Privacy Policy

This Privacy Policy describes how SaveMy75 ("we", "our", or "us"), operated as a sole proprietorship by Abhinav Rao under the software studio FARSSH, based in Hyderabad, Telangana, India, acts as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act).

We operate the SaveMy75 mobile applications (iOS and Android), the product web app at app.savemy75.com, and our website at savemy75.com.

SaveMy75 is an independent student attendance utility. We are not affiliated with, endorsed by, or connected to HITAM, WebProsIndia, or any educational institution. Your college portal remains the sole official source of academic records.

Depending on how you use SaveMy75, we collect and process the following categories of data:

• Account profile information: When you sign in with Google or Apple, we receive your name, email address, and profile photo via Google / Firebase Authentication.
• User identifiers: A Firebase user ID (UID) and an internal SaveMy75 account identifier used to securely associate your records and synchronize data across devices.
• Institutional ERP credentials: If you link your college portal, you provide your student roll number and portal password. Institutional credentials are encrypted at rest on our backend servers (AES-256-GCM class encryption) and are never stored in plain text or returned to client applications after linking.
• Academic and attendance records: Subject-wise attendance percentages, conducted/attended class counts, daily session history, timetables, internal examination marks, branch/program details, and related academic metadata retrieved from your college portal when you authorize a sync.
• Payment and subscription transaction metadata: Plan identifier, subscription status (e.g., active, expired), Razorpay payment ID, subscription ID, order ID, and transaction timestamps. (See Section 4 regarding payment security).
• Device and diagnostics information: Operating system version, device model, application build version, crash logs, network error logs, and interaction events used for telemetry and reliability.
• Support communications: Information you provide when contacting customer support or submitting our contact form, including your email, device environment, and inquiry details.

We do not sell your personal data. We do not use your ERP credentials for any purpose other than synchronizing your attendance at your request. We do not collect precise GPS location for tracking purposes.

Account creation and identity verification are powered by Firebase Authentication using Google Sign-In (OAuth) and Sign in with Apple. We do not maintain custom user password tables on SaveMy75 for application sign-in.

• Identity tokens provided by Google and Apple verify your identity without exposing your external account passwords to us.
• Our backend validates short-lived JSON Web Tokens (JWT) on all authenticated API requests to enforce row-level security and strict account isolation.
• Guest Mode leverages Firebase Anonymous Authentication to allow students to test calculators without linking an email account.

When you purchase a subscription or recurring plan on SaveMy75, transactions are processed securely through our authorized payment aggregator, Razorpay Software Private Limited.

• Zero Card & Secret Data Storage: SaveMy75 does not collect, process, or store credit/debit card numbers, CVVs, card expiration dates, netbanking passwords, or UPI PINs. All payment instrument information is submitted directly to Razorpay over encrypted TLS connections.
• PCI-DSS Level 1 Compliance: Razorpay is certified under PCI-DSS Level 1, the highest security standard in the global payments industry. Payment tokenization and mandate management comply with Reserve Bank of India (RBI) recurring payment regulations.
• Transaction Records Retained: SaveMy75 receives and retains non-sensitive transaction receipts, including Razorpay Order ID, Payment ID, Subscription Mandate ID, payment method type (e.g., UPI, Card), transaction amount, and payment status, exclusively for provisioning subscription access, generating invoices, and processing refund requests.

Under the DPDP Act 2023, we process personal data for specified lawful purposes based on your explicit consent and reasonable contractual necessity:

• Authenticate your account and maintain session security across mobile and web platforms.
• Connect to your designated institutional ERP portal using encrypted credentials you supply to fetch attendance records on your behalf.
• Calculate attendance metrics, safe leave buffer days, recovery timelines, and condonation projections.
• Deliver user-configured notifications, timetable reminders, and attendance buffer alerts.
• Process payments, manage subscription lifecycles, and execute refund or cancellation requests.
• Diagnose technical failures, resolve scraper issues, monitor application performance, and safeguard backend security.
• Comply with applicable legal, statutory, and regulatory obligations under Indian law.

When you link your college ERP account, our background workers retrieve attendance registers, subject schedules, and related academic records.

• Data is cached in our secure database to enable rapid retrieval, offline access, and trend analysis without continuous scraping of institutional servers.
• Our parser explicitly drops sensitive demographic records (such as parent contact numbers, home addresses, Aadhaar, or financial aid data) during ingestion.
• All calculations are estimates for personal planning. Your educational institution’s official register is the sole legal record of your attendance.
• Unlinking your college portal immediately erases stored credentials and halts automated background syncs.

SaveMy75 may deliver push alerts regarding attendance updates, low-buffer warnings, and timetable alerts.

• Push delivery utilizes platform services such as Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS) with device push tokens.
• You can toggle or silence notifications at any time in device system settings or in-app preferences.
• Notification payloads never contain ERP passwords or full financial transaction details.

We use PostHog for product telemetry and crash diagnostics. Telemetry helps us detect scraper breaks, optimize load speeds, and identify software defects.

• Telemetry records user interactions (screens viewed, button taps, sync outcomes) and coarse device properties (device model, OS version).
• Analytics sanitizers automatically redact ERP passwords, bearer tokens, encryption keys, and payment credentials before events leave our systems.
• Analytics identifiers are pseudonymized and never sold to data brokers or advertising networks.

Our marketing website uses local browser storage for interface settings (such as dark/light theme). Cloudflare security proxies may use essential cookies for DDoS mitigation and traffic integrity.

On mobile devices, authentication session material is maintained in platform-level secure storage (iOS Keychain / Android EncryptedSharedPreferences). Signing out clears all session keys.

We share data with verified third-party technical service providers under strict data-protection covenants:

• Google Firebase: Authentication and push notification transport.
• Razorpay: Payment processing, AutoPay mandate registration, and refund execution.
• PostHog: Pseudonymized product diagnostics and telemetry.
• Cloudflare: Edge routing, web application firewall (WAF), and CDN delivery.
• Hosting Infrastructure: Dedicated secure virtual server environments with restricted SSH access and automated patching.

SaveMy75 maintains robust technical and administrative security controls:

• Encryption in Transit: All web and API communication is enforced over HTTPS utilizing TLS 1.3/1.2 protocols.
• Cryptographic Encryption at Rest: Stored ERP passwords are encrypted at rest using AES-256-GCM authenticated encryption. Encryption keys are segregated from application databases with programmatic key rotation capabilities.
• Row-Level Security & Scoping: All academic queries in backend databases enforce tenant-level ownership checks preventing cross-user unauthorized data exposure.
• Automated Secret Redaction: Application loggers automatically filter passwords, tokens, and authorization headers from error logs.

Guest Mode allows students to explore calculators and features without providing personal Google/Apple accounts. Guest sessions are local-first. Exiting Guest Mode clears all local cache files and temporary session keys from the device.

SaveMy75 maintains a strict zero-sale policy: we never sell, rent, monetize, or trade your personal or academic information to advertisers, data brokers, or marketing partners.

Data is disclosed solely to authorized service providers (Section 10), or when required by applicable law, court order, or statutory request from an authorized law enforcement authority.

• Active Account Records: Retained while your account remains active to provide attendance tracking across academic terms.
• Upon Account Deletion: Core account identifiers, Google/Apple associations, encrypted ERP credentials, and academic data are purged immediately from active production databases.
• Operational Logs: Technical error traces, rate-limiting counters, and security audit logs are automatically pruned within a 30-day rolling window.
• Financial Records: Transaction receipts and invoice metadata are retained for statutory accounting and tax compliance periods as required under Indian law.

Under the Digital Personal Data Protection Act, 2023, you are recognized as a Data Principal with enforceable statutory rights:

• Right to Access & Summary: You may request a summary of personal data being processed and the identities of data fiduciaries or processors with whom data has been shared.
• Right to Correction & Erasure: You can update inaccuracies in your profile or permanently erase your personal data using in-app deletion tools or by contacting support.
• Right to Grievance Redressal: You have the right to register privacy-related grievances with our designated Grievance Officer (Section 18).
• Right to Nominate: You may designate an individual who, in the event of death or incapacity, shall exercise your rights as a Data Principal.

You can erase your personal data at any time through self-serve workflows:

• In-App Deletion: Navigate to Profile → Actions → Delete Account. Confirming permanently erases your account linkage, encrypted portal passwords, and stored attendance records from our systems.
• Web Deletion Instructions: Visit app.savemy75.com/delete-account for guided instructions.
• Assisted Email Deletion: Email support@savemy75.com with the subject "Data Deletion Request". Verified requests are fulfilled within 48 hours.

SaveMy75 is built for students in higher education. Under Section 2(f) of the Indian DPDP Act 2023, an individual under 18 years of age is classified as a child.

Students under 18 years of age (including college freshmen) must access SaveMy75 with the knowledge, guidance, and consent of their parent or legal guardian. We do not engage in behavioral tracking or targeted advertising directed at students. If you believe a child has provided data without appropriate parental consent, contact support@savemy75.com for immediate data removal.

In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, SaveMy75 has designated a Grievance Redressal Officer:

We may modify this Privacy Policy to reflect technical enhancements, feature updates, or regulatory notifications. Any modifications will be reflected by the "Last updated" date at the top of this document. Continued use of the platform after updates constitutes acceptance of the revised practices.

For questions, privacy inquiries, or data protection assistance:

• Email: support@savemy75.com
• Website: https://savemy75.com
• Contact Us Page: https://savemy75.com/contact
• Terms & Conditions: Terms and Conditions