1. Introduction & Scope
At Bikrivo, operated by CAFEMITRA (Proprietor: Raushan Kumar, Udyam: UDYAM-BR-08-0044967) (“we”, “us”, “our”), protecting the confidentiality and integrity of your data is fundamental to our mission. This Privacy Policy outlines our practices concerning the collection, storage, processing, and disclosure of personal data when you visitbikrivo.com, access our dashboard, embed our web chatbot widget, or transact through our services.
This policy is formulated in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 (IT Act), and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
2. Categories of Information We Collect
We only collect data necessary to provide our SaaS services, process payments, and ensure platform security:
Name, business legal name, operating email address, active mobile telephone number, password hash (salted via Supabase Auth), business category, and billing address.
Appointment reservation data (customer name, contact number, preferred time slot, consultation notes), storefront delivery orders, and digital Khata ledger records initiated by end customers.
Payment gateway transaction IDs (PayU), subscription IDs, transaction timestamps, payment status, and minor unit amounts. Note: Raw credit/debit card numbers and UPI PINs are processed directly by our RBI-licensed payment aggregator (PayU Payments Private Limited) and never touch Bikrivo servers.
Service menus, clinic brochures, PDF catalogs uploaded by you to train your AI chatbot, converted into 384-dimensional vector embeddings using local transformers.
3. Purposes for Processing Your Personal Data
Bikrivo acts as a Data Fiduciary with respect to your agency account information and as a Data Processor on behalf of your business for customer appointments and store orders. We process data to:
- Provision and operate your multi-tenant workspace, AI chatbots, and subdomain websites.
- Execute deterministic appointment reservations with zero double-booking locks and synchronize with Microsoft Outlook Graph calendars.
- Process subscription billing, renewals, and refunds via our payment gateway partner PayU Payments Private Limited.
- Send transactional order receipts, booking confirmations, and Smart Khata reminders via WhatsApp and email.
- Detect, prevent, and mitigate security threats, fraudulent transactions, and unauthorized access.
- Comply with statutory obligations under Indian tax laws and cybersecurity directives from CERT-In.
4. Payment Gateway & Sub-Processors (DPDP Act Section 6 & 8 Disclosure)
In full accordance with Section 8(2) of the DPDP Act 2023, Bikrivo engages only vetted, legally compliant sub-processors under strict contractual data protection terms. We never sell, rent, or monetize your personal or business data.
Processes subscription billing, net banking, cards, and UPI under RBI Payment Aggregator licensing and PCI-DSS Level 1 compliance. Bikrivo servers never receive or store card CVVs, raw card numbers, or UPI PINs.
Powers low-latency natural language understanding (Llama 3.3) and WhatsApp voice note transcription (Whisper). Operates under a strict commercial Zero-Data Retention policy: customer chat prompts and voice waveforms are processed strictly in transit in ephemeral RAM and are NEVER stored, logged, or used to train AI models.
Encrypted cloud database hosting with strict Row Level Security (RLS) isolating each tenant's data at the database level.
Synchronizes scheduled appointments to your Outlook calendar using OAuth 2.0 scoped permissions.
Dispatches real-time, encrypted transactional push notifications (new bookings, incoming store orders) directly to the verified business owner's device.
Vector representations of merchant catalogs, price lists, and FAQs are computed 100% locally in-process using on-premise transformer models (all-MiniLM-L6-v2). Raw business documents never leave the server for vectorization.
5. Reasonable Security Practices & DPDP Safeguards
In accordance with Section 8(5) of the DPDP Act, 2023 and Section 43A of the IT Act, 2000, Bikrivo implements stringent technical and organizational measures:
- Automated PII Scrubbing: Prior to any external AI inference, our real-time privacy filter scrubs and masks sensitive national identity numbers (including 12-digit Indian Aadhaar numbers masked to
XXXX-XXXX-1234, PAN cards masked toXXXXX**34F, and 16-digit credit cards). - Medical Health Records (PHI) Purpose Limitation: Doctor prescription slips uploaded by patients are processed strictly and exclusively to facilitate the patient's appointment reservation or prescription fulfillment with that specific registered clinic. Medical documents are never shared or aggregated.
- Encryption: All data transmitted over public networks is encrypted using TLS 1.3 / HTTPS. Database storage is encrypted at rest using AES-256.
- Multi-Tenant Isolation: PostgreSQL Row Level Security (RLS) guarantees mathematical separation — one business or agency cannot query, inspect, or access another tenant's customer data or leads.
- 30-Day Erasure SLA: In compliance with Section 12(3) of the DPDP Act, customer deletion or erasure requests received at our grievance desk are permanently purged from active databases within 30 days.
6. Your Rights Under the DPDP Act, 2023
As a Data Principal under Indian law, you have the right to:
- Right to Access: Request a summary of your personal data processed by Bikrivo.
- Right to Correction & Erasure: Correct outdated data or request permanent erasure of your account.
- Right to Grievance Redressal: Register a complaint regarding data processing with our designated Grievance Officer.
- Right to Nominate: Nominate an individual to exercise your rights in the event of death or incapacity.
To exercise any of these rights, email grievance@bikrivo.com or call +91 7764056669.
7. Cookies & Local Storage Policy
Bikrivo uses strictly necessary functional cookies and browser local storage to maintain authenticated user sessions, remember dashboard preferences, and support widget interactions. We do not use intrusive third-party cross-site advertising cookies.
8. Statutory Grievance Redressal Officer (IT Rules, 2021)
Under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and DPDP Act, 2023, the designated Grievance Redressal Officer is: