Privacy Policy

1Who we are

Upzy is a dedicated support space designed for gig workers to recharge, refresh, connect, and access essential services between work shifts. We provide safe, comfortable, and affordable facilities that help improve everyday work life.

This Privacy Policy explains how Chashi Technologies Private Limited (“Upzy”, “we”, “us”), located at Rajapushpa Atria, Golden Mile Road, near Metropolis Diagnostic & Healthcare, Kokapet, Hyderabad, Telangana – 500075, collects and handles your personal data when you use the Upzy mobile application and related services at our centre(s).

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Upzy is the Data Fiduciary — the entity that decides why and how your personal data is processed. You, the member, are the Data Principal.

We process your data only for clear, lawful purposes, keep it only as long as needed, and give you control over it. This policy is written in plain language.

2Scope

This Privacy Policy applies to the Upzy Member App, the Upzy Admin Portal, and services provided at Upzy centres — including membership registration, facility access, rest lounge, workspaces, lockers, Wi-Fi access, community features, domestic money transfer, and any other member services offered from time to time. Upzy is intended for adults (18+); see Section 13 on family members and minors.

3The personal data we collect

We collect the following categories of personal data. We collect only what is needed for the purpose stated against each.

Identity and verification

• Mobile number and one-time passwords (OTP) used to sign in.
• Government ID details verified at reception — Aadhaar, Driving Licence, or Voter ID (whichever accepted form you present). Your verified name is taken from this document.
• A photograph captured by our team at verification, and AI-generated professional photo variants derived from it. The original photograph is retained for identification only.
• Display name, gender, and other profile details you provide.

Membership

• Your plan, validity dates, membership status, and plan history.
• Family member details you add (such as name and relationship).
• Emergency contact details you provide.

Community

• Posts you create (events, jobs, buy/sell), upvotes, and reports you make or receive.
• Records of contact “reveals” — when you reveal another member’s contact, or yours is revealed.

Facility access and lockers

• Your entry pass (QR) and centre entry and exit records and timestamps.
• Facility usage records (such as lounge, workspace, Wi-Fi, or meeting areas, where applicable).
• Locker allocation, usage, and access records.
• Facial-image data used to verify your entry, where you opt in — see Section 12.

Technical and usage data

• Device information, app version, and basic usage needed to operate and secure the app.
• Wi-Fi session information (where provided by Upzy).
• Usage of digital services available through the Upzy Member App.

With your permission, Upzy uses your device’s approximate location on the sign-up and sign-in screens to show the Upzy centre nearest to you and the travel distance to it. Your location is used only at that moment and is not stored or linked to your account. To calculate the travel distance, your approximate location is shared with our maps provider, Google Maps Platform (see Google’s Privacy Policy). Location is optional — if you decline, Upzy shows a default centre and works normally. You can change location permission anytime in your device settings.

Domestic Money Transfer (DMT)

• Sender (remitter) details and KYC status required by our money-transfer partner.
• Recipient (beneficiary) bank details you provide at the desk.
• Transaction records (amount, reference, status, charges).
• Where identity verification for a transfer requires Aadhaar-based eKYC, this is carried out by our licensed money-transfer partner in accordance with RBI and UIDAI requirements.

We do not collect payment card details in the app, and the app does not process payments. Cash and fees are handled at the reception desk.

4How we collect it

• Directly from you — at sign-up, in the app, and at the reception desk.
• Generated by your use of the app and centre (entry records, locker access, transaction records).
• From our service partners where needed to provide a service (for example, the result of a money-transfer instruction).

5Why we process your data (purposes)

We process your personal data for these specific purposes:

• Create and manage your account and membership — mobile, OTP, ID verification, profile, plan.
• Verify your identity at reception — ID document, captured photo.
• Give you facility access and operate lockers — entry pass / access records, locker records.
• Verify your entry by facial recognition (optional, opt-in) — facial-image data.
• Run community features — posts, upvotes, reveals, reports.
• Provide domestic money transfer at the desk — remitter KYC, beneficiary details, transaction records.
• Send you service notifications — mobile number, app notification token.
• Keep members and facilities safe and secure, and prevent misuse — device and usage data, access logs, and CCTV records (where applicable, for investigation).
• Improve facility operations and member experience — usage analytics and service feedback.
• Respond to member support requests — contact details and membership information.
• Meet legal, regulatory, and audit obligations — as required by applicable law.

We use your data only for the purpose for which it was collected. We will seek fresh consent before using it for any new purpose.

6Our legal basis

We process personal data on the basis of:

• Your consent, given through a clear affirmative action when you sign up and use specific features; and
• Legitimate uses permitted by the DPDP Act, such as a purpose for which you voluntarily provided the data, and to comply with legal obligations.

You can withdraw consent at any time (see Section 9). Withdrawing consent may mean we can no longer provide certain features.

7Who we share it with

We do not sell your personal data. We share it only with service providers (“Data Processors”) who help us run the service, under agreements that require them to protect it and use it only for our stated purposes:

• Our money-transfer partner — to execute domestic money transfers and the related KYC.
• Our access-control / entry-kiosk vendor — for registration and facility entry.
• Our locker vendor — to operate lockers.
• Our SMS / OTP provider — to send verification and notification messages.
• Our cloud hosting provider — to host the app and store data securely.
• Our AI photo-processing provider (where applicable) — to generate professional photo variants.

We may also disclose data where required by law, court order, or a lawful request from a public authority.

Your data is primarily stored and processed in India. Where a service provider processes data outside India, we do so only as permitted by the DPDP Act, 2023 and its Rules.

8Identity documents and sensitive information

Your ID document and verification photo are used only to confirm your identity and are access-restricted to authorised staff. We retain them only for as long as needed to verify your identity and maintain your membership, after which they are securely deleted, unless a longer period is required by law. Where Aadhaar is used, we follow the applicable UIDAI and legal requirements.

9Your rights

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Correct, complete, or update your data.
• Erase your data where it is no longer needed for the purpose it was collected.
• Withdraw consent at any time.
• Nominate another individual to exercise your rights in the event of death or incapacity.
• Grievance redressal — have your complaints addressed by us.

To exercise any of these, use the in-app request option or email privacy@upzy.app. We will respond within 90 days. Withdrawing consent or requesting erasure is as easy as giving consent was. Some records (for example, completed money-transfer and audit records) may need to be retained for a period required by law even after a request — we will tell you when this applies.

10How to delete your account and data

You can delete your Upzy account and the personal data associated with it at any time by submitting a request by email to privacy@upzy.app.

When you request deletion, we delete the personal data associated with your account. We do not merely deactivate, disable, or “freeze” it. Certain records must be retained for a limited period where required by law — for example, completed money-transfer and audit records under RBI / AML rules, and records needed for security or fraud prevention. We delete these once the applicable legal retention period ends, and we will confirm once your request is completed.

11How long we keep it

We keep personal data only as long as needed for the purpose it was collected, or as required by law. Our retention periods are:

Account and membership data

For the duration of your membership plus up to 12 months, then deleted.

ID verification document and photo

Only as long as needed to verify identity and maintain membership; deleted thereafter unless law requires longer.

Money-transfer and audit records

As required under applicable RBI / AML rules (generally at least five years).

Community posts and reveal logs

Up to 12 months.

Access, locker, and facility usage records

Up to 12 months.

Wi-Fi usage logs

Up to 6 months.

CCTV footage

90 days, unless retained longer for an ongoing investigation.

Member support requests

Up to 24 months.

Before we erase data at the end of a retention period, we will give you at least 48 hours’ notice where the DPDP Rules require it, so you can ask us to keep it if still permitted.

12Facial recognition / biometric data

We use facial recognition to verify your entry at Upzy centres. This is optional and based on your explicit consent:

• We enrol your face only after you opt in, using a photograph captured by our team at reception — not through the app.
• From this we generate a mathematical face template. Your face template is stored securely on-premises at the centre’s access-control system; we do not store it in the cloud, and we use it for no purpose other than verifying your entry.
• You can withdraw consent at any time and continue to use QR-based entry instead.
• We delete your face template when your membership ends, or sooner on request.

13Family members and minors

Upzy is intended for adults. If a member adds a family member under 18, we require verifiable consent from a parent or lawful guardian before processing that minor’s data, and we do not use a minor’s data for behavioural monitoring or targeted advertising.

14How we protect your data

We apply reasonable security safeguards, including access controls and access logging, encryption or masking of data in transit and at rest where appropriate, restricted staff access, secure storage of access records, controlled physical access to Upzy centres, backups, and periodic security reviews. We require our processors to do the same. No system is perfectly secure, but we work to protect your data and to detect and respond to incidents.

15Data breaches

If a personal data breach occurs, we will notify you and the Data Protection Board of India as required by the DPDP Rules, including reporting to the Board within the prescribed timeline.

16Cookies and the admin portal

The Upzy Member App does not use third-party advertising or tracking cookies. Where our Admin Portal or website uses cookies, they are limited to those necessary to operate and secure the service.

17Grievance redressal and contact

For any questions, requests, or complaints regarding your personal data, membership, facility access, or privacy rights, please contact our Grievance Officer:

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

18Changes to this policy

We may update this policy from time to time. We will post the updated version in the app with a new “Last updated” date, and notify you of significant changes.