This Privacy Policy explains how Zephor Innovations Private Limited ("Zephor", "we", "our", or "us") collects, uses, stores, and protects your personal information when you use our platform, including our Reverse Vending Machine (RVM) network, Merchant Portal, consumer rewards programme, and associated websites.
1. Who We Are
Zephor Innovations Private Limited
No 17, M F Road, Navalpur, Walajapet, Vellore, Tamil Nadu – 632401, India
Email: [email protected]
Phone: +91 93843 75850
We are a plastic-waste collection and recycling technology company operating a network of smart Reverse Vending Machines. Our services connect consumers, retailers, RVM operators, and recyclers on a single reward-driven platform.
2. Information We Collect
2.1 Information You Provide
- Account registration: name, email address, mobile number, and (for businesses) GST number, company name, and address.
- KYC / onboarding: identity documents required for retailer and RVM operator accounts.
- Enquiry forms: contact details and messages submitted through our website.
- Newsletter: email address when you subscribe.
2.2 Information We Collect Automatically
- RVM usage data: bottle deposits (count, timestamp, machine ID), points credited, and OTP verification records.
- Device data: machine health metrics, camera snapshots used for bottle verification (processed by on-device ML — not stored beyond the session).
- Log data: IP address, browser type, pages visited, and timestamps when you access our web portals.
- Cookies and similar technologies: session cookies for authentication; no third-party advertising cookies.
2.3 Information from Third Parties
- Payment confirmation data from Razorpay (we do not store card or bank details).
- Authentication tokens from AWS Cognito for secure sign-in.
3. How We Use Your Information
- Operate, maintain, and improve the Zephor platform and RVM network.
- Credit and manage reward points for consumer deposits.
- Verify retailer and RVM operator accounts (KYC).
- Process coupon redemptions and payments.
- Send transactional emails and SMS OTPs (via AWS SES and SNS).
- Respond to enquiries and provide customer support.
- Monitor machine health and detect fraud or misuse.
- Comply with applicable laws and regulations in India.
- Send our newsletter (with your consent — unsubscribe any time).
We do not sell, rent, or trade your personal information to third parties for marketing purposes.
4. Legal Basis for Processing
We process personal data on the following grounds under applicable Indian data protection law:
- Contract: to fulfil our obligations when you use Zephor services.
- Consent: for newsletters and optional communications.
- Legitimate interest: fraud prevention, platform security, and service improvement.
- Legal obligation: compliance with Indian law, including tax and regulatory requirements.
5. Data Sharing and Disclosure
We may share your data with:
- Service providers: AWS (cloud infrastructure, email, SMS), Razorpay (payments), Cloudflare (CDN and tunnelling). These are bound by data processing agreements.
- RVM operators: transaction data related to machines they operate.
- Retailers: coupon redemption details necessary to honour rewards.
- Law enforcement or regulators: when required by applicable law or court order.
- Business transfers: in the event of a merger, acquisition, or sale of assets, subject to confidentiality obligations.
6. Data Retention
- Account data is retained for the duration of the account plus 3 years after closure, or as required by law.
- Transaction logs are retained for 7 years for financial compliance.
- Newsletter subscriptions until you unsubscribe.
- Enquiry records for 2 years.
- Camera snapshots used for bottle verification are processed on-device and are not transmitted or stored.
7. Data Security
We implement industry-standard security measures including:
- HTTPS (TLS) for all data in transit.
- HMAC-SHA256 authentication for RVM-to-server communications.
- AWS Cognito for secure authentication with multi-factor support.
- Role-based access control across all portals.
- Error and access logging to detect anomalies.
No method of transmission over the internet is 100% secure. In the event of a data breach affecting your rights, we will notify you in accordance with applicable law.
8. Your Rights
Subject to applicable Indian data protection law, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Erase your data (where there is no legal obligation to retain it).
- Withdraw consent for optional processing (e.g., newsletter).
- Object to processing based on legitimate interests.
- Lodge a complaint with the appropriate data protection authority.
To exercise any right, email us at [email protected]. We will respond within 30 days.
9. Cookies
Our websites use strictly necessary session cookies for authentication and CSRF protection. We do not use tracking or advertising cookies. You can disable cookies in your browser settings; however, this will prevent you from logging in to our portals.
10. Children's Privacy
Our services are not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date above and, where appropriate, notify you by email. Continued use of our services after changes constitutes acceptance of the revised policy.
12. Contact Us
For any privacy-related questions or to exercise your rights, please contact our Data Protection point of contact: