PRIVACY & DATA PROTECTION PORTAL Last Updated: October 17, 2026 • Effective Immediately

Master Privacy Policy & Product Disclosures

This Master Privacy Policy governs how BitMicron Tech Labs (“BitMicron”, “we”, “us”, or “our”) collects, processes, stores, and protects information across our corporate website, enterprise engineering services, and our proprietary software applications: BolSaathi, Guftagu, FinRadar, VanLedger, ChampionSetu, GrihSetu, Song2Reel, and MediLine.

Zero Data Brokerage

We never sell, rent, or trade personal data, voice recordings, or financial SMS logs to ad networks or data brokers.

On-Device First

Apps like FinRadar run 100% offline in local SQLite storage—no financial SMS or bank balances ever leave your phone.

Tenant Isolation (RLS)

Multi-tenant SaaS platforms enforce strict PostgreSQL Row-Level Security (RLS) and role-based access control.

DPDPA & Global Ready

Aligned with India's Digital Personal Data Protection Act (DPDPA 2023), IT Act 2000, GDPR principles, and Play Store policies.

Section 01

Scope, Legal Entity & Data Fiduciary vs. Processor Roles

1.1 Legal Entity: All products and services referenced in this policy are engineered and published by BitMicron Tech Labs, operating with its headquarters in New Delhi, India.

1.2 When BitMicron Acts as Data Fiduciary / Data Controller: When you visit our website (bitmicron.com), contact us for enterprise consulting, or use our direct-to-consumer applications (such as Guftagu, FinRadar, or Song2Reel), BitMicron determines the purpose and means of processing your personal data (if any is collected).

1.3 When BitMicron Acts as Data Processor (B2B & Vertical SaaS): When a clinic, salon, coaching academy, school van operator, or residential society (each a “Business Tenant”) uses our multi-tenant platforms—including BolSaathi, ChampionSetu, VanLedger, GrihSetu, or MediLine—to manage their customers, patients, students, or residents, the Business Tenant is the primary Data Fiduciary / Data Controller, and BitMicron Tech Labs processes that data strictly on behalf of the Business Tenant in accordance with their configuration.

Section 02

Product-Specific Data Handling Disclosures

Because BitMicron engineers distinct products across Voice AI, FinTech, Mobility, EdTech, PropTech, and Generative Media, data collection is strictly scoped to the specific application you use:

1. BolSaathi (AI Voice Receptionist SaaS)

B2B Multi-Tenant

Data Processed: Inbound caller phone numbers (normalized to E.164 format), voice audio streams, Devanagari Hindi/Hinglish/English call transcripts, detected booking intents, appointment timestamps, and business operating hours.
Purpose: Automated call answering, conflict-free appointment booking, CRM lead generation, and per-minute usage metering.
Tenant Isolation: Enforced via Supabase PostgreSQL Row-Level Security (RLS) so each business tenant can only access its own calls, customers, and transcripts.

2. Guftagu (AI Voice Companion PWA)

Consumer Voice PWA

Microphone Permission: Uses browser Web Audio API (navigator.mediaDevices.getUserMedia) only during active user-initiated voice calls to perform Voice Activity Detection (VAD) and Speech-to-Text.
Local-First Memory: Conversation context, persona preference (Kavya, Simran, Kabir), and remaining free-trial timer state are stored locally in your browser's localStorage.
Discreet Billing: UPI / payment transactions are processed via regulated payment gateways and appear discreetly under BitMicron Tech Labs.

3. VanLedger (School Transport & Fee Ledger)

Offline-First + Sync

Data Processed: Vehicle registration/capacity details, enrolled student names, school/shift assignments, parent contact numbers, monthly fee payment records, and digital gate pass statuses.
WhatsApp Integration: Uses deep-links to open the driver's native WhatsApp application with pre-filled fee reminders; VanLedger does not read private WhatsApp chats.
Local Security: Protected by an automatic AppLifecycle PIN lock whenever the app is minimized or backgrounded.

4. ChampionSetu & GrihSetu (Vertical OS)

Academy & Society OS

ChampionSetu: Stores academy profiles, student enrollments, batch schedules, attendance logs, and fee payment receipts (PDF generation) across SuperAdmin, Admin, and Student roles.
GrihSetu: Stores residential flat/unit mapping, visitor gate approval logs, maintenance helpdesk tickets, and society billing ledgers.
Access Control: Role-based access ensures students/residents only view their own records and authorized notices.

5. Song2Reel (Generative Media Studio)

Creator AI App

Data Processed: User story prompts, generated song lyrics, synthesized 30-second audio tracks, 5 AI storyboard images, and local FFmpeg-composed 9:16 MP4 video files.
BYOK / API Keys: Any custom AI provider API keys configured in the Settings screen are stored locally on your device and transmitted only to the respective AI provider endpoint.

6. MediLine (Omni-Connect Healthcare)

WhatsApp Healthcare

Data Processed: WhatsApp phone numbers, appointment requests, basic symptom triage inputs, and diagnostic/prescription notifications authorized by the partnering healthcare clinic.
Data Minimization: MediLine routes messages via encrypted HTTPS webhooks and does not use patient data to train public foundation models.

✓ 100% On-Device Architecture • Zero Cloud Upload Google Play Prominent Disclosure Compliant

Section 03: FinRadar Sensitive Permissions Disclosure (`READ_SMS`)

In full compliance with Google Play Store Sensitive Permissions Policies and India's Digital Personal Data Protection Act (DPDPA 2023), this section provides our mandatory prominent disclosure for FinRadar:

How SMS Data is Handled

Permission Requested: android.permission.READ_SMS
Strictly Local Processing: FinRadar reads and parses transactional bank/UPI/biller SMS messages using deterministic regular expressions and heuristics 100% inside your smartphone's local memory and local SQLite database (finradar.db).
Personal & OTP Messages Ignored: Personal chats, family texts, and One-Time Passwords (OTPs) are immediately disregarded and never stored.

Zero Remote Infrastructure Guarantee

Zero Cloud Transmission: FinRadar does not own, lease, or connect to any remote cloud database for storing your financial records. No SMS body, sender ID, bank account mask, merchant name, or account balance is ever uploaded over the Internet.
Instant Irreversible Deletion: Clearing app storage or uninstalling FinRadar permanently destroys the local SQLite database on your device.

Section 04

Multi-Model AI Providers & Infrastructure Sub-Processors

For cloud-enabled products that utilize artificial intelligence, voice synthesis, or cloud databases (specifically BolSaathi, Guftagu, ChampionSetu, VanLedger, GrihSetu, Song2Reel, and MediLine), we route data securely over TLS 1.3 to industry-vetted sub-processors solely to fulfill the requested feature:

Sub-Processor	Role & Technical Purpose	Applicable Products
OpenAI & Google Gemini	LLM reasoning, deterministic tool-calling (appointment slot conflict checks), intent extraction, and storyboard scripting via API.	BolSaathi, Guftagu, Song2Reel, MediLine
ElevenLabs	Low-latency emotional Text-to-Speech (Flash v2.5 / Multilingual v2) and audio synthesis.	Guftagu, BolSaathi, Song2Reel
Sarvam AI	Indic Speech-to-Text (`saaras:v3`), Hinglish LLM (`sarvam-105b`), and Devanagari Text-to-Speech (`bulbul:v3`).	BolSaathi, Guftagu
Supabase (PostgreSQL)	Managed PostgreSQL database, authentication, and Row-Level Security (RLS) cloud persistence.	BolSaathi, ChampionSetu, VanLedger, GrihSetu
Meta / WhatsApp Cloud API	Conversational message delivery and webhook ingestion for app-less workflows.	MediLine, Omni-Connect

*Note: BitMicron utilizes commercial API tiers where API inputs and outputs are not used to train public third-party foundation models without explicit consent.

Section 05

Information Security, Cookies & Data Retention

5.1 Technical Safeguards: We implement defense-in-depth engineering controls including HTTPS/TLS encryption in transit, AES-256 encryption at rest on cloud databases, PostgreSQL Row-Level Security (RLS), cryptographic webhook signature verification, idempotency deduplication, and on-device biometric/PIN lock screens.

5.2 Cookies & Local Storage: Our marketing website (bitmicron.com) does not use invasive third-party advertising trackers. Our web apps (such as BolSaathi and Guftagu) use strictly necessary session cookies and browser localStorage to maintain authentication state, tenant selection, and user preferences.

5.3 Retention Schedule: On-device app data (FinRadar, VanLedger local cache, Guftagu local memory) remains on your device until you clear app data or uninstall the application. Cloud SaaS data (BolSaathi, ChampionSetu, GrihSetu) is retained for the duration of the active subscription agreement and purged or exported within 30 days of account termination upon written request.

Section 06

Your Data Principal Rights (DPDPA 2023 & Global Privacy)

Under India's Digital Personal Data Protection Act, 2023 (DPDPA) and applicable international privacy regulations (such as GDPR), you have the right to:

Right to Access & Summary: Request a summary of personal data processed by BitMicron and the identities of all sub-processors with whom data has been shared.
Right to Correction & Erasure: Request correction of inaccurate records or complete erasure of your personal data from our cloud systems (or self-delete immediately via in-app reset / uninstallation for offline apps).
Right to Withdraw Consent: Revoke device permissions (such as READ_SMS or Microphone access) at any time via your Android/iOS/Browser settings.
Right to Grievance Redressal: Register a formal privacy complaint with our designated Grievance Officer below.

Section 07

Data Protection & Grievance Officer Contact

In accordance with the Information Technology Act, 2000 (Intermediary Guidelines) and the Digital Personal Data Protection Act, 2023, any questions, data deletion requests, or privacy grievances may be directed to:

Entity: BitMicron Tech Labs

Designation: Grievance & Data Protection Officer

Headquarters: New Delhi, India

Email: hello@bitmicron.com

Resolution SLA: Acknowledged within 48 hours; resolved within 15 business days.