Privacy Policy

We collect information you provide directly, information generated through your use of the registry, and limited technical data needed to operate the platform securely.

• Business and person profile data — names, addresses, contact details, hours, services, taxonomy classifications, and other listing fields you submit.
• Ownership and verification data — identity documents such as Aadhaar or PAN (stored in encrypted form), attestations, and correspondence submitted when you register or claim a listing.
• Account and authentication data — sign-in credentials, Google OAuth identifiers, staff PINs, and profile settings.
• Waiting list details — email, optional mobile number, and whether you expressed interest as a business or a person.
• Commerce and customer records — guest checkout phone numbers, optional email or address, and order metadata when storefront or POS features are enabled.
• Communications — messages you send to us for support, grievances, or compliance requests.
• Usage and technical data — IP address, browser type, device information, pages viewed, and diagnostic logs collected through our infrastructure providers.
• Analytics data — if you consent to cookies, aggregated page and event data via Google Analytics.

We use collected information to operate, maintain, and improve the registry and related services. Specific uses include:

• Creating, verifying, and publishing canonical business and person records.
• Managing early-access waiting lists and inviting you when capacity opens.
• Processing ownership claims and resolving listing disputes.
• Operating storefront, menu, order, staff, and POS features for businesses that enable them.
• Sending one-time passwords and transactional messages through WhatsApp/SMS providers where configured.
• Processing donations and future subscription payments through payment partners.
• Distributing approved registry data to connected ecosystem applications through our API.
• Providing customer support and responding to legal or regulatory requests.
• Monitoring platform security, preventing abuse, and enforcing our Terms and Conditions.
• Analyzing aggregated, de-identified usage to improve reliability and product quality.

Under the DPDP Act and other applicable law, we process personal data based on your consent (for example analytics cookies or optional marketing), to perform our contract with you, to comply with legal obligations, and for legitimate uses necessary to operate a trustworthy registry.

You may withdraw consent for non-essential processing where consent is the basis. Withdrawal does not affect processing already performed lawfully before withdrawal.

Registry data intended for public or partner distribution may be shared with connected applications in the directory ecosystem that integrate with Ariiyo through authorized APIs. We do not sell personal information.

We share information with service providers that help us host, secure, and operate the platform, including Cloudflare (infrastructure), Google (analytics, when consented, and sign-in), Razorpay (payments), and messaging providers for OTP or notifications. We may also share information with professional advisers and authorities when required by law or to protect rights, safety, and integrity of the registry.

Some processors, including Cloudflare and Google, may process or store information on servers located outside India. Where required, we implement appropriate contractual and technical safeguards for cross-border transfers under the DPDP Act.

We retain registry and account information for as long as needed to provide the service, maintain accurate historical records, resolve disputes, and meet legal obligations. When data is no longer required, we delete or anonymize it in accordance with our retention practices.

We implement administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, or misuse, including encryption for sensitive identity documents. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Subject to the DPDP Act and other applicable law, you may have the right to access, correct, complete, update, erase, and port personal data, and to nominate another person to exercise your rights in the event of death or incapacity. You may also have the right to grievance redressal and to approach the Data Protection Board where applicable.

To exercise privacy rights, email us at the address below. We may need to verify your identity before fulfilling a request. Erasure requests are handled as soon as reasonably practicable; some registry records may be retained where law or legitimate archival needs require.

We use essential cookies and local storage for security and preferences. Analytics cookies are loaded only after you consent via our cookie banner. See our Cookie Policy for details.

Ariiyo is a business registry service and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal data, contact us so we can delete it.

For privacy-related grievances, contact privacy@ariiyo.com or our Grievance Officer at grievance@ariiyo.com. See our Grievance Redressal page for timelines and escalation options.

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page and revise the effective date above.

Privacy questions and Data Principal requests: privacy@ariiyo.com.