Your privacy matters

1. Who we are

Varied Reach e-Voting Platform (“the Platform”, “we”, “us”) is operated by Varied Reach Technologies. We provide a digital platform for conducting Homebuyer Monitoring Committee Nominations and Elections under the Insolvency and Bankruptcy Code, 2016 (IBC).

Our registered correspondence address: hello@variedreach.com

2. What data we collect

2.1 Insolvency Professionals (IPs) and team members

• Name and work email address (used for OTP-based authentication)
• Organisation name and identifier
• IP address and user agent (stored in the audit log for every session)
• Actions performed on the platform (audit log)

2.2 Homebuyers (voters)

• Name, flat number, tower name, and registered email or mobile number (imported by the IP from their case records)
• OTP verification timestamp and IP address
• Vote cast timestamp (not the vote choice — that is encrypted and not linked to the voter record)
• Unique voting token and receipt code

2.3 Nomination applicants

• Name, flat number, tower name, and contact details
• Documents uploaded in support of the nomination

3. How we use data

• To authenticate users and homebuyers via OTP
• To conduct legally valid committee elections under the IBC
• To maintain an immutable audit trail for regulatory compliance
• To generate quotations, proposals, and invoices
• To send transactional emails (OTP codes, reminders, result notifications)

We do not use personal data for advertising, profiling, or sale to third parties.

4. Vote secrecy

Ballot choices are encrypted with AES-256-GCM before being written to the database. The encryption key is stored only in the server environment and is never accessible via any interface. The Platform cannot — and will not — reveal how any individual homebuyer voted. The audit log records that a vote was cast, not what the vote was.

5. Data retention

• Audit logs: retained indefinitely — required for regulatory compliance
• Election data: retained for the duration of the subscription and 5 years thereafter, or as directed by applicable law
• OTP codes: deleted immediately after use or expiry
• Uploaded documents: retained until the IP deletes them or the subscription lapses

6. Data sharing

We do not sell, rent, or share personal data with any third party except:

• Hosting infrastructure (Hostinger VPS, India datacenter) — processor only, no independent access to data
• When required by applicable Indian law, court order, or IBBI directive

7. Your rights

Under applicable Indian law, individuals may request:

• Access to personal data held about them
• Correction of inaccurate data
• Deletion of data (subject to audit-log and legal-hold exceptions)

To exercise any of these rights, email privacy@variedreach.com. We will respond within 30 days.

8. Cookies

The Platform uses one httpOnly, Secure session cookie to store the refresh token. This cookie is strictly necessary for authentication and cannot be used to track you across other websites. No third-party tracking or advertising cookies are used.

9. Security

We implement industry-standard technical and organisational measures including AES-256-GCM encryption, TLS in transit, network-isolated database containers, and role-based access controls. See our Security page for a detailed overview.

10. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top will reflect any changes. Continued use of the Platform after an update constitutes acceptance of the revised policy.

11. Contact

For any privacy-related questions: privacy@variedreach.com