Privacy Policy

This Privacy Policy explains what personal data Tinker Software ("Tinker Software", "Metro Tech", "we", "us", "our") collects, why we collect it, how we protect it and what rights you have. It is written to comply with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 of India.

1. What this policy covers

This single policy covers every product and service offered under the Metro Tech brand:

• The website at metro-tech.in and its sub domains.
• JollyBaba, the shop management application for mobile repair and resale shops, available at jollybaba.in and as an installable web app.
• JollyBaba Catalogue, the public product showcase available on the web and on Google Play.
• WhatsApp messaging services that we provide to shops, including WhatsApp Business onboarding and automated messages sent through Meta's WhatsApp Cloud API.
• Any future Metro Tech product that links to this policy.

Where a product has its own additional notice, that notice adds to this policy and does not replace it.

2. Who is responsible for your data

Under the DPDP Act, the entity that decides why and how personal data is processed is the Data Fiduciary. The entity that processes data on its behalf is a Data Processor. The person the data is about is the Data Principal.

• For the Metro Tech website, shop staff accounts and our own billing: Tinker Software is the Data Fiduciary.
• For the customer records a shop stores inside JollyBaba (names, phone numbers, device details, ledgers): the shop that entered the data is the Data Fiduciary. Tinker Software is a Data Processor acting on the shop's instructions. If you are a customer of a shop and want to know how your data is used, the shop is your first point of contact, and we will help the shop respond.
• For WhatsApp messages sent on behalf of a shop: the shop is the Data Fiduciary and Tinker Software is a Data Processor. Meta Platforms, Inc. processes the message as the WhatsApp service provider under its own terms.

3. The Metro Tech website

The website at metro-tech.in is a set of static pages. It does not set cookies, does not use analytics scripts and does not have login. When you visit, our hosting provider (Cloudflare) records standard server logs including your IP address, browser type and the pages requested, for security and to keep the site running. These logs are kept by Cloudflare for a short period under its own retention rules.

If you email, call or message us, we keep that correspondence to respond to you and for our records.

4. The JollyBaba management app

4.1 Shop staff accounts

Shop owners and staff sign in to JollyBaba with a Google account. When you sign in we receive from Google your name, email address and profile picture, and a unique Google account identifier. We use these to create your account, show your name inside the app, and control what parts of the app you can use. We do not receive your Google password. We may also record the branch you belong to, your role (owner, staff, technician), the device and browser you use, and a log of important actions you take inside the app (for example, closing a repair ticket or recording a payment) so the shop owner can audit them.

Purpose: to provide the service you or your employer have signed up for, to secure the account, and to keep a record of business transactions. Legal basis under the DPDP Act: your consent when you sign in, and the legitimate use of providing a service you have requested.

4.2 Customer and vendor records stored on behalf of shops

Shops use JollyBaba to record their own customers and suppliers. Depending on what the shop chooses to enter, this can include:

• Customer name and phone number.
• Details of the device brought for repair or sold, including model, IMEI and fault description.
• Repair ticket history, invoices, payments and outstanding balances (khatabook entries).
• Vendor and supplier names, phone numbers and, where the shop chooses to record it, identity document numbers for purchase records.
• Photos of devices, receipts or parts uploaded by the shop.

We store this data only so the shop can run its business. We do not use shop customer data for our own marketing, we do not sell it, and we do not combine data across different shops. Each shop's data is isolated from every other shop's data.

If you are a shop customer: the shop collected your data when you visited. Ask the shop to correct or delete it. You may also contact us directly using the data deletion page; we will pass your request to the shop and act on their instruction, or act directly where the law requires.

4.3 Automatically collected data

JollyBaba records the IP address, device type and app version of each sign in for security. We use privacy respecting, aggregated usage measurements (for example, daily active users per shop) to understand whether the product is being used. We do not run third party advertising trackers inside the app.

5. The JollyBaba catalogue app

JollyBaba Catalogue shows a shop's phones for sale. It has no login and no account. You can browse without giving us any personal data.

• When you tap "WhatsApp", "Call" or "Email", your device opens the relevant app and you contact the shop directly. Your phone number or email is seen by the shop you contacted, not stored by the catalogue.
• We collect aggregated, anonymised usage statistics (which listings are viewed, general device type) through Google Analytics for Firebase to understand which products are popular and to improve the app. These statistics cannot identify you.
• If the app crashes, a crash report containing the device model, operating system version and the error may be sent to Firebase Crashlytics so we can fix the bug. Crash reports do not contain your name or contact details.
• Product photos in the catalogue are served from Cloudinary.

Google Play data safety disclosure for JollyBaba Catalogue: the app collects no personal data that identifies you; it collects app interaction and crash data, which is not linked to your identity and is used for analytics and app functionality only. Data is encrypted in transit. There is no account to delete; you can stop all collection by uninstalling the app.

6. WhatsApp messages sent on behalf of shops

Some shops use JollyBaba, or our onboarding service, to send WhatsApp messages to their customers: for example, "your repair is ready", an invoice, or a reply to an enquiry. These messages are sent from the shop's own WhatsApp Business number through Meta's WhatsApp Cloud API, with Tinker Software acting as the technical provider.

6.1 What is processed

• The customer's phone number (needed to deliver the message).
• The message content, which is generated from the shop's records (customer name, ticket number, device, amount due).
• Delivery status information returned by Meta (sent, delivered, read, failed).
• Replies a customer sends to the shop's number, which are shown to the shop.

6.2 Consent to receive messages

Shops must only send messages to customers who have agreed to be contacted on WhatsApp, in line with WhatsApp's Business Messaging Policy and Indian law. Customers can stop messages at any time by replying "STOP" or by asking the shop. Marketing messages are sent only with the customer's separate opt in.

6.3 Meta Platform Data

To operate the WhatsApp Cloud API, we access certain data through Meta's platform ("Platform Data" as defined in Meta's Platform Terms): WhatsApp Business Account identifiers, phone number identifiers, message templates, message delivery events and, where a customer replies, the content of that reply. We use Platform Data only to send and receive messages for the shop that owns the account, to show delivery status inside JollyBaba, and to keep the integration working. We do not sell Platform Data, we do not use it to build profiles, and we do not share it with anyone other than the shop it belongs to and the processors listed in section 8. We keep Platform Data only as long as needed for these purposes or as required by law, and we delete it when the shop disconnects its account or when Meta requires deletion. We maintain the security measures described in section 11 and will cooperate with Meta's audit and compliance requirements.

Meta processes WhatsApp messages under its own WhatsApp Privacy Policy and Business Terms. Messages sent over WhatsApp are end to end encrypted between Meta's servers and the recipient; the shop and Tinker Software can see the message content because we compose it.

7. Google sign in and Google Play

JollyBaba uses Google Sign In. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We request only basic profile information (name, email, profile picture) and do not request access to your Gmail, Drive, contacts or any other Google data.

For apps distributed on Google Play, the data safety section in the Play listing reflects the practices described in this policy. Where the two differ, this policy is the more detailed statement.

8. Who we share data with

We do not sell personal data. We share it only with service providers who process it on our instructions, with the shop that owns the data, or when the law requires.

We may also disclose data when required by a court order, a request from a law enforcement agency under Indian law, or to protect the rights and safety of our users, the shops we serve or the public.

9. Where data is stored

Our application servers and database are hosted by Railway in the United States, and uploaded images are stored by Cloudinary in the United States. This means personal data collected in India is transferred to and stored in the United States. The DPDP Act permits transfer of personal data outside India except to countries restricted by the Central Government; the United States is not currently restricted. We have contractual agreements with these providers that require them to protect data to a standard no lower than this policy, and all data is encrypted in transit and at rest.

If Indian law or a regulator later requires data to be kept within India, we will move it and update this policy.

10. How long we keep data

11. How we protect data

• All connections use HTTPS (TLS 1.2 or higher). The database is encrypted at rest by the hosting provider.
• Passwords are never stored; sign in is through Google. Session tokens are short lived and rotated.
• Each shop's data is separated at the database level so one shop can never see another shop's records.
• Access to production systems is limited to named individuals at Tinker Software and is logged.
• Secrets and API keys are held in the hosting provider's secret store, never in app code.
• Backups are encrypted and access controlled.

No system is perfectly secure. If you believe your data has been exposed, contact us immediately at the address in section 16.

12. Your rights under the DPDP Act

As a Data Principal you have the right to:

• Access: ask what personal data we hold about you and receive a summary of it and of the processing we carry out.
• Correction and updating: have inaccurate or incomplete data corrected.
• Erasure: have your personal data deleted when it is no longer needed for the purpose it was collected, unless we must keep it by law. See the data deletion page.
• Withdraw consent: at any time, as easily as you gave it. Withdrawing consent does not affect processing already done, and may mean we can no longer provide the service.
• Grievance redressal: raise a complaint with our grievance officer (section 16). If you are not satisfied with our response, you may approach the Data Protection Board of India.
• Nominate: name another person to exercise these rights on your behalf if you die or become incapacitated.

To exercise a right, email raviraj03.py@gmail.com with the subject "Privacy request". We will verify your identity (usually by replying to the email or phone number on record) and respond within 7 working days. There is no charge.

If the data you are asking about was entered by a shop, we will forward your request to that shop, since it is the Data Fiduciary, and help it respond within the same period.

13. Children

Our products are business tools intended for adults. We do not knowingly collect personal data from anyone under 18. Shops must not create staff accounts for minors. If you believe we hold data about a child without verifiable parental consent, contact us and we will delete it.

14. Data breaches

If we become aware of a personal data breach that is likely to affect you, we will notify the affected shops and, where required, the affected individuals and the Data Protection Board of India without undue delay and in the form and time required by the DPDP Act and its rules. The notice will describe what happened, what data was involved and what we are doing about it.

15. Changes to this policy

We may update this policy when our products or the law change. The effective date at the top always shows the current version. For material changes, such as a new category of data or a new purpose, we will notify shop owners by email at least 15 days before the change takes effect. This page stays at the same URL so that references to it from app stores and Meta remain valid.

16. Contact and grievance officer

Tinker Software (Metro Tech)
Wadwani, District Beed, Maharashtra 431144, Nashik, Maharashtra, India
Email: raviraj03.py@gmail.com
Phone: +91 72187 24094

Grievance Officer: the Grievance Officer, Metro Tech, at the same address and email. Grievances are acknowledged within 48 hours and resolved within 30 days. Please put "Grievance" in the subject line.

Metro Tech is a brand of Tinker Software, Udyam No. UDYAM-MH-05-0134855, Nashik, Maharashtra.