Privacy Policy

SEALED

Privacy Policy

Effective Date: March 25, 2026   |   Version 3.0.0 and above

Applicable to: Sealed Customer App · Sealed Delivery Partner App · Admin Panel

Sealed (hereinafter referred to as "Company", "We", "Us", or "Our") is a technology platform incorporated and operating from Chennai, Tamil Nadu, India, offering on-demand delivery services including document delivery, parcel delivery, print-on-demand, and delivery of legal or official documents such as stamp papers and court fee stamps. This Privacy Policy ("Policy") describes how We collect, use, store, share, and protect the Personal Data of users ("You" or "Your") across Our customer-facing mobile application, the Delivery Partner application, and the Admin Panel (collectively, the "Platform").

This Policy is published in compliance with the Information Technology Act, 2000 ("IT Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and applicable provisions of the Digital Personal Data Protection Act, 2023 ("DPDP Act") as notified and applicable from time to time. This Policy is also designed to meet the privacy and data safety requirements of the Apple App Store and Google Play Store.

By downloading, installing, registering with, or using the Platform, You acknowledge that You have read, understood, and unconditionally consent to the terms of this Policy. If You do not agree, You must immediately discontinue use of the Platform.

1. INTERPRETATION AND DEFINITIONS

The following capitalised terms carry the meanings assigned to them throughout this Policy, whether appearing in singular or plural form.

"Account" – A unique profile created by You to access and use the Platform.

"Application / App" – The Sealed mobile applications for Customers and Delivery Partners, available on the Apple App Store and Google Play Store.

"Admin Panel" – The web-based administrative dashboard used by Company personnel to monitor, manage, and coordinate Platform operations.

"Company / We / Us / Our" – Sealed, a business entity registered and operating from Chennai, Tamil Nadu, India.

"Customer" – An individual or entity that uses the Platform to request delivery or print-on-demand services.

"Data Fiduciary" – The Company, as the entity that determines the purpose and means of processing Personal Data, as defined under the DPDP Act, 2023.

"Data Principal" – The natural person (You) to whom Personal Data relates, as defined under the DPDP Act, 2023.

"Delivery Partner" – An individual registered with the Platform to fulfil delivery assignments.

"Personal Data" – Any data that can directly or indirectly identify an individual, including but not limited to name, mobile number, email address, location, device identifiers, and IP address.

"Sensitive Personal Data or Information (SPDI)" – Personal Data as categorised under Rule 3 of the SPDI Rules, 2011, including financial information and location data where applicable.

"Service" – All features, functionalities, and services provided through the Platform.

"Third-Party Service Provider" – Any vendor, partner, or service provider engaged by Us to support Platform operations.

2. SCOPE OF PLATFORM SERVICES

Sealed operates a technology-enabled logistics platform that facilitates:

• On-demand delivery of documents, parcels, and packages;

• Print-on-demand services, enabling Customers to upload documents for printing and delivery;

• Delivery and procurement of legal and official documents including stamp papers, court fee stamps, and notarised documents;

• Real-time order tracking with GPS-enabled visibility for Customers and Delivery Partners;

• OTP-based authentication and delivery confirmation to ensure secure handover;

• In-app coordination between Customers, Delivery Partners, and Company operations via the Admin Panel.

3. INFORMATION WE COLLECT

3.1 Information You Provide Directly

When You create an account or use the Service, We collect:

• Full name;

• Mobile number (used for OTP-based authentication and delivery notifications);

• Email address (used for account management and service communications);

• Pick-up and delivery addresses (including pincode and landmark details);

• Documents uploaded for printing (processed solely for print fulfillment and permanently deleted from Our servers upon completion of the service — see Section 8);

• Payment information (processed by PCI-DSS compliant third-party payment gateways; We do not store card data);

• Communications You submit through in-app support or feedback channels.

3.2 Information Collected Automatically

We automatically collect certain technical data to maintain platform performance and security:

• Device information: device model, operating system version, unique device identifiers (IMEI/UDID/GAID/IDFA);

• IP address and network information;

• Application usage logs, crash reports, and diagnostic data;

• Session duration and feature interaction analytics.

3.3 Location Data

Location data is a core component of the Platform's functionality and is collected as follows:

• Customer App: Foreground location access is used to determine service availability, enable accurate address selection at pick-up and delivery points, and provide real-time order tracking visibility.

• Delivery Partner App: Foreground and background location access is required during active delivery shifts to assign nearby orders, provide live tracking to Customers through the Admin Panel, verify delivery completion at the designated address, and enable route optimisation. Background location collection is active only when a Delivery Partner has an active delivery assignment and is disclosed prominently within the App prior to activation.

Location data collected is used exclusively for operational purposes. We do not use location data for advertising profiling, nor do We sell location data to third parties. Delivery Partners may disable background location access through their device settings, though this will impair their ability to accept or fulfil active orders.

3.4 Device Permissions

The Platform requests the following device permissions, each of which is necessary for specific functions:

• Camera: To capture proof-of-pickup and proof-of-delivery photographs, and to scan QR codes or barcodes where applicable.

• Storage / Media Access: To allow Customers to upload documents for print-on-demand services and to store delivery confirmation images.

• Notifications: To deliver OTPs, order status updates, and real-time delivery alerts.

• Phone / Call Logs: To facilitate masked calling between Customers and Delivery Partners where such feature is enabled, without disclosing either party's direct phone number.

All permissions are requested contextually at the point of use and may be managed or revoked through Your device's operating system settings. Revoking certain permissions may limit the availability of corresponding features.

4. HOW WE USE YOUR INFORMATION

We process Personal Data solely for the following specified, explicit, and legitimate purposes:

• Account creation, authentication, and management;

• Processing, dispatching, and fulfilling delivery and print-on-demand orders;

• Assigning Delivery Partners to orders and facilitating real-time coordination;

• Providing live GPS-based order tracking to Customers and the Admin Panel;

• Sending OTPs, delivery status notifications, service updates, and critical alerts;

• Verifying pick-up and delivery completion;

• Detecting, investigating, and preventing fraudulent transactions and platform abuse;

• Processing payments and maintaining accurate transaction and earnings records for Delivery Partners;

• Analysing aggregated, anonymised usage trends to improve platform performance;

• Complying with applicable legal obligations, court orders, or regulatory requirements;

• Responding to Customer support enquiries and resolving disputes;

• Sending periodic service communications, promotional messages, and market research requests via SMS, email, or push notification — You may opt out at any time through account settings or by contacting Us.

We do not use Personal Data for automated decision-making that produces significant legal effects on You, nor for purposes incompatible with those stated above, without Your prior explicit consent.

5. LEGAL BASIS FOR PROCESSING

Our processing of Personal Data is grounded on one or more of the following lawful bases under applicable Indian data protection law:

• Consent: You have provided free, specific, informed, and unambiguous consent by accepting this Policy and using the Platform.

• Contractual Necessity: Processing is necessary to perform the service agreement between You and the Company.

• Legal Obligation: Processing is required to comply with applicable laws, including tax regulations, anti-fraud laws, and court orders.

• Legitimate Interests: Processing is necessary for Our legitimate business interests in maintaining platform security, preventing fraud, and improving service quality, provided such interests do not override Your fundamental rights.

Where processing is based on consent, You have the right to withdraw consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal. You may withdraw consent by contacting Our Data Protection Officer (DPO) at the details in Section 14.

6. DATA SHARING AND DISCLOSURE

6.1 Within the Platform Ecosystem

To fulfil orders, We share limited Personal Data between Customers and Delivery Partners, including first name, masked phone number, and live location during active delivery. Delivery Partner identity is verified and maintained by Us prior to any data sharing.

6.2 Third-Party Service Providers

We engage trusted third-party service providers under contractual data processing agreements to support platform operations. These include, but are not limited to:

• Payment gateway and financial transaction processors;

• Cloud infrastructure and hosting providers;

• Mapping and navigation services (including Google Maps Platform);

• SMS, push notification, and communication API providers;

• Analytics and crash reporting tools.

All third-party processors are bound by confidentiality obligations and are permitted to use Your data only as directed by Us and in accordance with this Policy. We do not sell, rent, or trade Your Personal Data to third parties for marketing purposes.

6.3 Legal Disclosure

We may disclose Your Personal Data to governmental authorities, law enforcement agencies, or judicial bodies where required by law, court order, or to protect the rights, safety, or property of the Company, its users, or the public. We will endeavour to notify You of such disclosure where legally permissible.

6.4 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of assets, Your Personal Data may be transferred to the successor entity, subject to equivalent privacy protections. We will provide notice of any such transfer.

6.5 Cross-Border Data Transfers

Where Personal Data is transferred outside India (for example, to cloud infrastructure hosted in other jurisdictions), such transfers shall be made in accordance with Section 16 of the DPDP Act, 2023, once applicable, and shall be subject to adequate contractual safeguards to ensure equivalent data protection standards.

7. DATA RETENTION

We retain Personal Data only for as long as necessary to fulfil the purposes described in this Policy, subject to the following guidelines:

• Documents uploaded for print-on-demand: Automatically and permanently deleted from Our servers upon successful completion and delivery of the print order.

• Active location data: Retained only for the duration of an active delivery assignment. Historical location logs are retained for a limited operational period not exceeding 90 days, after which they are anonymised or deleted.

• Account and transaction data: Retained for the period of account activity and for up to seven (7) years thereafter, as required by applicable tax, commercial, and financial regulation in India.

• Communication and support records: Retained for up to two (2) years from the date of the communication.

• Log and diagnostic data: Retained for up to 90 days for security monitoring and system diagnostics.

Upon request for account deletion, We will delete or anonymise Your Personal Data within a reasonable timeframe, except where retention is required by law or for legitimate dispute resolution purposes. Sensitive Personal Data or Information shall not be retained longer than is necessary for the purpose for which it was collected, in compliance with Rule 7 of the SPDI Rules, 2011.

8. DATA SECURITY

We implement industry-standard technical and organisational measures to protect Your Personal Data against unauthorised access, alteration, disclosure, or destruction. Our security practices include:

• Transport Layer Security (TLS / SSL) encryption for all data transmitted between the App and Our servers;

• Encryption of sensitive data at rest using AES-256 or equivalent standards;

• Role-based access controls ensuring that personnel access only the data necessary for their specific function;

• Regular security assessments, vulnerability testing, and penetration testing;

• Multi-factor authentication for Admin Panel access;

• Automatic deletion of print documents upon order completion, as described in Section 7.

In the event of a Personal Data breach that is likely to result in risk to Your rights and freedoms, We will notify the relevant authority and affected Data Principals in accordance with the timelines and procedures specified under the DPDP Act, 2023 and any applicable rules thereunder. While We employ commercially reasonable security measures, no method of data transmission or storage is entirely secure, and We cannot guarantee absolute security.

9. YOUR RIGHTS AS A DATA PRINCIPAL

In accordance with the DPDP Act, 2023 and applicable Indian data protection law, You have the following rights with respect to Your Personal Data:

• Right to Access: You may request a summary of the Personal Data We hold about You and the purposes for which it is being processed.

• Right to Correction and Erasure: You may request correction of inaccurate or incomplete data, or erasure of data that is no longer necessary for the purpose for which it was collected.

• Right to Grievance Redressal: You have the right to a readily accessible means of registering a grievance with Our DPO and to have it addressed within a reasonable timeframe.

• Right to Nominate: You may nominate another individual to exercise data rights on Your behalf in the event of Your death or incapacity.

• Right to Withdraw Consent: You may withdraw consent for any processing based on consent, without prejudice to prior lawful processing.

• Right to Opt Out of Marketing: You may opt out of promotional communications at any time through in-app notification settings or by contacting Us.

To exercise any of the above rights, please submit a written request to Our DPO at the contact details provided in Section 14. We will respond within 30 days of receipt. Certain requests may be subject to identity verification prior to processing.

10. DEVICE PERMISSIONS AND ACCESS CONTROLS

Sealed requests only those device permissions that are strictly necessary for core Platform functionality, as detailed in Section 3.4. We adhere to the principle of minimum necessary data collection. You may review and modify permissions granted to the App at any time through Your device's operating system settings (iOS Settings > Sealed; Android Settings > Apps > Sealed > Permissions). Revocation of permissions may disable certain features. We will not request permissions that are not directly necessary for the services You are using.

11. CHILDREN'S PRIVACY

The Platform is intended exclusively for individuals who are 18 years of age or older. We do not knowingly collect, process, or store Personal Data from individuals under the age of 18. If a parent or legal guardian becomes aware that a minor has provided Personal Data to Us without consent, they should contact Our DPO immediately. Upon verification, We will promptly delete such data from Our records. Registration by individuals under 18 is prohibited, and any accounts found to be held by minors will be terminated.

12. PROHIBITED ACTIVITIES

In accordance with Rule 3(1)(b) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, all users of the Sealed Platform are strictly prohibited from uploading, sharing, transmitting, or causing to be transmitted through the Platform any content or information that:

• Belongs to another person or entity and to which the user has no lawful right;

• Is grossly harmful, harassing, defamatory, obscene, pornographic, paedophilic, invasive of another's bodily or personal privacy, or racially or ethnically objectionable;

• Promotes hatred or discrimination on the grounds of religion, race, caste, sex, or national origin;

• Is libelous, libellous, or otherwise unlawful under Indian law;

• Harms or exploits minors in any manner;

• Infringes any intellectual property right, including patents, trademarks, copyright, or trade secrets;

• Threatens the unity, integrity, defence, security, or sovereignty of India or public order, or incites the commission of any cognisable offence;

• Contains viruses, malware, ransomware, spyware, or any other malicious software or code;

• Is knowingly false or misleading and intended to deceive or cause harm to any person or authority;

• Facilitates money laundering, gambling, fraud, or any other illegal activity;

• Impersonates any person or entity.

In the event of non-compliance, the Company reserves the right to immediately suspend or permanently terminate user access, remove non-compliant content, retain records for legal proceedings, and report violations to competent law enforcement or regulatory authorities as required by law. By using the Platform, users agree to comply with all applicable laws and these guidelines at all times.

13. COOKIES AND TRACKING TECHNOLOGIES

The Sealed mobile applications do not use browser cookies. However, We use mobile analytics SDKs and device identifiers to track app usage behaviour, diagnose crashes, and improve service performance. Analytics data is aggregated and anonymised wherever possible. You may opt out of analytics data collection by contacting Our DPO or by using the privacy settings available within Your device's operating system.

14. THIRD-PARTY SERVICES AND INTEGRATIONS

The Platform integrates with third-party services including Google Maps Platform for location and navigation functionalities. These services are governed by their respective privacy policies, which We encourage You to review independently. We are not responsible for the data practices of third-party services. Any links to external websites or services within the Platform do not constitute Our endorsement of, or responsibility for, those services.

15. GRIEVANCE REDRESSAL MECHANISM

In accordance with the IT Act, 2000, the SPDI Rules, 2011, and the DPDP Act, 2023, We have designated a Data Protection Officer (DPO) / Grievance Officer to address privacy-related concerns and complaints:

Data Protection Officer / Grievance Officer

Sealed

Chennai, Tamil Nadu, India

Email: admin@sealed.co.in

Response Time: Within 30 days of receipt of complaint

If Your grievance is not resolved to Your satisfaction within the prescribed period, You may approach the relevant Data Protection Board constituted under the DPDP Act, 2023 upon its operationalisation, or the competent courts having jurisdiction.

16. AMENDMENTS TO THIS PRIVACY POLICY

We reserve the right to update or revise this Policy at any time to reflect changes in Our data practices, applicable law, or platform features. Material changes will be communicated to You via in-app notification, push notification, or email at least 30 days prior to the effective date of the change, except where changes are required immediately by law. The revised Policy will bear an updated effective date at the top. Your continued use of the Platform following the effective date of any amendment constitutes Your acceptance of the revised Policy. If You do not agree with the amended Policy, You must discontinue use and may request account deletion as described in Section 9.

17. GOVERNING LAW AND JURISDICTION

This Policy shall be governed by and construed in accordance with the laws of India, including but not limited to the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts at Chennai, Tamil Nadu, India.

By using the Sealed Platform, you confirm that you have read, understood, and agreed to this Privacy Policy.

© 2026 Sealed · Chennai, Tamil Nadu, India · admin@sealed.co.in