Privacy Policy

Last updated: [date]

Draft written for the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025. Have it reviewed by a lawyer before public launch, and fill in the highlighted parts.

1. Who is responsible

HUB-VR.COM (legal name [legal name as on GST certificate]), [address], which owns and runs SahiBid, is the Data Fiduciary for personal data processed by SahiBid.

2. Your data stays in your Google Drive

SahiBid is built so that your business data is kept in your own Google Drive, in a folder called SahiBid that you own and control:

your company documents;
the details read from them (document type, registration numbers such as PAN and GSTIN, amounts, issue and expiry dates);
renewal status, reminder history and alert settings (email, WhatsApp number);
tenders and bid files, when those features are released.

SahiBid reads and processes this data only while doing a task you asked for (reading a new document, showing a page, the daily expiry check) and does not keep a copy. You can open, download, change or delete everything in your Drive at any time.

3. What our servers keep

Login accounts of you and your staff: name, work email, role, password (stored only as a secure hash), and the encrypted key for 2-step login.
An encrypted Google Drive connection key, so the daily expiry check and reminders can run while you are not logged in. You can withdraw it at any time: Settings › Disconnect, or in your Google Account under Security › Third-party access.
A security log: login times, IP addresses, failed attempts and account changes. It holds no documents or document details.

SahiBid uses Google's limited "drive.file" permission: it can open only files added through it or chosen by you, never the rest of your Drive. You sign in to Google on Google's own page; we never see your Google password.

4. Who we share data with

Only service providers who help us run the service, under contract: hosting in India ([provider, region]), Google (Drive and sign-in), email delivery ([provider]), WhatsApp Business messaging (Meta), and, if switched on, an AI service that reads document text to find dates and numbers ([provider]). We share data with authorities only when Indian law requires it.

5. How long we keep it

Login accounts and the Drive connection key: while your company account is active. When the owner deletes the account, they are deleted at once.
Security log: 1 year, then deleted.
Everything in your Google Drive stays under your control; we never delete it.

6. Security

Your business data never rests on our servers. Passwords are stored only as secure hashes. Every login needs a password and a 2-step code from an authenticator app. Google access keys are encrypted. All traffic uses HTTPS. Each company can see only its own data. Accounts lock after repeated wrong attempts. If a personal data breach happens, we will inform affected users and the Data Protection Board of India as the law requires.

7. Your rights

You may ask to see, correct or erase your personal data, withdraw consent, or name someone to act for you. Most of this you can do yourself in Settings. For anything else, write to the Grievance Officer below. We respond within the time the DPDP Rules set, and you may complain to the Data Protection Board of India if you are not satisfied.

8. Grievance Officer

[Name], [email], [phone], [address].

9. Changes

We will tell account owners by email before any important change to this policy.