Who we are. Kavach Devices Private Limited is a private limited company incorporated in India under the Companies Act, 2013, with its registered office in Pune, Maharashtra, India.
CIN: [To be inserted] · GSTIN: [To be inserted] · Registered office: [Address to be inserted], Pune, Maharashtra, India · Email: hello@kavachdevices.com
This Privacy Policy explains how Kavach Devices Private Limited ("Kavach", "we", "us") handles your personal data when you visit this website, join our waitlist, subscribe to our newsletter, or use a Kavach device and the Kavach app.
We are a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025. You are a Data Principal. This policy is also our notice under Section 5 of the DPDP Act, and takes into account the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
The short version. A safety device only works if you trust it. We collect the minimum we need to reach your emergency contacts and show them where you are. We do not sell your personal data, we do not use your location for advertising, and we never share your location with anyone except the contacts you choose.
Before launch. Fields marked [To be inserted] must be completed with the company's registered particulars, and this document should be reviewed by Indian counsel before Kavach is offered for sale.
1. What personal data we collect
When you use this website
- Waitlist and newsletter sign-ups: your email address, and optionally your name and which product interests you.
- Technical data: the page you signed up from, the referring website, your browser user-agent, and the country your request came from.
- Abuse prevention: a one-way salted hash of your IP address. We do not store your raw IP address.
When you use a Kavach device and app
- Account data: name, email address, mobile number and password credentials.
- Emergency contact data: the names and mobile numbers of the contacts you choose to add.
- Location data: your device location, collected when you trigger an alert, while an alert is active, and when you deliberately switch on live location sharing.
- Device telemetry: battery level, firmware version, connection status and alert history.
- Support data: the contents of messages you send us.
We do not collect payment card details ourselves. Payments are handled by regulated payment gateways that process card data under their own policies and applicable RBI rules.
2. Why we process it, and on what basis
Under the DPDP Act we process personal data only for lawful purposes, with your consent or for a legitimate use permitted by the Act. Each purpose below is itemised, as the DPDP Rules require.
| Purpose | Data used | Basis |
|---|---|---|
| Deliver an SOS alert to your emergency contacts | Name, location, contact numbers | Consent; and legitimate use where processing is necessary to respond to a threat to life or safety |
| Show your live location on the family map | Location | Consent, which you can withdraw |
| Send SMS and automated voice calls to contacts | Contact numbers, your name, location link | Consent |
| Operate your account and subscription | Account data | Performance of our contract with you |
| Waitlist and product-launch emails | Email, name, interest | Consent, withdrawable at any time |
| Keep the service secure and prevent abuse | Hashed IP, device telemetry | Legitimate use |
| Meet legal, tax and regulatory obligations | Transaction records | Compliance with law |
We do not sell or rent your personal data, use your location for advertising or profiling, or share your data with data brokers.
3. Consent, and how to withdraw it
Where we rely on consent, we ask for it separately from these terms, in plain language, before we process the data. You may withdraw consent at any time, and withdrawing it is as easy as giving it.
- Marketing email: use the unsubscribe link in any email, or write to us.
- Location sharing: switch it off in the Kavach app, or revoke the location permission in your phone's settings.
- Everything else: email privacy@kavachdevices.com.
Withdrawing consent does not affect processing carried out before the withdrawal. Please note that withdrawing consent for location processing will stop Kavach from being able to tell your contacts where you are, which is the core function of the product.
4. Your rights as a Data Principal
The DPDP Act gives you the following rights, and we will act on a valid request within the timelines prescribed under the Act and Rules.
- Right to access: a summary of the personal data we hold about you and how we process it.
- Right to correction and completion: have inaccurate or incomplete data corrected or completed.
- Right to erasure: have your personal data erased, unless we are required to retain it by law.
- Right to grievance redressal: raise a complaint with us and have it addressed. See Grievance Redressal.
- Right to nominate: nominate another individual to exercise your rights if you die or become incapacitated.
To exercise any of these, email privacy@kavachdevices.com from the address on your account. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
5. Who we share data with
- Your emergency contacts, who receive your name, the time of the alert and a live location link when you trigger an alert. This is the purpose of the product.
- Processors acting on our instructions: cloud hosting, SMS and voice-call gateways, mapping providers, email delivery and payment gateways. They may process data only for us, under contract.
- Authorities, where disclosure is required by law, court order, or to respond to a threat to life or safety.
Our infrastructure runs on Amazon Web Services. Some processors may process data outside India; where they do, transfers are made only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and under contractual safeguards.
6. How long we keep it
| Data | Retention |
|---|---|
| Waitlist and newsletter records | Until you unsubscribe, or 24 months after our last contact with you |
| Account data | For as long as your account is active |
| Location data from an alert | 90 days, so you and your contacts can review what happened |
| Live-sharing location trail | 24 hours |
| Invoices and tax records | 8 years, as required under Indian tax law |
When you close your account we erase your personal data, and instruct our processors to do the same, except where the law requires us to keep it.
7. How we protect it
We implement reasonable security safeguards as required by Section 8(5) of the DPDP Act and the IT Rules, 2011, including encryption in transit and at rest, access control on a need-to-know basis, hashing of IP addresses, logging and monitoring, and periodic review of our security practices.
If a personal data breach occurs, we will notify the Data Protection Board of India and every affected Data Principal without delay, and in any event within the timelines prescribed under the DPDP Rules, 2025.
No system is perfectly secure. We ask you to use a strong, unique password and to tell us immediately if you believe your account has been compromised.
8. Children and persons with disabilities
Kavach Core, Plus and Pro are intended for adults aged 18 and over. Kavach Plus may be set up by a family member or caregiver for an adult in their care, who should know they carry it. We do not knowingly collect personal data from children.
Where we process the personal data of a child under 18, or of a person with a disability who has a lawful guardian, we obtain verifiable consent from the parent or lawful guardian as required by Section 9 of the DPDP Act. We do not undertake tracking, behavioural monitoring for advertising, or targeted advertising directed at children.
By design, there is no Kavach app for a child. The guardian holds the account and the visibility.
9. Cookies and analytics
This website does not set advertising or tracking cookies and does not run third-party analytics or advertising trackers. We load fonts from Google Fonts, which means your browser makes a request to Google's servers to fetch them.
The Kavach app stores a session token on your device so that you stay signed in. This is necessary for the service to work.
10. Changes to this policy
If we change this policy we will update the date at the top of the page. If a change materially affects how we use your personal data, we will tell you by email or in the app before it takes effect, and where the law requires it we will ask for fresh consent.
11. Contact and grievances
For any question about this policy or about your personal data, contact our Data Protection Officer / Grievance Officer:
- Name: [To be inserted]
- Designation: Grievance Officer & Data Protection Officer
- Email: privacy@kavachdevices.com
- Address: [Registered office address to be inserted], Pune, Maharashtra, India
We acknowledge complaints within 48 hours and aim to resolve them within 30 days. Full details are on our Grievance Redressal page.