Apti Privacy Policy

Version 2026-11-02

1. Who we are and what this covers

Apti is an app that organizations use with their people, their customers and their communities. This policy covers everything the Apti app and its servers do with your personal data, in every organization you join. It is written by Codepackers Software Solutions Pvt Ltd (CIN U62091HR2023PTC114085), 1501, Tower-2, Unitech Escape, Sector-50, Gurgaon, Haryana, India 122018 ("we", "us"), which runs the Apti service.

Who is responsible for your data. Under the Digital Personal Data Protection Act 2023:

Where	Data fiduciary (the one who answers for your data)	Our role
Your account itself: sign-up, sign-in, your profile, your phone	Codepackers	Fiduciary
The AptiMart marketplace and Apti Social, which we run	Codepackers	Fiduciary
A workplace or other organization that uses Apti with its own members	That organization	Processor, on its instructions

Each organization's own notice, shown when you join it, names the organization and its contact. Questions about your data: support@codepackers.com. Complaints: the grievance officer in section 12, or Profile › Contact us in the app.

2. What we collect, why, and on what basis

Most of this you give yourself, for a purpose you choose, which the Act calls a legitimate use (s.7(a)). Where we ask you to switch something on, that is your consent (s.6), and you can switch it off again (section 7). Rows marked *optional* apply only when you use that feature or belong to an organization that uses it.

Data	Why	Basis	Kept
Account: name, login ID, mobile number, email, profile photo, password (one-way hash)	To create your account, sign you in, and show who you are to the people you deal with	You give it to use the service	Life of the account; login ID, mobile number, email and PAN 180 days after deletion (IT Rules 2021)
Google or Facebook sign-in (optional): if you choose to sign in with Google or Facebook, the account's ID there, its name and its email address	To sign you in with that account; the name is used for your new profile when you join with it. We ask for nothing else and never post anything	You choose it	Until you disconnect it (Profile › Account › Connected accounts) or your account is deleted
Profile extras (optional): gender, date of birth, address and PIN, a PAN where a listing requires one (shown to our admins as its last 4 digits)	Your own records and what a listing requires	You give it	Life of the account
Age declaration: your tick that you are 18 or older and your acceptance of the terms, with the time and the kind of device	The law requires adults only and a record of acceptance	Legal duty	Life of the account plus 3 years
Organization acceptances: which organizations you joined, when, and which version of their terms you accepted	So each organization's rules apply to you only after you agreed	Legal duty	Life of the account plus 3 years
SIM binding: subscription id, SIM slot, carrier codes, the SIM's number where the carrier gives it, a log of when the SIM was seen, missing or changed; a one-time SMS code when verification is on (hash)	India's telecom direction requires messaging apps to tie each account to the SIM in the phone; it also protects you against account takeover	Legal duty	Life of the account; events 1 year
Sign-in records: IP address, host name, time, phone or web	Security, fraud prevention, record-keeping	Legal duty	1 year
Push token (Google FCM or Apple APNs)	To ring your phone for calls and notify you of messages	To provide the service	Until the device signs out or the account is deleted
Location while the app is open (optional): your phone's position, with the battery level, only while Apti is on screen and only if you switch "Share my location" on (it is off until you do); nothing when the app is closed except a live location you share	Map features, nearby listings; and, in an organization whose notice says so, the people allowed to may see where you are while the app is open	Your consent: Profile › Privacy › Sensors › Share my location	Current position, plus 7 days of history
Location you send (optional): a location in a chat; a live location for 15 minutes, 1 hour or 8 hours, which keeps going with the app closed until it ends or you stop it	Because you chose to share it	Your action each time	With the chat; live shares end at the time you chose
Addresses (optional): up to 5 labelled addresses with a map pin	So a listing can deliver to you; it sees an address only after you say yes to it	You add them; you agree per listing	Until you delete them or your account
Map searches: the text you type into place search	To find the place; it goes through our server to OpenStreetMap's Nominatim without your name or account	To provide the feature	Not stored
Chats, photos, voice notes, documents, videos	To deliver them and keep the conversation; files are scanned for viruses; links may be previewed by our server	To provide the service	While the chat exists; hidden or reported content 180 days
Calls: who called whom, when, how long, whether answered	Call history and record-keeping	To provide the service	Life of the account; the audit record 1 year
Call content (optional)	Not recorded, unless an organization has recording switched on, which its own notice tells you; a recording is then that organization's record, kept 90 days, and every play is logged	That organization's rules	90 days
Orders and payment requests (optional, marketplace): items, status, amount, a listing's UPI ID, your "I've paid" and the UTR you may type, "Received", cash marks	The record of an order between you and a listing; we do not see or move the money	To provide the service	With the chat; the listing keeps it as its business record
Customer notes (optional, marketplace): tags a listing attaches to you from our list	So the listing can serve you; seen only by that listing's owners and staff	The listing's record about you (section 5)	Until the listing removes them, you leave it, or your account is deleted
Ratings, reports and complaints: what you reported, about whom, why, and what was done; Contact-us complaints with an optional photo	Moderation and the law's grievance duties; ratings are shown without your name	Legal duty and to provide the service	1 year at least; removed content 180 days
Listing data (optional) if you run one: name, address, photos, registration numbers, UPI ID, hours, your staff and co-owners, prices and stock, offers	To show the listing; some registration numbers are shown to customers, as the law requires	You give it to be listed	While listed, then 180 days
Subscription records (optional, for a listing on a paid plan): the plan, who bought it, the store's order reference, dates, amounts, tax and refunds. The store holds your card or UPI details; we never see them	To give you the plan you paid for, and for accounts and tax	To provide the service, and legal duty	While the plan runs, then as long as tax and company law require
How you joined: the invitation, link, code or person that brought you to an organization; on Android, the Google Play install referrer on first start	So the right organization or listing is linked to you	To provide the service	Life of the account
Device and app information: app version, device model, operating system, network type	To keep the app working and adapt data use on weak networks	To provide the service	1 year

What we do not do. We do not read your phone's contacts. We do not use analytics or advertising trackers. We do not sell or rent your data. We do not use it to show you advertising.

3. What an organization may switch on

Every organization in Apti has three switches that are off unless its own notice says otherwise: its admins may read chats, listen to calls, and record calls inside that organization. Only our platform admin can switch them on, at an organization's request, and every time an admin uses one of them it is logged. An organization's notice also tells you how strictly it applies SIM binding and whether it blocks screenshots or hides message text in notifications on its members' phones. We look at content ourselves only when it is reported, when a court or a government authority lawfully orders it (Information Technology Act 2000 s.69; Bharatiya Nagarik Suraksha Sanhita 2023 s.94), or to keep the service secure.

4. Who sees your data

The people and organizations you deal with, according to each organization's rules: in a marketplace, a listing's owners and staff see your chats, orders and the addresses you agreed to share, and only its owners see your number; in a members' network, only the people you connected with; in a workplace, the people the organization lets you reach, and its admins as section 3 describes. Customers of a marketplace never see one another.
Processors who work for us, under contract and only on our instructions: Hostinger, with servers in Mumbai, India, for the servers and database; Google (Firebase Cloud Messaging) and Apple (APNs) to deliver notifications; Google ML Kit, which reads QR codes and shop business cards on your phone and sends Google diagnostic data about the app and the device (device and app details, performance, image size and a per-installation identifier); MSG91, a DLT-registered SMS provider, to send one-time codes when SMS verification is on; OpenStreetMap's Nominatim for place search (query text only). If you sign in with Google or Facebook, that company confirms who you are to us under its own privacy policy; we send it nothing about your use of Apti. Our public website, apti.codepackers.com, is hosted on Netlify and holds no account data.
Google Play, if you buy a paid plan in the Android app. Google takes the payment as a separate company, under its own terms and privacy policy, and tells us the state of the purchase.
The law. We disclose data to the police, a court or a government authority when the law requires it, and we keep the records the Information Technology Rules 2021 require for 180 days after an account is deleted.
Nobody else. No sale, no sharing for advertising, no data brokers.

5. Organizations as data fiduciaries

A workplace organization that uses Apti with its members is responsible for the data its members produce inside it. A listing in the marketplace is responsible for what it learns about its customers (name, number, addresses shared, orders, notes). Our terms require every organization and listing to use that data only for its purpose, never to copy it out of the app, sell it or message people from personal numbers, to delete it when asked or when the person leaves, and to tell us within 24 hours of any leak. To exercise your rights against an organization or a listing, write to it in the app, or ask our grievance officer to help.

6. Children

Apti is for adults. You confirm you are 18 or older when you accept the terms. We do not knowingly process a child's data, do not track or profile children and do not direct advertising at them (DPDP Act s.9). If you believe a child has an account, tell the grievance officer and we will remove it.

Withdrawing is as easy as giving. Each choice is in the app, under Profile (your picture at the top right):

Choice	Where	When you withdraw
Location while the app is open	Profile › Privacy › Sensors › Share my location (off until you switch it on)	Your position is no longer reported; nearby listings use it only while you look at them
Live location in a chat	Stop sharing in the chat	The share ends at once
Address shared with a listing	My addresses, or decline when asked	That listing no longer sees it
Notifications and offers from a listing	The listing's page › notifications	No pushes from it
Follow, leave or block a listing or a person	Its page	They can no longer message you; the old chat stays read-only
Membership of an organization	Profile › Organizations › Leave	You are out of that organization; its records of you follow section 9
SMS verification code	Decline on the Confirm your number screen	Your number stays unproven; the app keeps working while the law allows
Phone permissions (camera, microphone, location, phone state, notifications)	Your phone's settings	The feature that needs the permission stops
The account itself	Profile › Account › Delete my account, or apti.codepackers.com/delete-account/ without the app	See section 9

8. Your rights

Under the Digital Personal Data Protection Act 2023 (s.11 to s.14) you may see a summary of the personal data we hold about you and who we shared it with; correct, complete or update it (most of it in Profile › Edit profile); erase it, except what the law requires us to keep; nominate a person to exercise these rights for you if you die or cannot act; and complain to the grievance officer and, if not satisfied, to the Data Protection Board of India. For data an organization is responsible for (section 5), we pass your request to it and help.

Send requests through Profile › Contact us or to support@codepackers.com, from the number, email or login ID on the account. We respond within 30 days. Your duties under the Act: do not impersonate anyone, do not suppress a material fact, and do not make a false complaint (s.15).

9. How long we keep data, and deleting your account

We keep personal data only as long as the purpose in section 2 lasts or the law requires, and then erase it.
Leaving an organization ends what you can see there; the organization keeps its own records of you for its purposes, under its notice, and we keep the acceptance record (section 2).
Deleting your account. In the app: Profile › Account › Delete my account. Without the app: email support@codepackers.com. At once, you are signed out on every device and your account is switched off in every organization. For 30 days, signing in again cancels the deletion. After 30 days we delete your profile and photo, addresses, positions, connections, the notes organizations and listings kept about you, and the files you sent; your name then shows as "Deleted account". Messages you sent stay in the other person's chat, shown as from "Deleted account", because they are part of that person's conversation too. If you are the main owner of a listing, hand it over first; the app tells you.
What we keep after deletion. Your login ID, mobile number, email and PAN for 180 days (IT Rules 2021). Reports, moderation records, terms acceptances and sign-in records, for the periods in section 2. Order and payment-request lines stay with the listing as its business record, under "Deleted account". Subscription records stay as long as tax and company law require. Deleting your account does not cancel a store subscription; cancel it in the store.

10. How we protect data

Connections to our servers are encrypted (TLS). Passwords and one-time codes are stored as hashes. Files are scanned for viruses before delivery. You can lock the app, hide message text in notifications, block screenshots, and sign out other devices. Admin access is logged and reviewable. Chats and calls are not end-to-end encrypted: they are readable on our servers under the controls in sections 3 and 4.

If personal data is lost, leaked or accessed without authority, we tell every affected person without delay, with what happened and what to do, and we report it to the Data Protection Board without delay and in full within 72 hours (DPDP Rules 2025, rule 7). Where an organization is the fiduciary, we tell it at once so it can meet the same duty.

11. Where data is stored, and changes

Your data is stored in India, on Hostinger's servers in Mumbai. Notifications pass through Google's and Apple's servers, which may be outside India, and SMS codes through MSG91. Transfers are allowed to any country the Central Government has not restricted (DPDP Act s.16).

We may change this policy. The app and this page show the new version and its date. A change that adds a new purpose or a new kind of data is explained in the app before it takes effect, and where consent is needed we ask for it afresh.

12. Contact

Codepackers Software Solutions Pvt Ltd (CIN U62091HR2023PTC114085), 1501, Tower-2, Unitech Escape, Sector-50, Gurgaon, Haryana, India 122018.
Data questions and deletion requests: support@codepackers.com.
Grievance officer: Sujagya Das Sharma, suja.sharma@codepackers.com, +91-8383980428.
In the app: Profile › Contact us.