Privacy Policy

The government office, municipality or utility that uses Zxseva (the client) decides why and how citizen grievance data is processed. We process that data only on the client’s documented instructions, as a data processor under the Digital Personal Data Protection Act, 2023.

For enquiries and sign ups made on this website, we decide how the data is used and act as the data fiduciary.

When a citizen files a grievance through WhatsApp, the helpline, the citizen app, the web portal or a walk-in counter, the client office may collect:

• name, mobile number and, where given, email address;
• the grievance text, voice notes, photos and documents;
• the location of the problem and the ward it falls in;
• status updates, ratings and reasons for reopening.

Personal details are visible only to officers handling the case. They are never sold, never used for advertising and never shown on the Public Dashboard, which displays aggregated figures only.

The AI Sorter reads the grievance content to suggest a department, ward, type and urgency. It does not use the citizen’s name or mobile number to make these suggestions. Officers can correct every suggestion, and every correction is logged. Grievance data from one client is not used to train models for another client without written consent.

When you use the Help Window or sign up, we collect your name, official email, designation, organization, city or district and the details you choose to share. We use them to reply, to create your account and to send login details, and for nothing else.

A short-lived session cookie is used for the security check on our forms. We do not use advertising or cross-site tracking cookies.

Grievance data is stored in India, in the hosting environment agreed with each client: a government-empanelled cloud region, a State Data Centre or the client’s own servers.

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
• Role-based access by department, ward and designation.
• Audit logs of every view, reassignment, escalation and closure.
• Daily encrypted backups kept in the same country.

We share data only with sub-processors needed to run the service, such as the hosting provider, the WhatsApp Business Platform provider, SMS gateways and our email delivery service, each bound by confidentiality and data protection terms. We disclose data to authorities only when required by law, and we tell the client unless the law prohibits it.

Grievance records are kept for the period set by the client’s record retention rules. When a contract ends, the client receives a full export and the data is deleted from our systems within 30 days, with a deletion certificate. Website enquiries are kept for up to two years unless you ask us to delete them sooner.

Citizens can ask the client office that received their grievance to access, correct or erase their personal data, or to withdraw consent, as provided under applicable law. We help clients respond to such requests.

Officials who used this website can make the same requests to us through the Help Window.

If we make a material change to how personal data is handled, we will notify clients in advance and publish the revised policy on this page.