Privacy Policy

1. Introduction

Dwaar AI is a technology platform built by Entriva Technologies Pvt. Ltd. ("Dwaar AI", "we", "us", "our") for gate management, community operations, valet parking and workforce attendance. Our products include the AI Gate Management hardware and software, the Basera resident app (including society maintenance payments), the Nazar guard app, the RWA Admin Portal, Dwaar AI Valet (its guest web tracking page, WhatsApp interface, valet staff app and hotel admin portal), the Dwaar Employee Attendance platform, and this website and the forms on it.

This policy explains what personal data we collect, why we collect it, how it is stored and protected, and what choices you have. It applies to everyone who interacts with a Dwaar AI product, including residents, visitors, staff, guards and community administrators at gated communities; hotels, restaurants, hospitals, airports and banquet businesses that use Dwaar AI Valet, and their guests and valet staff; employer customers and their employees on the Attendance platform; and visitors to our website who submit a form.

By using any Dwaar AI product, whether as a registered resident, a hotel guest handing over a vehicle, an employee clocking in for a shift, or a visitor whose vehicle or face is scanned at a gate we operate, you agree to the practices described in this policy. If you do not agree, please do not use our platform and let the relevant administrator, employer or business know.

2. Our Role: Data Fiduciary vs Data Processor

India's Digital Personal Data Protection Act, 2023 ("DPDP Act") distinguishes between a Data Fiduciary, the entity that decides why and how personal data is processed, and a Data Processor, an entity that processes data on a Data Fiduciary's behalf and instructions. Our role depends on whose data it is and who decides how it is used.

Where we act as a Data Processor

For resident and visitor data we process on behalf of a Resident Welfare Association or community, for guest and vehicle data we process on behalf of a hotel, restaurant, hospital, airport or banquet business using Dwaar AI Valet, and for employee data we process on behalf of an employer using the Dwaar Employee Attendance platform, that customer is the Data Fiduciary and Dwaar AI acts only as its Data Processor. We process this data only on that customer's documented instructions and under our contract with them.

Where we act as a Data Fiduciary

For data we collect for our own purposes, such as website form submissions, demo bookings, sales enquiries, marketing communications, and account holders of our own services, Dwaar AI is the Data Fiduciary.

Directing your rights request

If you want to exercise a data protection right over data controlled by a customer, for example as a resident, a hotel guest, or an employee, please direct your request to that customer first, your RWA, the hotel or business, or your employer, since they control how and why your data is used. We will support that customer in responding to your request as their Data Processor.

3. Information We Collect

We collect different information depending on how you interact with Dwaar AI.

From residents and account holders

• Name, phone number, email address and unit or flat number
• Vehicle registration number and FASTag identifier linked to your vehicle
• Photographs you choose to upload for identification within the resident app
• Visitor, staff and domestic help entries you approve or register
• Society maintenance payment details processed through the Basera app, as described under Payments below

From visitors, staff and delivery personnel

• Name and phone number provided at the gate or through a resident's approval
• Vehicle number, if arriving by vehicle
• A photograph captured by the gate camera at the time of entry, for verification and the visitor log

From guards and site staff

• Name, phone number and shift records logged through the Nazar guard app
• Attendance and shift handover data, including timestamped entries

Device and usage information

• IP address, device type and browser information when you visit our website or use our apps
• Log data such as pages visited, features used and app crash reports, used to improve the platform

From demo and enquiry form submitters

When you fill a form on our website, such as a demo booking or a sales enquiry, we may collect your name, mobile number, email address (optional), organisation, society or property name, city, role, property size or unit count, product interest, demo preference, campaign parameters (such as UTM tags) that show how you reached our website, and any consent choices you make on that form.

From Dwaar AI Valet guests

When you use Dwaar AI Valet as a guest at a hotel, restaurant, hospital, airport or banquet business, we collect your name, mobile number, vehicle registration number, photographs of your vehicle's condition (front, right, back and left) taken at drop-off and pickup, OTP and handover records, pickup requests you raise, WhatsApp messages exchanged with our system, feedback you submit, and timestamps for each step of the handover.

From Dwaar AI Valet staff and hotel admins

For valet staff and hotel administrators using the Dwaar AI Valet staff app and hotel admin portal, we collect name, phone number, shift records, and a facial verification captured at shift login, as described further in Section 4.

From the Dwaar Employee Attendance platform

For employees on the Dwaar Employee Attendance platform, we collect employee name, employee ID, attendance and shift records, and, where the employer enables it, facial verification data captured at clock in and clock out, as described further in Section 4.

Payments

Society maintenance payments made through Basera and ad-credit top-ups on Dwaar AI Valet are processed by a third-party payment gateway, [TO CONFIRM: payment gateway name]. We do not store your full card number, CVV, UPI PIN or net-banking credentials, these are handled directly by the payment gateway.

4. Facial Recognition Data

What we collect

When a person approaches a Dwaar AI enabled gate, or logs in for a shift on Nazar, the Dwaar AI Valet staff app, or the Attendance platform, a camera captures a facial image. For registered residents, staff, guards, valet staff and employees, this image may be converted into a mathematical facial template, a numeric representation used only to check whether a face matches a previously enrolled, authorised profile. The system does not attempt to determine a person's identity from the open internet or any external database; it only compares against faces enrolled by the relevant administrator, business or employer.

Why we use it

At the gate, facial recognition exists to verify people entering on foot, such as residents, domestic staff, delivery personnel and guards during shift changes, who are not covered by vehicle based checks like FASTag or ANPR. It is a backup and convenience layer, not the only way to gain entry. On Nazar, the Dwaar AI Valet staff app and the Attendance platform, it is used to confirm that the person logging in for a shift or clocking in is who they say they are.

Enrollment is opt in for residents

Residents are not required to enroll a facial profile to use Dwaar AI. Vehicle entry works through FASTag or ANPR regardless of facial enrollment, and any resident, visitor or staff member can always be verified manually by the guard on duty.

Workplace consent for staff, guards, valet staff and employees

Where facial enrollment is used for guards, valet staff or employees for shift login, attendance or clock-in purposes, the employer, hotel or other business, or the community's management committee, as applicable, is responsible for obtaining the necessary workplace consent before enrollment.

How facial data is stored and protected

• Facial templates are stored in encrypted form, separately from a person's name, phone number or address
• Facial data is used only for entry verification, shift login and attendance logging within the relevant customer's own Dwaar AI account, and is not pooled, compared or shared across other communities, businesses or customers
• We do not sell, rent or use facial recognition data for advertising, profiling or any purpose outside gate entry, shift login and attendance
• Access to facial data is restricted to systems and authorised personnel that need it to operate the gate, resolve entry disputes, or verify shift logins

Your choices

You can ask the relevant administrator, business or employer to remove your enrolled facial profile at any time, after which entry or shift login continues to work through FASTag, ANPR or manual verification where available. Visitors and non-enrolled individuals whose photograph is captured for the visitor log can request that record's deletion, subject to the retention rules in Section 12.

5. How We Collect Information

We collect information in the following ways.

• Directly from you, when you register on the Basera app, use Dwaar AI Valet as a guest or staff member, use the Attendance platform, fill a form on our website, book a demo, or contact our sales or support team.
• From your community's administrator, your hotel or business, or your employer, when they add you as a resident, register your vehicle, enroll staff and guards, or set you up as an employee on the Attendance platform.
• Automatically through our hardware, when the FASTag reader, ANPR camera or facial recognition camera at your gate, or a shift login camera, captures data as part of an entry or attendance event.
• Automatically through our website and apps, using cookies, log files and analytics tools, as described in Section 14.

6. Purposes and Legal Basis

Under the DPDP Act, we process personal data either with your consent, or where a legitimate use permitted under Section 7 of the Act applies, for example, where you voluntarily provide your data to us for a specified purpose, such as booking a demo or making an enquiry, and have not indicated that you do not consent to its use. The list below sets out our purposes and the basis we rely on for each.

• Verifying vehicles and people at the gate through FASTag, ANPR and facial recognition, and maintaining an accurate entry and exit log. Legal basis: legitimate use, as part of operating the security service your community has engaged us for.
• Operating the Basera resident app, Nazar guard app and RWA Admin Portal, including visitor approvals, maintenance payments, attendance and shift handovers. Legal basis: legitimate use, under our contract with your community.
• Operating Dwaar AI Valet vehicle handover, guest notifications and feedback. Legal basis: legitimate use, under our contract with the hotel or business, and to provide the handover service a guest has requested.
• Operating the Dwaar Employee Attendance platform. Legal basis: legitimate use, under our contract with the employer.
• Responding to support requests, demo bookings and sales enquiries. Legal basis: legitimate use, since you voluntarily provide this data to us for that specified purpose.
• Sending marketing communications. Legal basis: consent, as described in Section 8.
• Detecting and preventing fraud, tailgating, unauthorised entry and other security incidents. Legal basis: legitimate use.
• Improving the reliability, accuracy and usability of our hardware and software. Legal basis: legitimate use.
• Meeting legal, regulatory and audit obligations that apply to us or to our customers. Legal basis: legal obligation.

We do not use resident, visitor, guest, staff, guard or employee data for advertising, and we do not sell personal data to third parties.

7. Advertising on Dwaar AI Valet

Advertisements, which may come from the host business (the hotel, restaurant, hospital, airport or banquet business) or from third-party advertisers, may be shown to guests on the Dwaar AI Valet guest tracking page after their vehicle has been delivered.

• We do not share a guest's personal data with advertisers.
• Ads are not targeted using a guest's personal data. [TO CONFIRM: ads shown are non-personalised / contextual only]
• Advertisers receive only aggregated, non-identifying performance figures, such as impressions and clicks, not any individual guest's data.

As stated elsewhere in this policy, we do not sell personal data.

8. Marketing Communications

If you tick the marketing consent box on any Dwaar AI form, including the Dwaar AI and Dwaar AI Valet demo booking forms, we may send you product updates, feature announcements and offers by email, WhatsApp and SMS. This consent is optional and is never a condition for booking a demo or using our products.

You can withdraw this consent at any time by replying STOP to any WhatsApp or SMS message, clicking unsubscribe in any email, or writing to hello@dwaarai.com. Withdrawing consent does not affect messages about a demo you have booked or a service you use, and does not affect processing that took place before withdrawal.

Transactional messages, such as OTPs, vehicle-ready alerts and demo confirmations, are not marketing. We send these as part of delivering our service, and they are not affected by withdrawing marketing consent.

9. Sharing and Disclosure

We share information only in the following circumstances.

• With your community's management committee, your hotel or business, or your employer, who need visitor logs, guest handover records, attendance records and entry data to run their operations and resolve day to day issues.
• With service providers who process data on our behalf, under contracts that require them to protect your data and use it only for the purpose we specify. These include:
  • Cloud hosting [TO CONFIRM: hosting provider name]
  • CRM and web forms: Zoho
  • WhatsApp Business messaging, delivered through Meta and our Business Solution Provider, Authkey, with Karix Mobile as the underlying provider
  • SMS provider [TO CONFIRM: SMS provider name]
  • Payment gateway [TO CONFIRM: payment gateway name]
  • Analytics and tag management: Google Tag Manager [TO CONFIRM: exact list of analytics or advertising tags configured inside our Google Tag Manager container]
  • Certified gate hardware partners, who receive no personal data beyond what their published APIs require to operate the gate [TO CONFIRM]
• With law enforcement or regulators, if legally required to do so, or to investigate a security incident, fraud, or a threat to safety.
• As part of a business transaction, such as a merger, acquisition or asset sale, in which case we will ensure the acquiring party is bound by protections consistent with this policy.

We do not share facial recognition data, FASTag identifiers or vehicle numbers with advertisers, data brokers, or any party outside the operation of your community's, hotel's or employer's Dwaar AI account.

10. Cross-Border Data Transfers

Some of our service providers may store or process personal data outside India. Where this happens, we ensure such transfers comply with Section 16 of the DPDP Act and any country-specific restrictions notified by the Government of India from time to time.

[TO CONFIRM: which of our service providers store or process data outside India, and in which countries]

11. Data Security

We apply reasonable security safeguards to protect your information, including encryption of data in transit and at rest, role based access controls so that staff only see the data needed for their role, and regular review of our systems for vulnerabilities. Facial recognition templates receive additional protection as described in Section 4.

No system is completely immune to risk. In the event of a personal data breach, we will notify the Data Protection Board of India and affected individuals as required by the DPDP Act and applicable rules. Where we act as a Data Processor for a customer, we will notify that customer promptly so they can meet their own obligations as the Data Fiduciary.

12. Retention and Deletion

• Website form and lead data is retained for [TO CONFIRM: retention period for demo and enquiry form data].
• Dwaar AI Valet vehicle history and photographs are retained for 70 days on the Basic plan and 100 days on the Enterprise plan, unless the host business configures a different period. [TO CONFIRM: these periods match the live product]
• Visitor entry and exit logs, including gate camera photographs, are retained for [TO CONFIRM: retention period], after which they are automatically deleted unless your community's administrator has configured a different retention period.
• Attendance records on the Dwaar Employee Attendance platform are retained for [TO CONFIRM: retention period].
• Facial recognition templates are deleted when a resident, staff member, guard, valet staff member or employee is removed from the relevant account, or on request as described in Section 4.
• Payment records are retained for [TO CONFIRM: retention period required by applicable tax and accounting law].

Resident, staff, guard and employee account data is retained for as long as the relevant account is active, and for a reasonable period afterward to meet legal, financial or dispute resolution requirements. In general, we delete or anonymise personal data once the purpose it was collected for has been served, unless the law requires us to keep it for longer.

You can request earlier deletion of your data by contacting your community's administrator, your hotel or business, your employer, or writing to us directly using the details in Section 19, subject to any legal obligation we may have to retain certain records.

13. Your Rights and Choices

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal data we hold about you and how it is being processed
• Correction, completion and updating of your personal data
• Erasure of your personal data, subject to legal retention requirements
• Withdraw consent at any time, as easily as you gave it, including consent for facial recognition enrollment or marketing communications, without affecting your ability to enter through FASTag, ANPR or manual guard verification, or to use our products
• Grievance redressal, by raising a concern with us as described in Section 19
• Nominate another person to exercise these rights on your behalf in the event of your death or incapacity
• Complain to the Data Protection Board of India if a grievance you raise with us is not resolved to your satisfaction

To exercise any of these rights, contact your community's administrator, your hotel or business, your employer, or reach our team directly using the details in Section 19. We aim to respond within [TO CONFIRM: response timeline, e.g. within X days].

14. Cookies

Our website uses the following categories of cookies and similar technologies.

• Strictly necessary. Used to operate core website functionality, such as remembering your session and securing form submissions. These cannot be disabled without affecting the website.
• Tag management. We use Google Tag Manager (container ID GTM-N5PJKJ2R) on every page to manage the scripts that run on our website. [TO CONFIRM: the exact list of analytics, advertising or other tags configured to fire through this container, such as Google Analytics or Google Ads conversion tracking, so this section can name them individually]
• Third-party forms. Some pages embed a Zoho Forms form directly, for example our gate automation cost calculator and the Dwaar AI Valet demo booking page. Zoho may set its own cookies within that embedded form to make it function correctly.

We do not currently use advertising or remarketing pixels on this website. If that changes, we will update this section to say so plainly and name the specific tool.

You can control or disable cookies through your browser settings. Disabling cookies may affect some website functionality, such as embedded forms, but will not affect the operation of gate hardware, the Basera and Nazar apps, Dwaar AI Valet, or the Attendance platform.

15. Children's Privacy

Dwaar AI is intended for use by adults managing, residing in, working at, or operating a business on our platform. Where a gate camera captures the image of a minor accompanying a resident or visitor, that image is treated with the same protections as any other visitor entry record and is not used for any purpose beyond gate security and the visitor log.

Our services are not directed at children under 18. We do not knowingly collect personal data from children through our website or forms. Where a customer's use of our platform involves a child's data, for example a minor's image captured at a gate or in a Dwaar AI Valet handover, obtaining verifiable parental consent is that customer's responsibility as the Data Fiduciary. We do not track, behaviourally monitor, or target advertising at children.

16. Language

This policy is available in Hindi and Kannada on request. [TO CONFIRM] To request a translated copy, write to hello@dwaarai.com.

17. Governing Law

This policy is governed by the laws of India. Courts at Bengaluru, Karnataka have exclusive jurisdiction over any dispute arising from it. [TO CONFIRM with lawyer]

18. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, our products, or applicable law. We will update the "Last updated" date at the top of this page whenever we make a material change, and where required by law, we will notify affected customers, your community's administrator, or residents directly.

19. Contact and Grievance Officer

If you have questions about this policy, want to exercise a data right, or need to raise a grievance about how your personal or facial recognition data has been handled, please reach out to us.

For general enquiries, write to hello@dwaarai.com. We aim to acknowledge privacy related requests within a reasonable timeframe and resolve them as quickly as the request allows, and no later than [TO CONFIRM: response timeline, e.g. within X days] as referenced in Section 13.