Itemised Privacy Notice & Data Protection Policy
Effective Date: October 2026 · Data Fiduciary: Reachzo.online · Zero Social Media Password Collection
This Itemised Privacy Notice is published in compliance with Sections 5, 6, 8, 9, 11, 12, 13, and 14 of the Digital Personal Data Protection Act, 2023 (India) ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"). It explains in clear, plain language what personal data Reachzo.online ("Data Fiduciary", "we", "us") collects from you ("Data Principal"), the specific purposes for which it is processed, the third-party Data Processors involved, our statutory retention schedules, and how you can exercise your rights.
1. Itemised Personal Data Collected & Specific Purposes (Section 5 & Rule 3)
| Data Category | Itemised Personal Data Elements | Specific Purpose of Processing | Lawful Basis |
|---|---|---|---|
| Account Identity | Username, Display Name, Email Address, Optional WhatsApp Number, Password Hash (bcrypt), 18+ Age Confirmation | Account creation, authentication, password recovery OTPs, and order status notifications | Consent & Contractual Service Delivery (Sec. 6) |
| Wallet & Payment Records | Deposit Amount, Order Reference ID, Razorpay Payment/Order ID, Bank/UPI UTR Reference, Promo/Voucher Redemptions | Instant wallet credit verification, fraud prevention, double-spend protection, and statutory tax accounting | Contractual Fulfillment & Legal Obligation (Income Tax / GST / RBI Rules) |
| SMM Order Data | Public Social Media Target Link/URL, Service ID, Quantity, Start Count, Remains (We NEVER ask for or store your social media passwords) | Automated fulfillment of public engagement orders and refill guarantee verification | Consent & Contractual Service Delivery |
| Security & Anti-Abuse Telemetry | Client IP Address, Hashed Device Fingerprint, Login/OTP Rate-Limit Counters, Cloudflare Turnstile Challenge Token | Preventing brute-force attacks, credential stuffing, multi-account bonus abuse, and SSRF/CSRF attacks | Reasonable Security Safeguards (Sec. 8(5) & Rule 6) |
| Optional Marketing & Cookies | Consent Token, UI Theme Preference, Marketing Email Opt-In/Out Status, Unsubscribe Timestamp | Remembering Light/Dark theme and sending optional promotional coupons only when explicitly opted in | Explicit Opt-In Consent (Withdrawable 24x7 via Sec. 6(4)) |
2. Third-Party Data Processors & Cross-Border Transfers (Section 8(2) & Section 16)
We do not sell or rent your personal data. We share strictly minimized data with vetted Data Processors solely to fulfill your requests:
| Processor Name | Role | Data Shared | Processing Location & Safeguards |
|---|---|---|---|
| Razorpay Software Pvt. Ltd. | Payment Gateway | Order Amount, Order Reference, Checkout Email/Phone | India (PCI-DSS Level 1, HMAC-SHA256 Webhook Verification) |
| Cloudflare, Inc. (Turnstile) | Bot & CAPTCHA Protection | Client IP Address, Browser Challenge Token | Global Anycast Edge (India PoPs, Strict Hostname & Action Binding) |
| Google LLC (Optional OAuth) | Sign-In with Google | Verified Email Address, OAuth Subject Identifier | India / Global (OpenID Connect Token Verification, CSRF State Check) |
| Upstream SMM Fulfillment Providers | Order Delivery APIs | Public Target Post/Profile URL & Quantity Only (Your email, phone, and account identity are never sent to SMM providers) | Global API Endpoints (HTTPS TLS 1.2/1.3 + SSRF IP Pinning) |
3. Data Retention & Automated Erasure Schedule (Section 8(7) & Rule 8)
- Active User Accounts & Inactivity Policy: Retained while your account remains active so you can access your wallet balance and order history, or until you exercise your right to self-service Account Erasure under Section 12(3). (Note: The automatic 3-year inactivity erasure schedule under Rule 8 & the Third Schedule of the DPDP Rules, 2025 applies by statute to specified large Data Fiduciaries such as e-commerce/social media platforms with ≥2 crore users or online gaming intermediaries with ≥50 lakh users; if Reachzo enables optional inactive-account cleanup for unfunded accounts inactive for 3+ years since
last_user_activity_at, a verified 48-hour pre-erasure email notice is delivered before any profile anonymization.) - Security & Traffic Logs: Retained for up to 365 days (1 year) in compliance with Rule 8 cybersecurity & audit log retention requirements, and then automatically purged.
- Password Reset OTPs & Tokens: Single-use tokens expire after 60 minutes and are purged automatically within 24–168 hours.
- Statutory Financial & Tax Ledgers: Wallet deposit receipts, GST/tax accounting entries, and immutable ledger rows (
wallet_transactions,deposit_requests) are retained for 8 years as mandated by Indian financial and tax laws, even after account personal identifiers are anonymized.
4. Children's Personal Data & 18+ Age Policy (Section 9)
Reachzo's commercial social media marketing and wallet services are intended exclusively for individuals aged 18 years and older. All users must confirm they are 18+ at registration. We do not knowingly collect personal data from children under 18 or perform behavioral tracking or targeted advertising directed at minors.
5. Your Data Principal Rights & How to Exercise Them (Sections 11–14)
- Right to Access & Data Summary (Section 11): Download a complete JSON or printable HTML summary of all personal data, orders, deposits, consents, and third-party processors from Account Settings → Privacy Center.
- Right to Correction & Erasure (Section 12): Update your email/WhatsApp or trigger immediate self-service Account Erasure / Right to be Forgotten directly in your Account Privacy Center.
- Right to Withdraw Consent (Section 6(4)): Withdraw optional cookie consent via the footer Cookie Preferences modal or withdraw marketing email consent via the one-click
Unsubscribelink in any promotional email. - Right to Nominate (Section 14): Register an authorized nominee in your Account Privacy Center who may exercise your DPDP rights in the event of death or incapacity.
6. Grievance Redressal Officer & Data Protection Board Escalation (Section 13)
Designated Privacy & Grievance Officer: Reachzo Grievance Redressal Desk
Email: grievance@reachzo.online / privacy@reachzo.online
Portal Filing: Account Settings → File Privacy Grievance or Support Helpdesk
Resolution Timeline (SLA): Acknowledgement within 24 hours; substantive resolution within 7 business days (and strictly within the statutory maximum under Rule 13 of the DPDP Rules, 2025).
If your grievance is not resolved within the statutory timeline or you are dissatisfied with the outcome, you have the right under Section 13(3) of the DPDP Act, 2023 to file a complaint with the Data Protection Board of India.