Privacy Policy & Data Security

1. Introduction & Scope

Welcome to UdaanByte (“we,” “our,” or “us”), operated from Airoli, Navi Mumbai, Maharashtra, India. UdaanByte delivers hyperlocal B2B AI technologies, physical A6 acrylic NFC counter standees, Google Business Profile optimization, and local marketing automation to offline Indian micro, small, and medium enterprises (MSMEs).

This Privacy Policy governs your use of the UdaanByte public website (udaanbyte.com), the Merchant Shop Dashboard (udaanbyte.com/db/shop_login.html), the ReviewGen Engine v5.0 portal (udaanbyte.com/review.php?shop={slug}), and physical NFC/QR counter standees deployed at registered merchant retail counters.

2. Information We Collect

We deliberately practice data minimization. We only collect the minimal information necessary to deliver counter review generation and merchant analytics:

• Merchant Account Details: Shop business name, owner name, verified WhatsApp/mobile number, email address, physical shop address, Google Maps Place ID / CID, and chosen subscription tier.
• Customer Counter Interactions: When a counter walk-in taps an NFC standee or scans the QR code, we log the event timestamp, the shop identifier (slug), the selected star rating (1 to 5), and the chosen language preference (English, Marathi, Hindi, or Hinglish).
• Optional Qualitative Feedback: If a customer inputs custom feedback tags or taps satisfaction chips (e.g., “Quick Billing,” “Polite Staff,” “Fresh Stock”), these are recorded solely to personalize the AI draft review.
• System Telemetry: Aggregated, non-identifiable browser User-Agent strings and anonymized IP addresses for rate limiting and fraud prevention.

3. What We Never Collect (Customer Freedom Guarantee)

Unlike predatory marketing platforms or spam aggregators, UdaanByte never harvests counter customer contact information:

• Never Harvested No Customer Mobile Numbers or Names: Walk-in customers do not sign in, enter OTPs, or register their contact numbers to generate a review.
• Never Stored No Payment Credentials: We never capture UPI PINs, credit/debit card numbers, bank details, or checkout totals. The NFC standee operates independently of your billing POS or soundbox.
• Never Sold Zero Data Selling: Customer review preferences and shop visit metrics are never shared, rented, or sold to third-party ad networks or data brokers.

4. Anti-Hallucination AI & Third-Party APIs

The ReviewGen Engine v5.0 incorporates a dual-grounding anti-hallucination pipeline (facts.php and truth.php). When a customer generates a review draft:

• The prompt contains strictly bounded shop attributes (e.g., business category, selected positive tags, customer star rating).
• No personally identifiable customer details are sent to upstream LLM providers (Google Gemini / Groq / OpenRouter).
• Requests are transmitted over encrypted TLS 1.3 channels and are never stored by AI providers to train public models.
• Reviews of 1, 2, or 3 stars are quarantined by our Negative Review Firewall and routed to the merchant’s internal resolution desk without publishing to external search engines.

5. Data Security & SQLite Storage Architecture

All merchant and interaction records reside on secured Hostinger Premium LiteSpeed servers partitioned into a high-performance 3-database SQLite architecture:

• data/businesses.db — Merchant credentials, Google Place IDs, and plan entitlements.
• data/review_generation_log.db — High-frequency tap timestamps, star selections, and latency metrics.
• data/leads.db — 7-Day Free Trial pilot requests and inbound inquiries.

Security Controls: Direct downloads of all .db, .sqlite, .env, and log files are strictly rejected with HTTP 403 Forbidden via LiteSpeed .htaccess directives. Databases operate under SQLite Write-Ahead Logging (WAL) mode with parameterized PDO prepared statements to block SQL injection.

6. Cookie & Local Storage Policy

We use minimal, non-tracking client-side storage mechanisms:

• ub_cyber_theme (Local Storage): Stores your preference for Cyber-Luxe Dark or Warm Canvas Light mode.
• ub_cookie_consent (Local Storage): Remembers that you acknowledged our privacy terms.
• PHPSESSID (Session Cookie): Used exclusively within the authenticated Merchant Dashboard (/dashboard) with HttpOnly, SameSite=Strict, and Secure flags. Expires immediately upon logout.

7. Grievance Officer & Inquiries

In accordance with the Information Technology Act, 2000, and rules made thereunder, any privacy disputes or data deletion requests may be directed to our Grievance Officer: