Privacy Policy

This Privacy Policy explains how SAMONA(Sole Proprietorship, Udyam Registration Number UDYAM-AP-20-0114242, registered proprietor Nangana Mohanrao) — “Samona”, “we”, or “us” — collects, uses, shares, and protects personal information in connection with the Samona website, customer application, and Samona Pro application (together, the “Platform”).

We are a “Data Fiduciary” under the Digital Personal Data Protection Act, 2023 (India) and the rules made under it. You are the “Data Principal” whose information we handle. We process personal data in accordance with this Policy, our Terms & Conditions, and applicable Indian law.

Please read this Policy carefully. It covers both Customers and independent service Professionals, and explains the choices and rights available to you. Where we refer to “you”, we mean the person whose personal data we process, whether you are a Customer, a Professional, or a visitor to our website.

When you use the Samona customer app, we may collect:

• Account information — your name, mobile number, email address, and password or login details;
• Service request details — descriptions of the job you need, photos or notes you add, preferred timing, service address, and any instructions you share with a Professional;
• Location — your device location as described in Section 5, used to find nearby Professionals and route them to you;
• Communications — messages, ratings, reviews, and support requests you send through the Platform; and
• Transaction records of completed bookings — job history and status. Payments for services are made by you directly to the Professional in cash; we do not collect card or bank payment details for service payments.

On our website, if you join the waitlist, we collect the name, email address, and phone number you submit. Waitlist submissions are stored for us by Supabase, a third-party cloud database provider (see Section 11).

When you register and use the Samona Pro app, we may collect:

• Account and profile information — your name, mobile number, email address, trade or skills, years of experience, profile photo, and a short description of your services;
• Verification information — identity documents and details submitted for verification, as described in Section 4;
• Service area and availability — the areas you cover, the categories of jobs you accept, and the times you are available;
• Job records — requests you accept or decline, jobs completed, agreed and final job amounts, ratings and reviews from Customers; and
• Location — your device location as described in Section 5, used to send you nearby job requests and confirm when you arrive at a job.

Professionals are independent service providers, not employees of Samona. We collect this information to operate the marketplace, not to manage your employment.

As part of Professional onboarding, we may ask for identity and address documents (for example, an Aadhaar card, PAN card, driving licence, or other accepted proof), documents supporting payouts or trade licences and certificates, and a photograph for verification. Documents are uploaded from the device as PDF, JPEG, or PNG files and stored in original form — we do not apply any masking, redaction, or blurring to the documents themselves.

We request only what we reasonably need to verify identity, deter fraud, and build trust between strangers transacting through the Platform. Verification documents are used for verification and fraud-prevention purposes and are not displayed publicly on your profile.

Because identity documents can constitute sensitive personal data, we strictly control who can access them. Documents are stored in a private bucket with no public URL. They are accessible only to you and to Samona’s authorised administrators (for example, when manually reviewing a verification submission), through short-lived, expiring links rather than permanent addresses. We do not log or record every document access.

Professionals review their own documents through the app while they remain active. Please be aware that the contents of a document are not masked in any automated way at this time.

When a Professional deletes their account as described in Section 15, their uploaded verification documents are deleted as part of that process.

Customers are not required to submit identity documents to use the customer app, and cannot view a Professional’s verification documents.

Location is central to how Samona works. We collect device location only in the foreground — while you are actively using the app. The apps do not request or use background location.

Foreground location

While the app is open and in use, we access your device’s location to:

• show nearby Professionals to Customers;
• match Customers with Professionals in the relevant area;
• let Professionals set and adjust their service area;
• verify a Professional’s arrival at a job (the app sends a position check when the Professional reports they have arrived); and
• let Professionals view their own position on a map while working on a job.

No background location

We do not use background location, and we do not collect your location while the app is closed or in the background. Device permission prompts ask for location access only while the app is in use (iOS: “While Using the App”; Android: “While using the app”).

Turning off location access — which you can do at any time in your device settings — may reduce or prevent you from receiving nearby job requests, but it will not affect other parts of the app. We do not use location to track you for purposes unrelated to providing the Platform.

With your permission, the apps access your device camera and photo library so that you can:

• add a profile photo (Customers and Professionals);
• attach photos to a service request, for example pictures of a leaking tap or a broken appliance, so the Professional can understand the job before attending;
• capture or upload photos of completed work, where relevant to a job; and
• upload identity or other documents during Professional onboarding or verification.

Photos and documents you upload are stored with your account and are shared with the other party to a booking only as needed to deliver the service (for example, job photos are visible to the Professional who accepted your request). You can delete photos you have uploaded from your content where the app allows it, or by contacting us.

The apps do not access your camera or photo library except when you choose to use a feature that requires it.

When you use the apps, we collect technical information such as:

• device type, operating system, and app version;
• the type of notification token linked to your device; and
• language and time zone, where needed to operate the app.

We collect push notification tokens — unique identifiers issued by Apple or Google to your device — so we can send you job alerts, booking updates, and service notifications. You can disable push notifications at any time from your device settings; doing so may mean you miss booking-related updates.

This technical information helps us keep the Platform reliable, diagnose problems, and understand which app versions are in use. We do not collect advertising identifiers, we do not use device identifiers to build advertising profiles, and we do not sell device data.

We use personal information to:

• create and manage your account;
• match Customers with nearby, available Professionals and deliver bookings;
• verify Professional identity and maintain trust and safety on the Platform;
• enable communication between Customers and Professionals about a booking;
• send service-related notifications, such as booking confirmations and job alerts;
• display profiles, ratings, and reviews to help users make informed choices;
• detect, investigate, and prevent fraud, misuse, and safety incidents;
• provide customer support and respond to your requests, including account deletion requests;
• understand how the Platform is used, debug issues, and improve features and reliability; and
• comply with legal obligations and respond to lawful requests from authorities.

We do not use your personal information for purposes unrelated to the Platform without telling you, and where the law requires, without your consent.

Under the Digital Personal Data Protection Act, 2023, we process personal data on the basis of your consent, or on the basis of certain legitimate uses recognised by the Act (for example, processing necessary to provide the service you have asked for, or processing permitted by law).

When we ask for consent — for example, for location access, camera access, or notifications — we present the purpose at the time of the request, through the app’s permission prompts and this Policy. You may refuse consent for optional permissions without losing access to core features, except where that permission is essential to the service (such as location for matching nearby jobs).

You have the right to withdraw any consent you have given, at any time, in the manner described in Section 14. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Consent that is withdrawn, or permissions that are revoked, may prevent us from continuing to provide parts of the service that depend on them — for example, a Professional who disables location may stop receiving nearby job requests.

Samona is built on direct transactions between Customers and Professionals. Some personal information must be shared between the two parties for a booking to work:

Shared with the Professional (once a request is accepted)

• your name and contact number;
• the service address and approximate location for the job; and
• the job description, photos, notes, and timing you provided.

Shared with the Customer (once a request is accepted)

• the Professional’s name and contact number;
• their profile photo, trade, ratings, and reviews; and
• job updates such as when the Professional is on the way or has arrived.

We do not sell your personal information to anyone. Beyond the sharing described above and in Section 11, we disclose personal information only where required by law or to protect the rights and safety of users and the public.

Users are asked to use the other party’s information only for the booking at hand, and not to misuse it for unsolicited contact, marketing, or harassment.

We use a small number of third-party providers to operate the Platform. They process information on our behalf, under contractual obligations to protect it. These include:

• Supabase — cloud authentication, database, and object-storage services. App accounts, app data, uploaded files, and website waitlist submissions are handled by Supabase;
• Amazon Web Services (AWS) — cloud hosting and object-storage infrastructure on which the Platform and its data run;
• Push notification services — Apple’s Push Notification service and Google’s Firebase Cloud Messaging, which deliver notification tokens to your device;
• Expo — the development tooling and push-delivery service used by our mobile apps; and
• OpenStreetMap (Nominatim) — a mapping and address lookup service used for geocoding service locations; address queries are sent to this service through our own servers.

The apps do not currently embed third-party analytics or advertising-tracker SDKs. We may also disclose information to advisers, auditors, or authorities where required by law. Our providers are not permitted to use your information for their own purposes.

Personal data collected through the Platform is processed and stored on cloud infrastructure located outside India (see Section 19 for the verified locations of our providers).

We protect personal data with a combination of technical and organisational measures appropriate to the risks, including:

• encryption of data in transit (HTTPS/TLS);
• encryption of files at rest in object storage;
• access controls, so that only authorised personnel can reach data that requires it;
• credential handling through established authentication services;
• short-lived, expiring links for access to stored documents; and
• periodic review of our practices as the Platform evolves.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee that the Platform will be free of unauthorised access, loss, or misuse, and users should likewise safeguard their own devices and credentials.

We retain personal data only for as long as it is needed for the purposes described in this Policy, including:

• to provide the service and operate your account while it remains active;
• to maintain booking and verification records that may be needed for support, dispute handling, or fraud prevention; and
• to meet legal, tax, accounting, or regulatory obligations that require certain records to be kept.

We apply the following retention periods to the affected categories. Where the clock is measured from account deletion, it starts on the day the account is deleted:

• Professional verification documents — deleted after 5 years from account deletion;
• verification selfies — deleted after 90 days from account deletion;
• Professional profile photos — deleted after 30 days from account deletion;
• job images older than 90 days that no booking references — deleted once no job row names them;
• Professional notification records — deleted 90 days after they are created;
• customer notification records — deleted 90 days after they are created;
• service and skill listings of a deleted account — deleted after 30 days from account deletion; and
• job declines and job offers — deleted 180 days after they are created, once the job they relate to is no longer active.

Deletion is carried out by an automated data-retention engine and is strictly gated: a category is deleted only when its retention setting is enabled and its approved period has elapsed. Records tied to a job that is still being worked are never aged out. Each automatic deletion is recorded in a cleanup audit log, and stored files are removed before the records that point to them.

The only records that may ever be deleted automatically are limited to Professional verification documents, verification and profile photos, notification records, service and skill listings, job declines and job offers belonging to closed or non-active accounts, and job images that no booking references. Records tied to a job that is still being worked are never aged out. Each automatic deletion is recorded in a cleanup audit log, and stored files are removed before the records that point to them.

Some records are never deleted automatically, even by configuration error: customer avatars, saved addresses, chat messages, completed and cancelled job records, and the audit record of an account deletion. These are another user’s record or the historical record a marketplace must keep.

When you request account deletion, however, the process is automated: professional verification documents, profile and verification photos, other professional profile data, and — for a deleted customer surface — the customer profile data, profile photo and saved addresses are deleted as part of the deletion flow described in Section 15. Job records, chat messages, earnings records and reviews are retained as the other party’s record of the transaction. Backup copies are cycled out on the backup schedule of our hosting providers.

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you have the right to:

• Access — request a summary of the personal data we hold about you;
• Correction and completion — request that inaccurate data be corrected, or incomplete data be completed;
• Erasure — request deletion of your personal data, subject to legal and operational retention needs;
• Withdraw consent — withdraw any consent previously given, including for permissions such as location, camera, and notifications;
• Grievance redressal — raise a complaint with us, and with the Data Protection Board of India where applicable; and
• Nominate — have another individual exercise your rights on your behalf, in circumstances permitted by law.

You can exercise several of these controls directly in the apps — for example by editing your profile, revoking device permissions in your phone’s settings, deleting verification documents you have submitted, or deleting your account through the app (Professionals in the Pro app, Customers in the customer app) as described in Section 15. For anything else, contact us using the details in Section 20. We may need to verify your identity before acting on a request.

Professionals and customers can request deletion of their account directly in the app — Samona Pro (Profile → Delete account) or the customer app (Profile → Delete account). The flow requires you to confirm it is really you with a fresh one-time code when your session is not fresh enough, and then to confirm with a single-use deletion code.

What is deleted depends on your account, and is decided by our servers, not by any setting you choose:

• Professional profile only. If your mobile number is also registered as a customer account, deleting from the Pro app removes only the professional side: your professional profile, skills, services, documents, profile and verification photos, and job alerts. Your customer account and phone number continue to work as before.
• Customer profile only. If your mobile number is also registered as a professional account, deleting from the customer app removes only the customer side: your customer profile and details, profile photo, saved addresses, and notification records. Your professional account and phone number continue to work as before.
• Entire account. If your mobile number is not registered as the other kind of account, the deletion removes your entire Samona identity — including your phone number and sign-in — from both the Samona and Samona Pro apps. Because one phone identity signs into both apps, deleting the account means that phone number can no longer sign in to either.

Timing. Deletion normally completes within a few minutes. If you have active jobs, deletion waits until those jobs are finished and then completes automatically. We will keep you reasonably informed of progress in the app, and where deletion cannot be completed automatically you will be asked to contact us to finish it.

Exceptions. Some records are retained where required by law, or where reasonably necessary for legitimate purposes such as dispute resolution, fraud prevention, or complying with tax and accounting obligations — for example, records of completed bookings, chat messages, earnings records, and reviews are kept as the other party’s record of the transaction. Retained records are limited to what is necessary and are not used for new purposes.

Where an active legal hold is in place — for example, during a dispute, a fraud investigation, or a legal or regulatory obligation — the records covered by the hold are preserved from deletion, even if they are your own documents or profile data. The rest of the deletion still proceeds, and the held records are deleted once the hold is released. In all cases, an audit record of the deletion is retained.

Our website currently uses only the storage strictly necessary to operate it. It does not set advertising cookies, and it does not embed third-party analytics or tracking pixels. Server logs (containing IP address, browser type, and requested pages) are retained by our hosting provider for security and operations.

If we add analytics or other non-essential technologies to the website in the future, we will update this Policy and, where required, ask for your consent before they are used.

The mobile apps do not use website cookies. Any in-app storage used to keep you logged in or remember preferences is functional, not advertising-related.

The Platform is not directed at children under 18 years of age, and we do not knowingly collect personal data from children.

If we learn that we have collected personal data from a person below the age of 18 without the verifiable consent of a parent or lawful guardian, we will take steps to delete that information promptly.

Parents or guardians who believe a child has provided us with personal data can contact us at the address in Section 20, and we will investigate and act on the request.

We maintain procedures to detect, investigate, and respond to personal data breaches. These include:

• identifying and containing the breach, and limiting any further loss or unauthorised access;
• assessing the nature and scope of the breach, including the data affected and the individuals concerned;
• remediating the cause and strengthening relevant safeguards; and
• notifying affected Data Principals and the Data Protection Board of India, in the manner and within the timelines required under the Digital Personal Data Protection Act, 2023 and its rules, where the law requires such notification.

If we become aware of a breach that affects your data, we will communicate with you through the Platform, by email, SMS, or other reasonable means, along with steps you can take to protect yourself.

At present, data collected through the Platform is processed and stored on cloud infrastructure located outside India. Our Supabase database and object storage run in the Asia-Pacific (Singapore) region, and our AWS infrastructure is provisioned in the United States (us-east-1). We do not currently store personal data in India.

Because personal data is therefore transferred outside India, such transfers will be carried out in accordance with the Digital Personal Data Protection Act, 2023 and the rules made under it, including any restrictions on transfer to certain restricted territories notified by the Central Government.

We assess our providers’ processing locations as part of our vendor review, and we update this Policy if our storage or processing footprint changes materially.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or the law. The “Last updated” date at the top of this page shows when it was last revised. For material changes, we will provide additional notice through the Platform or by other reasonable means before the changes take effect.

If you have questions about this Policy or how we handle your personal data — or if you wish to exercise your rights under Section 14, including requesting account deletion — contact us at:

SAMONA
Sole Proprietorship (Udyam Registration Number UDYAM-AP-20-0114242)
Registered proprietor: Nangana Mohanrao

D No. 32-9-2/1, Amaravati Foundation Office
Madhu Gardens, Dasari Lingiah Street
Vijayawada, NTR District, Andhra Pradesh – 520010, India
Email: samona.official9@gmail.com

Complaints and grievances may be addressed to our Grievance Officer, Nangana Mohanrao (registered proprietor), at samona.official9@gmail.com or at the registered address set out above. You also have the right to file a complaint with the Data Protection Board of India in accordance with the Act.

For the terms that govern your use of the Platform, please see our Terms & Conditions.