Privacy Policy

1. Who we are and our role

For the personal data you provide to run your account and use the platform, SurveyX Technologies Private Limited is the Data Fiduciary and you are the Data Principal. Our registered office is at Flat 201, Shivsai Complex, S. No. 68A/2, Hadapsar Road, Manjri, Pune, Maharashtra 412307. GSTIN: 27ABRCS5448P1Z8.

When you apply to an RPTO through DroneSetu and share identity documents with it, that RPTO is a separate Data Fiduciaryfor those documents and for your training records, and is responsible for its own use of them (including the records it must maintain for the DGCA). DroneSetu stores and transmits those documents on the RPTO’s behalf as a processor, and on your behalf as the person they belong to.

2. Information we collect

• Account & profile: your name, email address, mobile number, profile photo/avatar, and — if you choose to provide them — your remote-pilot certification details (regulator, licence number, expiry and registration status).
• Fleet & logbook data: the drone and battery records you add, and the flight, maintenance and battery logbook entries you create.
• Flight-log analysis: when you upload a flight log it is parsed in your browser to produce analysis and logbook entries. The raw log file (.bin / .ulg / .csv) stays on your own device in a folder you choose — it is not uploaded to our servers. Only the derived summary (date, duration, the location you enter, altitude, detected issues) is saved to your account.
• Identity & KYC documents (training portal): if you apply to an RPTO for pilot training, you may upload identity and eligibility documents — such as an Aadhaar or other government ID, a medical certificate, a class-10 marksheet and an ID proof — together with the details on them. These are provided so the RPTO can admit you and maintain the training records the DGCA requires. See section 5 for how we protect and retain them.
• Training records: your applications, enrolments, attendance, test results, fee records and certification / RPC details created during your training.
• Approximate location: to show operational and usage metrics to our administrators, we record an approximate, city-level location derived from your IP address while you use the app. We do not store the IP address itself for this purpose or any precise GPS position of yours.
• Security & usage: last-seen time, consent records, and — for actions on sensitive documents — an access/audit log recording who viewed or changed a document and when, including the IP address and browser for those specific security events.

3. How we use your information

• To provide the service — store your fleet, generate DGCA-format logbooks, analyse your flights, and run the training portal (admissions, batches, tests, certificates).
• To share your identity documents with the specific RPTO you apply to, so it can verify eligibility and admit you.
• To operate, secure and improve DroneSetu, keep an audit trail of access to sensitive documents, and understand aggregate usage.
• To communicate with you about your account (for example, email verification, password resets, and notices about your data such as an upcoming deletion of documents).

We do not sell your personal data and we do not use it for third-party advertising.

4. Consent and legal basis

We process your data to provide the service you sign up for. Where the DPDP Act requires consent, we collect it at the point of collection — for example, you must give specific, informed consent before uploading identity documents, and we keep a dated, versioned record of that consent. You may withdraw your consent at any time; withdrawing consent for a particular purpose may mean we or the RPTO can no longer provide the related service (for example, we cannot progress an admission without the required documents). Withdrawing consent does not affect processing already carried out.

5. Identity documents — special protection

• Encrypted at rest: uploaded documents are encrypted with AES-256-GCM before they are stored, using a key held outside the database. A copy of the database on its own does not reveal your documents.
• Encrypted in transit: all traffic uses HTTPS/TLS.
• Access-limited & logged: only staff of the RPTO you applied to (in the roles that need it) can view your documents, and each view is recorded in an audit log.
• Deleted when no longer needed: your uploaded ID documents are deleted from DroneSetu when your Remote Pilot Certificate (RPC) is issued, when your admission is cancelled, or automatically about two months after upload if you never proceed with an admission. Before an automatic deletion we notify the handling RPTO so it can keep the copy it needs for its DGCA records. A minimal verification record (that a document of a given type was checked) is retained as proof the check was done.

Aadhaar: where an Aadhaar is used for identity, we ask you to upload a masked Aadhaar (with the first 8 digits hidden, showing only the last 4). We do not use your Aadhaar number to authenticate you and do not share it beyond the RPTO you apply to.

6. Sharing & service providers

We use trusted providers to run DroneSetu — Supabase (database, authentication & encrypted file storage, hosted in India), Vercel (application hosting), Resend (transactional email), and mapping providers such as Cesium ion and OpenStreetMap (to render maps). They process data on our behalf under their own safeguards. We also share your identity documents and training data with the RPTO you apply to, as described above. We may disclose data where required by law.

7. Where your data is stored & security

Your account data is stored in a managed PostgreSQL database hosted in India (Mumbai region), protected by row-level security so each person can access only their own records. Data is encrypted in transit (HTTPS) and, for identity documents, encrypted at rest. Two-factor authentication (TOTP) is available on your account. Raw flight-log files remain on your device. No method of storage is completely secure, but we take reasonable technical and organisational measures to protect your data, and we maintain a process to assess and, where required, report a personal-data breach.

8. Data retention

• Account & logbook data: kept while your account is active; deleted when you delete your account, except where the law requires retention.
• Identity documents: deleted on RPC issuance, admission cancellation, or ~2 months after upload if you do not proceed (see section 5).
• Training records & verification records: retained for five years to meet DGCA and RPTO record-keeping obligations.

9. Your rights

Subject to the DPDP Act, you may:

• Access & portability: download a copy of the data we hold about you from Account → Security → Download my data.
• Correction: edit most details yourself in Account Settings, or ask us to correct or complete your data.
• Erasure: delete your account and associated personal data from Account → Security.
• Withdraw consent for a specific purpose (see section 4).
• Grievance redressal: raise a complaint with our Grievance Officer (below) and, if unsatisfied, with the Data Protection Board of India.
• Nominate another individual to exercise your rights in the event of death or incapacity — contact us to do so.

10. Children

The training portal is intended for adult trainees, and the wider service is intended for certified or registered remote pilots. We do not knowingly process the personal data of a child (under 18) without verifiable parental consent as required by the DPDP Act.

11. Changes to this policy

We may update this policy from time to time. We will revise the “last updated” date above and, for material changes, notify you in the app.

12. Contact & Grievance Officer

For any question about this policy or to exercise your rights, contact us at yogesh@surveyx.in.

Grievance Officer (as required under the DPDP Act):
Name: Yogesh Bhosale
Email: yogesh@surveyx.in
Address: Flat 201, Shivsai Complex, S. No. 68A/2, Hadapsar Road, Manjri, Pune, Maharashtra 412307

SurveyX Technologies Private Limited — DroneSetu · GSTIN 27ABRCS5448P1Z8