1. Who We Are

PrintRocket India Private Limited ("PrintRocket", "we", "us", "our") is a company incorporated under the Companies Act, 2013, operating the PrintRocket mobile application and website — an AI-powered, hyperlocal print-on-demand platform that connects users with verified local print vendors for document printing, design, binding, and delivery services.


Company	PrintRocket India Private Limited
CIN	U18129DC2026PTC472309
PAN	AARCP1736E
Registered Address	5th Floor, Mehershi Kanad Bhawan, Udhmodhaya Foundation, University of Delhi, North Campus, New Delhi – 110007
Website	www.printrocket.in
Email	info@printrocket.in
Phone	+91 8218768195

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), PrintRocket India Private Limited is the Data Fiduciary — the entity that determines the purposes and means of processing your personal data.

2. What This Policy Covers

This Privacy Policy explains:

What personal data we collect from you when you use the PrintRocket app and website (collectively, the "Platform")
Why we collect it and the legal basis for doing so
How we use, store, protect, and share it
How long we keep it
What rights you have over your data and how to exercise them

By downloading the PrintRocket app, registering an account, or placing an order, you confirm that you have read and understood this Privacy Policy. If you do not agree with how we handle your data, please do not use the Platform.

This Policy applies to:

All registered users of the PrintRocket mobile application
Visitors to the PrintRocket website (www.printrocket.in)
Anyone who contacts us by email, phone, or through support channels

This Policy does not apply to print vendors or delivery partners who register as service partners on our platform — a separate Partner Privacy Notice governs their data.

3. Legal Framework

We comply with all applicable Indian data protection and privacy laws, including:

Information Technology Act, 2000 (IT Act) — the current governing legislation
IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) — governing collection and use of sensitive personal data
Digital Personal Data Protection Act, 2023 (DPDP Act) — phased implementation; full enforcement from May 2027
Consumer Protection Act, 2019 — governing consumer rights and redressal
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 — governing platform obligations

We are implementing DPDP Act compliance ahead of the full enforcement date to protect our users' rights from day one.

4. What Personal Data We Collect

4.1 Data You Provide Directly

When you register and use PrintRocket, you provide us with:

Data	Why We Collect It
Mobile phone number	Account creation and OTP-based authentication
Full name	Order records and delivery addressing
Delivery address	Fulfilling home delivery orders
Email address (optional)	Order receipts and account recovery
Documents and files you upload	Processing and printing your orders
Print preferences	(sides, copies, paper quality, binding)
Special instructions	Customising your print order
Design inputs	If you use our AI design or design service
Payment method	Processed by Razorpay — we do not store raw card data
Support messages	Resolving your queries

4.2 Data We Collect Automatically

When you use the PrintRocket app, we automatically collect:

Device information — type, model, operating system version, device identifiers
App usage data — features used, session duration, order flow navigation
IP address — for security and fraud detection
Approximate location — from IP address, used for displaying regional availability
Precise GPS location — only when you grant permission, used for hyperlocal vendor matching
Push notification token — to send you order status updates
Crash and diagnostic data — to identify and fix technical issues
Order and transaction history — maintained as your account record

4.3 Data from Third Parties

We receive limited data from:

Razorpay — payment confirmation, transaction reference ID, and payment status (never your full card number or CVV)
Print vendors — order acceptance confirmation, fulfillment status updates, pickup readiness notifications
Delivery partners — delivery status and completion confirmation

4.4 What We Do Not Collect

We do not collect:

Biometric data of any kind
Health or medical information
Financial account numbers or bank details
Political opinions, religious beliefs, or caste information
Sexual orientation or gender identity beyond what you choose to display in your profile
Data from your contacts, call logs, or SMS messages

Data minimisation: We apply the principle of collecting only what is strictly necessary to provide the service you request. We do not collect data "just in case" it might be useful later.

5. Why We Collect It — Purposes of Processing

5.1 Contract Performance (Processing your orders)

We process your data because it is necessary to fulfil the service you have requested:

Creating and managing your PrintRocket account
Receiving, routing, and fulfilling your print and design orders
Matching your order with the nearest available verified vendor
Enabling payment processing through Razorpay
Arranging home delivery or coordinating self-pickup
Sending order confirmation, status updates, and delivery notifications
Enabling time-slot scheduling for pickup

5.2 Legal Obligation

We process certain data because Indian law requires us to:

Maintaining financial transaction records (required under Income Tax Act and GST regulations)
Responding to lawful requests from courts, law enforcement, and regulatory authorities
Maintaining data security records as required under the IT Act and SPDI Rules
Issuing GST-compliant invoices

5.3 Legitimate Interest (Platform operation)

We process data for our legitimate business interest in operating a reliable, secure platform:

Authenticating users and preventing unauthorised account access
Detecting and preventing fraud and abuse
Conducting internal analytics to improve platform performance and user experience
Diagnosing and fixing technical issues
Maintaining audit logs for platform integrity

When we rely on legitimate interest, we ensure our interests do not override your privacy rights.

With your explicit consent, we process data for:

Sending promotional messages, discount offers, and new feature announcements (push, SMS, email)
Using analytics tools to understand how you use the app
Requesting your precise GPS location for hyperlocal vendor matching

You can withdraw consent for any of these at any time — see Section 9.

6. How We Use Your Uploaded Files

Documents and files you upload (PDFs, Word documents, JPGs, PNGs) are treated with strict confidentiality. Our commitments:

Transmitted securely — all file uploads use TLS 1.3 encrypted connections
Used only to print your order — files are never used for any other purpose
Shared only with your assigned vendor — and only the files relevant to their order
Automatically deleted within 30 days of order completion from our primary servers
Never used to train AI models — your documents will never be used to train, fine-tune, or evaluate any machine learning model
Never accessed by PrintRocket staff unless you explicitly request support that requires it
You can request immediate deletion of any uploaded file by contacting us

Vendors receive your files in read-only format tied to a specific order. Vendors are contractually prohibited from retaining, copying, or using files for any purpose beyond printing that order.

We share your data only where necessary to deliver the service. We do not sell your data. We do not share your data for advertising purposes.

7.1 Local Print Vendors

To fulfil your order, we share:

Your name
Contact number (for pickup coordination)
Delivery address (for home delivery orders)
Order specifications and uploaded files

Vendors are bound by our Vendor Partner Agreement, which prohibits them from using your data for any purpose beyond fulfilling your specific order.

7.2 Delivery Partners

For home delivery orders, we share your delivery address, contact number, and order ID with our logistics partners. This data is used exclusively for the delivery transaction.

7.3 Payment Processor — Razorpay

Payment processing is handled entirely by Razorpay Software Private Limited (PCI DSS Level 1 certified). When you pay, your payment data is transmitted directly to Razorpay under their Privacy Policy (razorpay.com/privacy). We receive only a transaction reference ID and payment confirmation status — we never store your card number, CVV, expiry date, or UPI PIN.

7.4 Technology Service Providers

We use trusted service providers who process data strictly on our instructions:

Provider Type	Purpose
Cloud hosting	Storing app data and user records securely
Push notifications (FCM)	Sending you order status updates
Analytics	Understanding app usage patterns (anonymised)
Customer support tooling	Managing your support queries
SMS gateway	Sending OTP and critical order alerts

All service providers are bound by data processing agreements that restrict them from using your data for any purpose other than providing their service to us.

7.5 Legal and Regulatory Authorities

We may disclose your personal data to government authorities, courts, or law enforcement agencies when:

We are legally required to do so by a court order, summons, or statutory requirement
Disclosure is necessary to investigate suspected fraud or illegal activity
Disclosure is necessary to protect the rights, property, or safety of our users or the public

We will notify you of any such disclosure where we are legally permitted to do so.

7.6 Business Transfers

If PrintRocket is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you before your data is transferred and a different privacy policy applies.

We never sell, rent, trade, or share your data with advertisers, data brokers, or marketing firms. Your data has never been monetised in this way and will not be.

8. How Long We Keep Your Data

We retain your data only as long as necessary for the purpose it was collected, or as required by law.

Data Type	Retention Period	Reason
Account information	Duration of account + 3 years after last activity	Service continuity and legal obligation
Order records	7 years from order date	GST, Income Tax, and Consumer Protection Act requirements
Uploaded files and documents	30 days after order completion, then permanently deleted	Necessary for reprint queries; minimised thereafter
Payment transaction records	8 years	RBI record-keeping requirements
Precise GPS location	Session only — not stored after vendor assignment	Data minimisation
Crash and diagnostic logs	90 days	Technical improvement
Marketing consent records	Until consent is withdrawn or account deleted	Proof of consent
Customer support conversations	2 years from resolution	Quality and dispute resolution

When data reaches the end of its retention period, we permanently delete or irreversibly anonymise it.

9. Your Rights

Under the DPDP Act, 2023 and existing Indian privacy law, you have the following rights:

9.1 Right to Information

You can request a summary of:

What personal data we hold about you
The purposes for which we process it
The third parties we share it with

9.2 Right to Access

You can request a copy of your personal data that we hold.

9.3 Right to Correction

You can request correction of any inaccurate or incomplete data. You can update your name, phone number, and delivery address directly in the app under Account → Settings.

9.4 Right to Erasure (Right to Be Forgotten)

You can request deletion of your personal data and account. We will:

Delete your account data within 7 days of a verified request
Retain data we are legally required to keep (e.g., transaction records)
Confirm deletion in writing

Where we process your data on the basis of consent (e.g., marketing), you can withdraw consent at any time:

Push notifications: App Settings → Notifications → toggle off
Location: Device Settings → Apps → PrintRocket → Permissions → deny Location
Marketing emails/SMS: Unsubscribe link in the message or email us

Withdrawing consent does not affect the lawfulness of processing before withdrawal.

9.6 Right to Grievance Redressal

If you have a complaint about how we handle your data, contact our Grievance Officer (see Section 17). We will acknowledge within 48 hours and resolve within 30 days.

How to Exercise Your Rights

Send a written request to info@printrocket.in with:

Your registered mobile number
A clear description of your request
Proof of identity if required

We do not charge fees for rights requests. We may verify your identity before processing sensitive requests.

10. Data Security

We implement technical and organisational measures to protect your personal data:

Technical measures:

All data in transit is encrypted using TLS 1.3
Databases are encrypted at rest using AES-256
Payment environments are PCI DSS compliant via Razorpay
Access controls: role-based access, with access to personal data limited to authorised personnel who need it to do their jobs
Two-factor authentication required for all admin access

Organisational measures:

All staff who handle personal data receive data protection training
Third-party vendors are vetted and bound by data processing agreements
We conduct regular security reviews

In the event of a data breach:

We will notify the Data Protection Board of India within 72 hours of becoming aware of a breach
We will notify affected users promptly with details of the breach and steps taken
We will take immediate steps to contain and remediate the breach

No system is completely secure. While we do everything reasonably practicable to protect your data, we cannot guarantee absolute security.

11. Children's Privacy

The PrintRocket Platform is intended for persons who are 18 years of age or older.

We do not knowingly collect personal data from children under 18. Where a child uses our Platform, verifiable consent of the parent or legal guardian is required before we process any of the child's personal data (as required under Section 9 of the DPDP Act).

We do not:

Conduct behavioural monitoring of children
Display targeted advertising to children
Create profiles of children for any commercial purpose

Violations of children's data obligations carry penalties of up to ₹200 crore under the DPDP Act.

If you believe a child has used our Platform without proper parental consent, contact us at info@printrocket.in immediately and we will delete that data promptly.

12. Location Data

The PrintRocket app may request access to your device's GPS location to enable hyperlocal vendor matching — finding the nearest verified print vendor to your location.

Location access is optional:

If you grant location access: We use your real-time location to identify nearby vendors and calculate delivery routes. Location data is used during the active ordering session only and is not stored after vendor assignment.
If you deny location access: You can manually enter your address. All features remain accessible.

You can change location permissions at any time: Device Settings → Apps → PrintRocket → Permissions → Location

We never share your location data with third parties for advertising or profiling purposes.

13. Push Notifications

We use push notifications (via Firebase Cloud Messaging) to send you:

Order status updates (confirmed, printing, ready, dispatched, delivered)
OTP messages for login verification
Promotional offers and new features (only if you have opted in)

You can manage notification preferences in the PrintRocket app under Account → Notifications, or through your device's notification settings.

14. Cross-Border Data Transfers

Some of our technology service providers (such as cloud hosting and analytics tools) may process data on servers located outside India.

Under Section 16 of the DPDP Act, cross-border data transfers are permitted unless the Central Government restricts transfer to specific countries. As of the date of this Policy, no such restricted country list has been published.

Where your data is processed outside India:

We ensure equivalent data protection standards are applied through contractual Data Processing Agreements
We use providers operating within recognised international data protection frameworks

15. Third-Party Services

The PrintRocket Platform integrates with the following third-party services:

Service	Purpose	Their Privacy Policy
Razorpay	Payment processing	razorpay.com/privacy
Firebase (Google)	Push notifications, analytics	firebase.google.com/support/privacy
Google Analytics	Website traffic analytics	policies.google.com/privacy
Google Maps	Map display and vendor location	maps.google.com/help/terms_maps

We are not responsible for the privacy practices of these third parties. We recommend reviewing their policies.

Our Platform may contain links to third-party websites. Clicking those links means you leave our Platform, and their privacy policies apply.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, law, or services.

When we make material changes:

We update the "Last updated" date at the top of this Policy
We notify you via an in-app alert or push notification
For fundamental changes to how we process your data (e.g., new uses, new third-party sharing), we will seek fresh consent before the change takes effect

We encourage you to review this Policy periodically. Your continued use of the Platform after notification of changes constitutes acceptance of the updated Policy.

17. Contact & Grievance Officer

For all privacy queries, data access requests, complaints, or to exercise your rights:


Grievance Officer	Amit Arora
Designation	Founder & Grievance Officer, PrintRocket India Private Limited
Email	info@printrocket.in
Phone	+91 8218768195
Address	5th Floor, Mehershi Kanad Bhawan, Udhmodhaya Foundation, University of Delhi, North Campus, New Delhi – 110007
Acknowledgement time	Within 48 hours
Resolution time	Within 30 days
Business hours	Monday to Saturday, 10:00 AM – 6:00 PM IST

If you are not satisfied with our response, you may escalate to the Data Protection Board of India once it becomes fully operational (expected May 2027).

PrintRocket India Private Limited — CIN: U18129DC2026PTC472309 — www.printrocket.in

Privacy Policy