or obtain consent before implementing material changes.
- Users are encouraged to periodically review this Privacy Policy to remain informed of our current data practices. Your continued use of the App following the effective date of an updated Privacy Policy constitutes acceptance of the revised Privacy Policy to the extent permitted by applicable law.