Privacy Policy
In short
We collect what we need to run Satyakod, sell it, and keep it secure. Analytics and advertising cookies load only if you agree. We never sell personal data for money. When shoppers scan a product code, we process that scan on behalf of the brand that printed the code. You can reach our Grievance Officer at hello@satyakod.com.
1. Who we are
AnvionixLabs, a sole proprietorship registered in India (GSTIN 09GRRPS7325N2ZJ), with its principal place of business at Niti Khand-1, Plot-230, Indirapuram, Ghaziabad, Uttar Pradesh 201014, India (“AnvionixLabs”, “we”, “us”, “our”). Satyakod is a brand and service of AnvionixLabs.
For privacy questions write to legal@satyakod.com. For complaints, contact our Grievance Officer (section 11).
2. Our two roles
We act as a data fiduciary (under India’s Digital Personal Data Protection Act, 2023, “DPDP Act”) or controller (under the EU and UK GDPR) for personal data of visitors to our websites, prospective customers, and the people who use Satyakod accounts on behalf of our business customers.
We act as a data processor for our business customers (brands) when people scan codes printed on the brands’ products, use a brand’s verification page, or message a brand’s verification bot. In that case the brand decides why the data is processed, and the brand’s own privacy notice applies. We process that data only on the brand’s instructions under our Data Processing Addendum. If your question is about a product scan, please contact the brand; we will also forward requests we receive to the right brand.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Contact and account details | Name, work email, company, job title, phone number, login credentials (stored hashed) | You or your employer |
| Billing details | Billing name, address, GSTIN or tax ID, invoices. Card and bank details are handled by Razorpay; we do not store full card numbers | You, Razorpay |
| Platform usage | Actions in the dashboard, audit logs, IP address, browser and device type, timestamps | Automatically when you use the platform |
| Website analytics and advertising | Cookie and device identifiers, pages viewed, referring site, approximate location from IP address, interactions | Cookies and similar technologies, only with your consent |
| Communications | Emails, support requests, demo requests, call notes | You |
| Scan data (processed for brands) | Code or serial scanned, time, IP address, approximate location derived from IP (or precise location only if the device grants permission on a brand’s page), device and browser type, channel; for the WhatsApp verification bot, phone number and message content | People scanning products, via the brand’s verification channels |
4. Why we use it, and our legal grounds
| Purpose | Legal ground |
|---|---|
| Provide, secure and support the service; create and manage accounts | Performance of a contract; legitimate use for the purpose you provided the data (DPDP); legitimate interests (GDPR) |
| Verify scans, detect clones, diversion and fraud for brands | On behalf of the brand, under its instructions |
| Billing, invoicing, tax and accounting | Contract; legal obligation |
| Respond to enquiries and demo requests; send service and security notices | Contract or steps before a contract; legitimate interests |
| Website analytics and product improvement | Your consent |
| Advertising and measuring campaigns (Google Ads, Meta) | Your consent |
| Marketing emails about our products | Consent, or legitimate interests where the law allows for business contacts; you can unsubscribe at any time |
| Comply with law, enforce our terms, protect rights and safety | Legal obligation; legitimate interests |
Where we rely on consent you can withdraw it at any time, as easily as you gave it. Withdrawal does not affect processing that happened before it.
7. International transfers
Our website is hosted by Vercel, served from its global network with processing in Mumbai, India. Our application servers are hosted by Veeble in a United States data centre. Files, email and code-signing keys are handled by Amazon Web Services in its Mumbai region, India. Several of our providers operate in the United States and other countries; our Sub-processors page lists each one and where it operates. We may move hosting to other regions, including India, and will update this policy when we do.
Under the DPDP Act, personal data may be transferred outside India except to countries the Government of India restricts by notification; we will comply with any such restriction. For personal data from the EU, UK or Switzerland, we use the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another valid transfer mechanism.
8. How long we keep it
- Scan data and website analytics data: up to 26 months from collection, then deleted or anonymised, unless a brand customer instructs earlier deletion or the law requires longer.
- Account and platform data: for as long as the customer’s contract is active, then up to 26 months to handle renewals, disputes and support, after which it is deleted or anonymised.
- Enquiries and demo requests that do not become customers: up to 26 months from our last contact with you.
- Invoices and accounting records: as long as tax, GST and accounting laws require.
- Security logs: as long as needed to investigate incidents, normally no more than 12 months.
9. How we protect it
We use reasonable security safeguards appropriate to the data, including encryption in transit (TLS), code-signing keys held in AWS Key Management Service in India, access controls based on least privilege, hashed passwords and API keys, logging of administrative actions, and separation of each customer’s data. No system is perfectly secure, so we cannot guarantee absolute security.
If a personal data breach occurs, we will notify the Data Protection Board of India and affected people as the DPDP Act and its rules require, notify other regulators where applicable, and inform affected brand customers without undue delay.
10. Your rights
Depending on where you live, you have some or all of these rights:
- India (DPDP Act): to obtain a summary of your personal data and how it is processed; to correct, complete, update or erase it; to withdraw consent; to grievance redressal; and to nominate someone to exercise your rights in the event of death or incapacity.
- EU, UK and similar laws: to access, rectify, erase, restrict or object to processing, to data portability, to withdraw consent, and to complain to your data protection authority.
- US states with privacy laws (such as California): to know, access, correct and delete personal data, to opt out of the sale or sharing of personal data and of targeted advertising, and not to be discriminated against for exercising these rights. You may use an authorised agent.
To exercise a right, email legal@satyakod.com. We may need to verify your identity. We respond within 30 days, or sooner where the law requires. For scan data processed on behalf of a brand, we will pass your request to that brand and help it respond.
11. Grievance Officer
Grievance Officer, AnvionixLabs, Niti Khand-1, Plot-230, Indirapuram, Ghaziabad, Uttar Pradesh 201014, India. Email: hello@satyakod.com.
We acknowledge grievances within 7 days and aim to resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India, or to the data protection authority where you live.
12. Children
Satyakod is a business service and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
13. Automated assessments
Verification verdicts (Genuine, Suspicious, Counterfeit) are automated assessments of whether a product code is authentic. They are about products, not people, and we do not use them to make decisions with legal or similarly significant effects on individuals.
14. Changes to this policy
We will update this page when our practices change and revise the “Last updated” date. If changes are material, we will tell customers by email or in the product before they take effect.