Privacy Policy

1. Who We Are, and Who Decides

Praxate is operated by:

Under the Digital Personal Data Protection Act 2023 (India) there are two roles, and which one applies depends on whose data it is:

• People on a customer's cameras (employees, visitors, anyone on the premises): the customer is the Data Fiduciary. The customer decides which cameras run, which areas are watched, how long footage is kept and who receives alerts. Xserv Labs is the customer's Data Processor and processes this data only on the customer's instructions, under our Data Processing Agreement. Telling people on the premises that cameras are running is the customer's responsibility.
• Our customers' own account data (sign-in details, contact name, email, phone, alert recipients, the device's diagnostics): Xserv Labs is the Data Fiduciary.

This policy describes both. A person seen on a customer's cameras who wants to exercise a right under the Act should contact that customer; we help the customer answer (section 6), and anyone may also write to us directly.

2. What Data We Process and Why

Praxate watches a customer's own CCTV cameras for them. A Praxate tablet (or the Praxate app on the customer's Android device) on the customer's premises reads the cameras on the local network, keeps a short recording on the device, and sends camera video to Praxate's servers in India, where people are detected, counted and checked against the customer's zones. Alerts go to the people the customer chooses, on WhatsApp.

Face recognition is off. No customer uses it today and no face data is created. If a customer later chooses to turn it on, Praxate will ask for that customer's separate, explicit consent first and this policy will describe it before it starts.

We do not use customers' video to train our own models. We do not sell personal data. The app collects no location, microphone, contacts or phone-state data.

3. Legal Basis for Processing (DPDP Act 2023 §6)

Our legal basis for all personal data processing is consent under DPDP Act 2023 §6. Consent is:

• Free — the consent screen asks only for what the service needs to work; nothing else is bundled with it.
• Specific — the consent screen names the one purpose (watching the customer's cameras and sending the customer's alerts) and lists every kind of data it uses. Any new purpose, such as face recognition, would be asked for separately.
• Informed — this policy and the consent form describe exactly what data is processed, for how long, and by which sub-processors.
• Unambiguous — consent is an affirmative act. No pre-ticked boxes. The "I agree and continue" button stays disabled until the purpose and the children attestation are ticked.

Consent is recorded with: the exact purposes accepted, the version of the consent text shown (version 3), a UTC timestamp, and a one-way-hashed record of the session. A reference number is displayed to the customer immediately after consent is recorded.

Praxate does not process biometric data. If a customer ever chooses face recognition, it starts only after that customer's separate, explicit consent and an update to this policy.

4. Retention Periods

We keep personal data only as long as the purpose needs it (DPDP Act 2023 §8(7)). These are the periods the software enforces by default; a customer's own settings can make some of them shorter or longer, and the customer's dashboard shows the period that applies to them.

5. Sub-Processors and Data Transfers

Camera video stays on the customer's tablet and on Praxate's own servers in India. The service providers below process data for us under their terms:

Because of Railway and Meta, account details and alert messages are processed outside India. DPDP Act 2023 §16 permits this except to countries the Government restricts; none of these are.

6. Your Rights as a Data Principal (DPDP Act 2023 §§11–14)

Under the Digital Personal Data Protection Act 2023 you have the following rights. To exercise any right, contact the DPO at [email protected]. We will respond within 30 days.

There are no fees for exercising these rights. We will not discriminate against you for exercising them.

7. Children's Data (DPDP Act 2023 §9)

Praxate is intended for use in commercial and professional premises. It is not directed at or intended to process the personal data of persons under 18 years of age.

Our consent flow requires every subscribing organisation to attest that where its cameras record children (under 18), it holds the parent or guardian consent DPDP Act 2023 §9 requires, and that it will not use Praxate to track or profile any child. Violation of this attestation constitutes a material breach of the service agreement.

If we become aware that a child's data has been processed without the consent §9 requires, we will erase it and notify the customer. Repeat violations may result in immediate account suspension.

8. Security Measures

We implement the following technical and organisational measures to protect personal data (DPDP Act 2023 §8(4), GDPR Art. 32):

• Encryption at rest — The website database (Railway PostgreSQL) is encrypted at rest.
• Encryption in transit — Everything the tablet sends to Praxate, and everything a browser receives, travels over TLS.
• Data minimisation — Video is kept for the short periods in section 4 and deleted automatically.
• Access controls — Each customer runs in its own separate service with its own database. Praxate staff access requires sign-in.
• Consent gating — A customer's site is not set up until consent is recorded and Praxate has approved the account.
• Logging — Service logs are kept for troubleshooting; they can contain device and network details (section 2), never passwords.

In the event of a personal data breach that is likely to result in risk to Data Principals, we will notify affected customers and, where required, the Data Protection Board of India, without undue delay.

9. How to Withdraw Consent and Request Erasure

Withdrawing consent is as easy as giving it (DPDP Act 2023 §6(4)). Ask in any of these ways:

• Follow the steps on praxate.com/delete-account, or
• email [email protected] with the subject "Consent Withdrawal — [your company name]", or
• use "Delete My Account" on the Account page, which opens a message to Praxate on WhatsApp.

A person at Praxate carries out the request: we stop processing within 24 hours and erase the account's video, detection records, recipients, camera login details and account details within 30 days, on the tablet (when it next connects), on our servers and on the website. The consent records that prove consent was given and withdrawn are kept as section 4 says. We reply to confirm when it is done. Processing before the withdrawal stays lawful. Billing stops from the next billing cycle.

10. Grievances and the Data Protection Board

If you have a complaint about how we handle your personal data:

1. Contact our DPO first. Email [email protected]. We will acknowledge within 48 hours and resolve within 30 days.
2. If unsatisfied, you may escalate to the Data Protection Board of India under DPDP Act 2023 §75. The Board's contact details will be published by the Central Government upon operationalisation of the Act.

11. Changes to This Policy

We will notify customers of any material changes to this policy (changes to processing purposes, new sub-processors, or changed retention periods) via email at least 14 days before the change takes effect. Material changes require fresh consent — the consent_version will be incremented and customers on the previous version will be prompted to re-consent before any new processing scope applies.

Minor changes (typographical corrections, clarifications that do not affect scope) may be made without prior notice. The "Version" and "Effective date" fields at the top of this page will be updated.

12. Contact — Data Protection Officer