PolicyMitra Privacy Policy

This Policy addresses two categories of individuals whose personal data the App processes:

• Account Users — the insurance agent, agency staff, or agency administrator who registers for and uses the App to manage their business (“you”, “Account User”).
• Client Data Subjects — the individual clients of an Account User's insurance agency whose personal and policy information is entered into the App by an Account User in the ordinary course of managing that client's insurance relationship.

For Client Data, the agency operating the App account acts as the data fiduciary/data controller and is responsible for obtaining valid, informed consent from its clients before entering their personal information into the App, consistent with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable law. Createawity processes Client Data on the agency's instructions, as the technology provider that operates the App and its backend infrastructure, and does not independently determine the purposes for which Client Data is collected.

2.1 Account Information

When you register for and use the App as an Account User, we collect:

• Full name, mobile number, and email address (email is optional at signup)
• Login credentials (your password is stored using industry-standard hashing; we do not store or transmit it in plain text)
• Agency details: agency name, address, GST number, and preferred display language
• Your role within the agency (e.g., agent, admin, master) and any staff accounts you create

2.2 Client Information

As part of the App's core functionality, Account Users may enter the following information about their clients into the App:

• Client full name, mobile number, email address, date of birth, city, and free-text notes
• Consent status recorded under the DPDP Act and a “do-not-disturb” communication preference
• Insurance policy details: policy number, insurer name, plan, sum insured, premium amount and frequency, due and renewal dates, nominee name and relationship, and commission figures
• Daily savings (“Bachat”) records: collection and disbursement amounts, dates, notes, and savings goal targets
• Payout records, follow-up tasks, and sales lead details (name, mobile, email, source, and stage)
• Documents an Account User chooses to upload for import (for example, LIC premium due-list PDFs), which may contain policyholder names, policy numbers, and premium amounts

2.3 Authentication and Session Data

To keep you signed in, the App stores an access token and a session-refresh cookie securely on your device. These credentials are used only to authenticate your requests to our servers and are not accessible to other apps on your device.

2.4 Technical Data

Our servers process standard technical information (such as request metadata and IP address) that is inherent to operating any networked application. This information is used transiently for security, abuse prevention, and service reliability, and is not compiled into individual user profiles beyond what is reasonably necessary for those purposes.

2.5 What We Do Not Collect

The App does not access or collect:

• Your device contacts, photo library, camera, or precise/background location
• The contents of your SMS messages — one-time passwords (OTPs) must be entered manually and are never read automatically
• Advertising identifiers — the App contains no third-party advertising or analytics SDKs

• To provide and maintain the App's core features: client and policy management, renewal reminders, Bachat tracking, reports, and payouts
• To authenticate Account Users and maintain secure login sessions
• To prepare pre-filled messages (for example, a renewal reminder) that you may choose to send via WhatsApp or your device's calling app — these messages are sent from your own WhatsApp/phone account under your control, not automatically by Createawity
• To generate reports and summaries (such as commission, ROI, and cross-sell insights) for the agency's own internal use
• To maintain, secure, troubleshoot, and improve the App and its backend services
• To comply with applicable legal obligations and respond to lawful requests from public authorities

We do not use Account or Client information for advertising, we do not build advertising profiles, and we do not sell personal data to third parties.

We process Account Information on the basis of the consent you provide when creating an account and agreeing to the App's Terms of Use, and as necessary to provide the service you have requested.

Client Data is processed on the instructions of the agency (Account User), which is responsible under the DPDP Act for obtaining valid consent from its clients before their personal data is entered into the App. The App's client-consent-status field exists to help agencies record and track that consent; it does not substitute for the agency's own obligation to obtain it.

• All data transmitted between the App and our servers is encrypted in transit using HTTPS/TLS
• Access tokens and session cookies are stored using your device's platform-level secure storage (Android Keystore or iOS Keychain) and are not readable by other apps
• Passwords are never stored or transmitted in plain text
• We maintain reasonable administrative, technical, and physical safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction

No method of transmission or storage is perfectly secure. If we become aware of a data breach affecting your personal data, we will notify affected Account Users and relevant authorities as required by applicable law.

We do not sell personal data, and we do not share personal data with advertisers. We may share information only:

• With hosting and infrastructure providers who process data on our behalf, under confidentiality obligations, solely to operate the App
• When required to comply with applicable law, regulation, legal process, or a valid governmental request
• To protect the rights, property, safety, or security of Createawity, our users, or the public
• In connection with a merger, acquisition, or sale of assets, subject to continued protection of your data under this Policy

The App does not integrate any third-party advertising or analytics software development kits (SDKs).

We retain Account and Client Information for as long as the agency's account remains active, and for a reasonable period afterward as needed for legal, accounting, dispute-resolution, or audit purposes, or until deletion is requested in accordance with Section 8 below.

Subject to applicable law, including the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed
• Request correction or completion of inaccurate or incomplete personal data
• Request erasure of personal data that is no longer necessary for the purposes it was collected
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity
• Lodge a grievance regarding the handling of your personal data

To exercise any of these rights, contact us at info@createawity.tech.

If you are a Client Data Subject, please note that the agency managing your insurance policies is the party responsible for your personal data. We recommend directing requests to that agency in the first instance; Createawity will support the agency in fulfilling valid requests relating to data processed through the App.

The App is intended for use by adult insurance agency staff and is not directed at children. We do not knowingly collect personal data from children through Account registration. Where a client record reasonably requires details of a minor (for example, a minor named as a nominee or beneficiary on a policy), the agency entering that data is responsible for ensuring appropriate parental or guardian consent has been obtained. If you believe a child's personal data has been provided to us other than as described here, please contact us so we can address it.

Our servers and the infrastructure providers that process data on our behalf are located in India. Where personal data is transferred outside your country of residence, we take steps to ensure it receives a level of protection consistent with this Policy and applicable law.

We may update this Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. Material changes will be indicated by an updated “Last updated” date above, and, where appropriate, an in-App notice. Continued use of the App after changes take effect constitutes your acceptance of the revised Policy.

In accordance with the DPDP Act, we have designated a point of contact for privacy-related queries and grievances:

• Grievance Officer: To be provided
• Email: info@createawity.tech
• Registered address: To be provided

For any other questions about this Policy or our data practices, please write to info@createawity.tech.

This Policy is governed by the laws of India, without regard to conflict-of-law principles.