Privacy Policy

1. Data Inventory & Collection Behavior

PodSpace collects only the data strictly required to facilitate physical workspace reservations, secure electronic door unlocking, statutory tax invoicing, and operational turnover. We do not engage in behavioral advertising or cross-site tracking.

• Identity & Authentication: Full name, verified mobile phone number, email address (via Supabase Auth or Google OAuth), and optional profile avatar.
• Reservations & Session State: Pod identifier, selected slot start and end timestamps, session duration, booking status (pending, confirmed, in_use, completed, cancelled), extension history, and completed session ratings.
• Financial References (No Card Storage): Razorpay order IDs, payment transaction IDs, refund IDs, payment method tokens, and itemized GST tax invoice records (SAC code 998319, 18% GST). Raw debit/credit card numbers, expiry dates, CVVs, and net banking credentials are never received or stored on PodSpace servers; transactions are handled directly within Razorpay's PCI-DSS Level 1 compliant interface.
• Wallet & Referral Ledgers: Account credit balance, promotional credits, audit transaction timestamps, and referral bindings recorded in the platform ledger.
• Location Data (Foreground Only): Device GPS coordinates requested while discovering pods or calculating walking/driving distances. Location is queried ephemeral in-memory; coordinates are never logged, stored in databases, or tracked in the background.
• Device & Bluetooth Permissions: In the mobile application, Bluetooth Low Energy (BLUETOOTH_SCAN, BLUETOOTH_CONNECT) permissions are used exclusively within proximity of the pod to broadcast encrypted unlock commands to the physical door lock.
• Lock Access Records: TTLock hardware lock IDs, generated numeric keypad passcodes, Bluetooth authorization tokens, unlock event timestamps, and battery telemetry. Numeric passcodes are time-limited strictly to your reserved window plus a 5-minute exit grace period.
• Cleaner Turnover Photos: Photographic evidence of pod cleanliness, amenity restocking, and physical integrity captured by verified turnaround cleaners. These photos are stored in private encrypted object storage and accessed strictly by operations administrators.
• Support & Emergency Logs: Support ticket categories, customer inquiries, attached screenshots, agent responses, and 24x7 emergency escalation logs.

2. Legal Bases for Processing (DPDPA 2023)

Under the Digital Personal Data Protection Act, 2023 (DPDPA), PodSpace processes personal data on the following lawful grounds:

• Contractual Necessity (Section 4): Managing user accounts, holding slots, executing payment confirmations, generating electronic door passcodes, extending sessions, and processing cancellations/refunds.
• Consent (Section 6): Voluntary account creation, promotional communications, and optional performance telemetry (managed via cookie preferences).
• Certain Legitimate Uses (Section 7): Complying with statutory tax directives (GST invoicing), responding to medical/safety emergencies inside a pod, and preventing fraudulent booking behavior.

3. Operational Purposes & Use Cases

• Provisioning authorized physical access to reserved pods via Bluetooth Low Energy and numeric keypad passcodes.
• Ensuring multi-tenant scheduling concurrency, preventing slot collisions, and enforcing the 10-minute payment hold buffer.
• Issuing GST-compliant tax invoices and executing automated wallet or original-source refunds.
• Dispatching advisory push notifications regarding slot start, 5-minute remaining warnings, and cleaning readiness.
• Coordinating physical maintenance, sanitization inspections, and emergency assistance.
• Anonymized telemetry to monitor map rendering speed and booking funnel reliability (only when consented).

4. Third-Party Service Providers & Sharing

We do not sell, rent, or monetize your personal data. We disclose data solely to the following sub-processors under contractual data processing agreements:

5. Data Retention Schedule

PodSpace retains personal data strictly for the duration necessary to satisfy operational purposes, contractual commitments, and statutory tax and accounting mandates:

6. Security Practices & Encryption

• Data in Transit: Enforced TLS 1.3 cryptographic protocols with modern cipher suites for all web, API, and mobile communications.
• Row-Level Security (RLS): PostgreSQL database tables enforce strict tenant isolation policies ensuring customers can only query and mutate their own bookings and profile records.
• Zero Card Exposure: PodSpace maintains an absolute zero-card-storage architecture. Card data entry and tokenization occur within Razorpay's hosted PCI-DSS environment.
• Private Evidence Vault: Cleaner turnover photos reside in a private Supabase Storage bucket accessible exclusively via short-lived cryptographic signed URLs generated for authenticated staff.
• Lock Isolation: Smart locks receive time-restricted credentials only; no personally identifiable customer information is ever written to or transmitted through physical door hardware.

7. Your Statutory Rights & Deletion Workflow

Under Chapter III of the DPDPA 2023, you are entitled to the following rights as a Data Principal:

• Right to Access Information (Section 11): Request a summary of personal data held about you and processing activities undertaken.
• Right to Correction and Erasure (Section 12): Request correction of inaccurate information or permanent erasure of personal data that is no longer necessary for operational or statutory purposes.
• Right to Grievance Redressal (Section 13): Access an accessible grievance redressal mechanism with an initial response within 48 hours and formal resolution within 30 days.
• Right to Nominate (Section 14): Nominate an individual to exercise your rights in the event of death or incapacity.

8. Cookies, Storage & Consent Gating

PodSpace uses minimal, functional browser storage. We enforce working consent controls that completely halt optional analytics network calls before user authorization:

• Strictly Necessary Storage: Authentication session tokens (sb-*-auth-token), slot reservation concurrency locks (podspace_active_hold), and your consent state (podspace_cookie_consent). These cannot be deactivated as the platform cannot function without them.
• Optional Performance & Analytics: Gated telemetry events that monitor booking funnel completion. If you select Reject Non-Essential or keep analytics disabled, no analytics requests are dispatched to our telemetry endpoints.

You can modify or withdraw your consent at any time by clicking Cookie Settings in the website footer.

9. Age Policy & Minors

PodSpace is strictly intended for individuals 18 years of age or older who possess legal capacity to enter into binding contracts under the Indian Contract Act, 1872. We do not knowingly solicit or collect personal data from minors. If we discover an account registered by an unaccompanied individual under 18, the account and related data will be terminated immediately.

10. Cross-Border Data Transfers

Primary customer personal data is hosted in India (AWS Mumbai). Certain technical infrastructure partners (e.g. TTLock gateway in Frankfurt, Germany; Firebase push delivery in the USA) operate globally. All cross-border technical transfers comply with applicable guidelines under DPDPA Section 16, ensuring that sub-processors maintain data security controls equivalent to Indian statutory standards.

11. Data Fiduciary & Grievance Officer

For privacy inquiries, rights requests under DPDPA, or formal grievances, contact our designated Data Protection & Grievance Redressal Officer:

For general booking or platform assistance, please visit our Support Centre.