1. Scope
This Privacy Policy explains what personal data Solabrix Technologies ("Solabrix," "we," "us") collects through the Zenith platform (the "Platform"), why, and what rights you have over it. It applies to registered users (Plant Owners, Service Providers, Solar Champions, OEMs) and, in one specific respect described in Section 4, to people who have not registered at all.
This policy should be read alongside our Terms of Service.
2. Data We Collect
2.1. Account data. Mobile number (used for OTP verification and login), and any name or PIN you set up on your account.
2.2. Plant & address data. When you register a Plant, we collect its capacity, commissioning date, and address. Address fields (Area/Locality, PIN code, City, District, State) may be auto-filled via Google Places when you search for your address; you can review and edit every auto-filled value before saving.
2.3. Generation data. Provided either automatically (Live Tracking, synced from your connected inverter via the manufacturer's data feed) or manually (Manual Tracking: you enter units from your bill, or upload the bill itself as an image or PDF). Uploaded bills are processed with OCR to extract your consumer number and generation figures for verification; the uploaded file and the extracted figures are both retained, per Section 6.
2.4. Payment data. Payments are processed by our payment gateway partner, Razorpay. We do not store your full card, UPI, or bank details ourselves, Razorpay handles that as a PCI-DSS compliant processor. We retain transaction references, amounts, and status (paid/failed/refunded) for your booking history and for statutory financial record-keeping.
2.5. Work evidence. When a Service Provider completes a Service Request, they upload photographs and, for some Services, a written report, as proof of work. These may include images of your Plant and, incidentally, the surrounding property.
2.6. Ratings. Star ratings and any written feedback you or an assigned SP submit about each other after a completed Service Request.
2.7. Communications data. Your mobile number is used to send OTPs, transactional updates (booking confirmations, status changes), and, where applicable, marketing or outreach messages via SMS/WhatsApp (through our messaging partner, Msg91). See Section 9 for how to opt out of the non-transactional kind.
2.8. Usage data. Standard website/app analytics (pages visited, general device/browser information), collected to understand how the Platform is used and to fix problems.
3. Document Vault
You can upload documents related to your plant in our Document Vault, tagged with one of a fixed set of labels (generation bill, warranty card, design document, invoice, or other). These documents are stored against your Plant record, alongside any system-generated warranty certificates the Platform already produces automatically. An SP can also do this on your behalf, with your permission.
You can view and download any document in your Plant's vault from your account at any later point in time.
Vault documents may contain sensitive information depending on what's uploaded, a warranty card or invoice can include your name, address, and purchase details. These are protected by the same security measures described in Section 10, and access is limited to your account and the Solabrix systems and staff that need it to operate the feature.
We don't currently collect government ID numbers or biometric data through this or any other feature.
4. Data About People Who Haven't Signed Up
This section exists because it's true of Zenith's actual practice, not because every platform needs it. As part of the functionality offered by the Platform, we "discover" other users. For example, when you specify the SP who did EPC of your plant, we discover an SP. Similarly, when an SP uploads all the plants whose EPC they have done, we discover POs.
If you receive an outreach message from us and did not sign up, you can:
- Opt out of further messages using the opt-out method stated in that message (e.g., a WhatsApp/SMS "STOP" reply or equivalent), which we are required to honour going forward.
- Request deletion of all your data from the Platform, by contacting us at the address in Section 12.
5. How We Use Your Data
- To operate your account and Plant registration.
- To calculate your Generation Score and, if you opt in, your Championship ranking.
- To match, assign, and pay Service Providers for Service Requests.
- To process payments and maintain the financial records required by law.
- To send transactional communications (OTPs, booking updates) and, where you haven't opted out, marketing/outreach communications.
- To improve the Platform (aggregated, de-identified usage analysis).
- To detect fraud, rating manipulation, or other misuse, per Section 7.7 of the Terms of Service.
We do not sell your personal data to third parties.
6. Data Retention
- Account and Plant data: retained while your account is active, and for a reasonable period after closure for legal, tax, and dispute-resolution purposes.
- Generation data: retained for the life of the Plant's registration, since historical data underpins past Championship rankings and your own performance history. If you delete your account, historical rankings that already appeared on a public leaderboard are not retroactively removed (they were public record at the time), but your data will no longer be used to calculate future scores.
- Document Vault files: retained for the life of the Plant's registration, since they're kept for warranty and reference purposes that can span years. Deleted on request or account closure, subject to the same legal-retention exceptions as other Plant data above.
- Payment records: retained as required by Indian financial and tax law (typically several years; confirm the exact statutory period with your accountant/legal counsel rather than relying on this draft).
- Prospect/outreach data (Section 4): retained until you opt out or request deletion, or until a reasonable period of outreach inactivity, whichever comes first.
7. Who We Share Data With
- Service Providers, for Service Requests they're assigned to: your name, contact number, Plant address, and relevant Plant details, only as needed to perform the Service.
- Razorpay, for payment processing.
- Google (Places/Maps API), for address autocomplete.
- Msg91, for OTP, transactional, and outreach messaging.
- Your Plant's inverter manufacturer/OEM, if you use Live Tracking, to receive your generation data feed.
- Law enforcement or regulators, only where legally required.
We do not share your data with third parties for their own independent marketing purposes.
8. Your Rights
Under the Digital Personal Data Protection Act, 2023, and subject to its exceptions, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Withdraw consent for processing that relies on consent (this may limit what the Platform can do for you, e.g., you can't get a Generation Score without generation data).
- Request erasure of your data, subject to our legal retention obligations (Section 6).
- Nominate another individual to exercise these rights on your behalf in the event of death or incapacity, as provided under the Act.
To exercise any of these rights, contact us using the details in Section 12.
9. Marketing & Outreach Opt-Out
You can opt out of non-transactional SMS/WhatsApp messages at any time, using the opt-out instruction included in the message itself, or by contacting support directly. Opting out does not affect transactional messages necessary to operate your account (OTPs, booking confirmations, payment receipts), those aren't marketing and can't be turned off without affecting your ability to use the Platform.
10. Data Security
We take reasonable technical and organizational measures to protect your data, including access controls and secure transmission. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.
[Data breach notification process needs to be specified here once decided: who gets notified, on what timeline, and how, this is a real DPDP Act obligation, not optional boilerplate.]
11. Cross-Border Data Transfer
Some of our service providers (Google, and potentially others) may process data on servers located outside India. We take steps to ensure these providers meet appropriate data protection standards.
12. Grievance Officer & Contact
As required under Indian law, we've designated a Grievance Officer to address privacy concerns.
Name: Gaurav Nandedkar
Designation: Office Admin and Grievance Officer
Email: gaurav@solabrix.com
For general privacy questions: team@solabrix.com
13. Children's Privacy
The Platform is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has registered, contact us and we will investigate and remove the account if confirmed.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified through the Platform or by SMS/email before they take effect.