Privacy notice
This notice tells you what personal data enlacey collects, why, where it is kept, who can see it, and how to get it out or get rid of it. It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP).
Who we are
enlacey is a services marketplace for Haldwani, Uttarakhand. It is run by one individual — the founder, Naman Gururani — not by a company. There is no company, no registered office and no other staff. Under the DPDP Act the founder is the Data Fiduciary for your data, and he is also the grievance officer named at the end of this page.
Contact: privacy@enlacey.com · Haldwani, Uttarakhand, India.
The short version
- We collect only what a booking actually needs.
- We never sell your data and we show no advertising.
- Your phone number is stored as a one-way hash plus the last 4 digits — the readable number lives only with Google, our sign-in provider.
- Your data sits on servers in India.
- You can download everything we hold, or delete your account, from inside the app — without asking us.
What we collect, and why
Your phone number
To create your account and sign you in. The code is sent by Google Firebase Phone Authentication. We store an irreversible hash of the number and its last 4 digits (so our team can recognise a caller); the readable number stays with Google.
An optional password
If you choose to add one, it is stored only as a salted, keyed one-way hash (argon2id) — we cannot read it back. Sign-in attempts are rate-limited, and a one-time code always works instead, which is also how you reset it.
Your name and profile photo
So the person you book with knows who they are dealing with. Optional, but a job is hard to run without a name.
Your addresses and location
To show you providers near you and to let the provider reach the place. The exact address is revealed to a provider only after they accept the booking; before that they see the area only.
What you ask for
The job description you type or dictate (including a voice note), the category, the time you want, and any photos you attach — to match you with the right people and to run the job.
Health information (Care & Health bookings only)
If you book nursing or elderly care, what you type about the person's condition — a diagnosis, a medicine, the help they need. You choose what to write, and you can keep it as brief as you like. We use it only to run that booking: to match the right provider and to let the provider you accept do the job. It is never used for anything else, never shared, and it goes when you delete your account.
Chat messages and job photos
Messages between you and the other party in a booking, plus any photos in it, and the provider's arrival selfie — to run the booking and to settle a dispute if one comes up.
Verification documents (providers only)
If you apply to work through enlacey: an ID proof and any certificates you send, plus the notes of the check. Seen only by the enlacey team, never by customers. We show customers only the badge that the check produced.
Ratings and reviews
What you write about the other party after a booking, and what they write about you. Reviews are shown publicly in the app with the reviewer's first name.
Your device and notification token
The push token of your phone, its platform and app version — to send you a notification when a provider accepts, arrives or messages you.
Security and audit records
Sign-in times, a coarse IP prefix (for example 203.0.113.0/24 — the neighbourhood, not your address), a hash of your app/browser user-agent, and a record of every time a member of our team opens someone's personal data. This is how we spot abuse and prove who looked at what.
Crash reports
If the app or the server crashes, the technical stack trace goes to Sentry. It is configured not to send personal data — no phone number, name, address or message text.
We do not collect your Aadhaar or PAN, your contacts list, your call or SMS logs, or your bank or card details. We take no health data from your phone, from any health app, or from any device — the only health information we ever hold is what you choose to type in a Care & Health job description, as described above.
On what basis we use it
Mostly on your consent: before your account is created you tick that you accept the terms, that you agree to us processing your profile, location and booking details to run your bookings, and that you are 18 or older. We store what you agreed to and when, with a version number, so it can be checked later. Where the law requires us to keep something (records of a transaction, or a response to a lawful request from an authority), we keep it on that basis.
You can withdraw consent at any time — the practical way to do that is to delete your account, because without this data the service cannot run for you.
Where your data is kept
-
Database and application: a server in India — Amazon Web Services,
Mumbai region (
ap-south-1). - Photos, voice notes and documents: Amazon S3, Mumbai region. They are never public; they open only through a link that expires in minutes.
- Sign-in: Google Firebase Authentication holds your phone number and delivers the SMS. Google may process it on its own infrastructure outside India.
- Push notifications: delivered through the Expo push service and then Google's FCM. The notification text is deliberately kept free of personal details.
- Crash reports: Sentry, European Union data region.
Apart from those named services, your data does not leave India, and we do not transfer it to any country the Government of India has restricted.
Who can see your data
- The other party in a booking — and only what they need: your first name, your job description, the chat, and (after they accept) the address and the arrival details. A provider never gets your phone number from us.
- The enlacey team — today, the founder, and anyone he asks to help in Haldwani. Every look at personal data is logged.
- The services listed above (Amazon Web Services, Google Firebase, Expo, Sentry), which process data on our instructions.
- An authority, if the law obliges us — for example a court order or a police request that is valid on its face.
We do not sell your data, rent it, use it for advertising, or hand it to data brokers.
How long we keep it
- While your account exists — your profile, addresses, bookings and messages stay so the app works.
- When you delete your account — your name, phone, addresses, photos, documents, devices and provider listing are removed immediately, and your sign-in record with Google is deleted too.
- 30 days after deletion — the leftovers that the other party might still need for a dispute (chat message text, booking photos, voice notes) are wiped by an automatic sweep.
- Kept for longer, without your name: the record that a booking and a payment happened, your consent records, and the audit trail. Consumer-protection and tax law expect these to exist, and a consent record is only useful if it survives.
Your rights
- Get a copy — in the app: Profile → Download my data. It gives you a JSON file with your profile, addresses, jobs, bookings, reviews, messages and notifications.
- Correct it — edit your name, addresses and provider details in the app, or write to us for anything you cannot reach.
- Delete it — in the app: Profile → Delete account, or by email if you cannot open the app. See enlacey.com/delete-account.
- Withdraw consent — as described above.
- Nominate someone — DPDP lets you name a person who can exercise these rights for you if you die or become unable to. There is no screen for it yet; email us and we will record it.
- Complain — to our grievance officer below, and after that to the Data Protection Board of India.
We may ask you to confirm it is really you — usually by calling the number on the account — before acting on a request that arrives by email.
Children
enlacey is for adults: you must be 18 or older to have an account, and you confirm that when you sign up. We do not knowingly collect data about anyone under 18. If you believe a child has an account, write to us and we will delete it.
How we protect it
- Everything travels over HTTPS.
- Your phone number is stored only as a keyed one-way hash, plus the last 4 digits.
- Photos and documents are private by default and open only through short-lived signed links.
- Our team's access is role-based and least-privilege, and every read of personal data writes an audit record.
- Our logs are scrubbed of personal data — phone numbers, addresses, locations and tokens never appear in them.
- Backups are taken daily and kept in India.
No system is perfect. If a breach happens that puts you at risk, we will tell you and the Data Protection Board, as the law requires.
Grievance officer
Naman Gururani, founder, enlacey
Email:
privacy@enlacey.com
Haldwani, Nainital district, Uttarakhand, India
This address forwards to the founder's mailbox — enlacey is run by an individual and has no company switchboard.
We acknowledge every complaint within 48 hours and answer it within 7 days. If you are not satisfied, you may complain to the Data Protection Board of India.
Changes to this notice
This is version 1.0, effective 11 September 2026. If we change anything material — new data, a new purpose, a new recipient — we will publish the new version here with a new number and date, and ask you to agree again inside the app before it applies to you.