This Privacy Policy explains how Silvra Gold Silver Digital Pvt Ltd (CIN: U47733TS2025PTC207772) (“Silvra”, “we”, “us”, “our”) collects, uses, shares, stores and deletes your personal data when you use our website www.silvras.com and the Silvra mobile apps on iOS and Android (together, the “Platform”).

This Policy is published under the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 and its Rules. Under the DPDP Act, Silvra is the Data Fiduciary and you are the Data Principal.

The Platform is for users in India who are 18 years or older. By creating an account you confirm that you have read this Policy.

2.1 Account information (you provide)

• Name, mobile number (verified by OTP) and email address
• Date of birth and address (needed for KYC and physical delivery)
• Nominee details, if you choose to add a nominee

2.2 KYC / identity verification (you provide)

• PAN (required by law for gold/silver purchases above prescribed limits and for tax reporting)
• Aadhaar — only if you choose to use it for verification, and only in masked/offline form as permitted by law
• Selfie / live photo to confirm you are a real person matching your ID (liveness check). This is used only for verification and is not used for any other purpose.

2.3 Financial & transaction information

• Bank account number, IFSC and UPI ID — to pay out sell proceeds to you
• Transaction history: buy, sell, SIP and delivery orders (date, amount, quantity, status)
• Holdings of digital gold and silver
• Card details are never stored by Silvra. Card, UPI and net-banking payments are processed directly by our RBI-authorised payment gateway.

2.4 Device & usage information (collected automatically)

• Device model, operating system and version, app version
• IP address and approximate location derived from IP (used for fraud prevention — we do not collect precise GPS location)
• App/website usage events, session logs and crash reports
• We do not collect your IMEI, MAC address, contacts, photos gallery, SMS inbox or call logs, and we do not use the Advertising ID (IDFA/GAID) to track you.

2.5 Communications

• Emails, support tickets and in-app chats you send us
• Delivery logs of OTPs, transactional SMS, emails and push notifications

The mobile app asks for these permissions only when you use the related feature. You can turn them off in your phone settings at any time.

• Provide the service — create your account, process buy/sell/SIP orders, show your holdings, arrange physical delivery and pay out sell proceeds
• Verify your identity — KYC and anti-money-laundering (AML) checks required by law
• Keep you safe — detect fraud, suspicious logins and misuse
• Communicate — OTPs, order confirmations, invoices, statements and security alerts
• Meet legal obligations — tax (Income Tax Act, GST) records and lawful requests from authorities
• Improve the Platform — fix bugs and understand which features are used
• Marketing — offers and updates only if you opt in. You can opt out any time via the unsubscribe link or app settings.

• Your consent — given when you sign up, complete KYC or opt in to marketing. You can withdraw it at any time (this will not affect processing already done).
• Legitimate uses permitted by law — where processing is needed to provide a service you asked for, or to comply with a law, court order or government request (DPDP Act, Section 7).

If you withdraw consent for data that is essential to the service (for example, KYC), we may not be able to continue providing the service to you.

We share only the minimum data each partner needs, under written agreements that require them to protect it to the same standard as this Policy.

Government and legal disclosures

We disclose data to authorities such as the Income Tax Department, FIU-IND, law-enforcement agencies or courts only when required by law or a valid legal order.

Business transfers

If Silvra is merged or acquired, your data may move to the new entity, which must follow this Policy. We will notify you before this happens.

Payment data is stored in India by our payment gateway, as required by RBI rules. Other account data is stored with our cloud service providers, whose servers may be located in India or other countries. Wherever it is stored, it is encrypted and protected by contract, and we transfer data outside India only to countries not restricted by the Government of India under the DPDP Act.

• While your account is active — we keep your data to provide the service.
• KYC and transaction records — kept for 5 years after your account is closed (or longer if a law, investigation or dispute requires), as required by the Prevention of Money Laundering Act, 2002.
• Tax records (invoices, GST, TDS) — kept for the period required under the Income Tax Act and GST Act.
• Everything else (profile, preferences, device data, marketing consent) — deleted within 30 days of account deletion.

• All data is sent over HTTPS (TLS 1.2+)
• Data is encrypted at rest by our database and storage providers
• Sensitive fields (PAN, bank account) are masked in the app and accessible only to authorised staff
• Staff access is limited by role and protected with multi-factor authentication
• We review security regularly and fix issues promptly

No system is 100% secure, but we follow reasonable security practices as required by the SPDI Rules, 2011 and the DPDP Act, 2023.

Under the DPDP Act, 2023 you have the right to:

• Access — get a summary of the personal data we hold and who we shared it with
• Correction — fix inaccurate or incomplete data
• Erasure — ask us to delete your data (subject to the legal retention in Section 8)
• Withdraw consent — as easily as you gave it
• Grievance redressal — complain to our Grievance Officer (Section 17)
• Nominate — appoint someone to exercise these rights if you die or are incapacitated

To use any of these rights, email privacy@silvras.com. We will reply within 30 days.

Website

• Essential cookies — keep you logged in and secure. These cannot be turned off.
• Analytics — Google Analytics, Vercel Analytics and Hotjar help us understand how pages are used. You can block these in your browser settings.

Mobile app

The app uses analytics and crash-reporting tools to fix bugs and improve performance. They do not receive your KYC or financial data, and they are not used for cross-app advertising tracking.

The Platform is only for people aged 18 or above. We do not knowingly collect data from anyone under 18. If we find that we have, we will delete it. Parents can contact us at privacy@silvras.com.

If a personal data breach happens, we will act immediately to contain it, inform the Data Protection Board of India and CERT-In within the legally required time, and notify affected users by email, SMS or in-app message with what happened and what you should do.

The Platform may link to other websites (for example, partner or government sites). Their privacy practices are governed by their own policies, not this one.

We may update this Policy from time to time. The “Last updated” date at the top will always show the latest version. For important changes, we will notify you by email or in-app notice at least 30 days before they take effect.

As required by the IT Act, 2000, the Consumer Protection (E-Commerce) Rules, 2020 and the DPDP Act, 2023:

We acknowledge complaints within 48 hours and resolve them within 30 days. If you are not satisfied, you may approach the Data Protection Board of India. Disputes are subject to the courts at Hyderabad, Telangana.