Privacy Policy

1. Who we are

Solve24 is a hyperlocal services marketplace operated from India at solve24.in. We connect customers with local workers (plumbers, electricians, carpenters, painters, cooks, drivers and other home-services trades) and shops. We never charge commission on the worker's rate — the price agreed between customer and worker is what the customer pays, directly to the worker.

In DPDP Act terms, Solve24 is a Data Fiduciary: we decide the purpose and means of processing your personal data. You are the Data Principal whose data we process.

2. What personal data we collect

We collect only the data we need to run the service. Specifically:

We do NOT knowingly collect data from children under 18. If you believe we have, write to our Data Protection Officer below and we will delete immediately.

3. Your consent — how it works

Under DPDP Act, we process your data on the basis of your free, specific, informed, unambiguous consent. At signup you give one required consent (service processing — needed to run the platform) and one optional consent (marketing emails / updates). You can withdraw either consent any time at /profile/edit or by writing to privacy@solve24.in.

Withdrawing marketing consent only stops promotional emails — transactional emails (payment, mandate, grievance) continue because they are necessary to deliver the service you asked for. Withdrawing service consent deletes your account entirely (see "Delete my data" below).

4. Who we share with

We share your personal data only in these specific cases:

• Processors we rely on — Firebase (Google) for authentication; Razorpay (RBI-licensed PA) for payments; Resend for transactional emails; Cloudflare for infrastructure; Google Analytics 4 + Microsoft Clarity for aggregated analytics; Sentry for crash logging. Each is bound by its own privacy terms and only receives the minimum data needed.
• Other users — if you are a worker, your name, phone, trade, city, service area, work photos, and ratings are shown publicly to help customers find you. If you are a customer who posts a query, your name and query text are visible to workers so they can respond.
• Legal process — when required by Indian law, court order, or by a notified Government request under the IT Act, 2000 or DPDP Act.

We do NOT sell your personal data. We do NOT share your contact details with advertising networks. We do NOT transfer your data outside India except through our listed processors (Google, Razorpay, Resend, Cloudflare — all have Indian legal presence or DPDP-recognised transfer frameworks).

5. How long we keep your data

6. Your rights under DPDP Act

You have five rights at any time, free of charge:

1. Access — see what data we hold on you. Email our DPO; we respond within 7 working days.
2. Correction — fix inaccurate data. Mostly self-serve at /profile/edit, or email DPO.
3. Erasure (delete my data) — delete your account and all associated personal data, except what we are legally required to retain (payment records for 8 years). Self-serve from /profile ("Delete my account") or email DPO.
4. Grievance redressal — complain about how we handle your data. See Grievance Officer section below. SLA: acknowledgement within 48 hours, resolution within 72 hours.
5. Nominate a successor — in the event of your death or legal incapacity, you may nominate a person to exercise these rights on your behalf. Write to the DPO to register a nomination.

7. Security & breach notification

We follow industry-standard controls: TLS encryption in transit, Firebase Auth-managed credentials (we never store passwords), Cloudflare WAF, D1 database access-token-scoped, no personal data in client-side logs, PII scrubbing on crash reports.

If a personal data breach occurs that is likely to cause harm, we will notify the Data Protection Board of India within 72 hours and notify affected users via their registered email, without undue delay, as required by DPDP Act Section 8(6).

8. Cookies and tracking

We use three categories of cookies/trackers:

• Necessary — session, authentication (Firebase), CSRF. These cannot be turned off; the site needs them to function.
• Analytics — Google Analytics 4, Microsoft Clarity. Aggregated behavior to improve the product. Can be rejected via our cookie banner.
• Marketing — Meta Pixel for ad conversion attribution. Can be rejected via our cookie banner.

You can revisit your cookie choice from /profile/edit at any time.

9. Grievance Officer & Data Protection Officer

Under India's IT Rules 2021 and DPDP Act 2023, we are required to designate contacts for your data-related and content-related complaints. For now, both roles are consolidated under one point of contact until our scale requires a separate DPO.

If you are not satisfied with our response, you may approach the Data Protection Board of India (once operationalised under DPDP Act) or any competent court.

10. Changes to this policy

We'll notify you by email (to your registered address) at least 7 days before any material change takes effect. The "Last updated" date at the top of this page always reflects the current version.