Privacy Policy

1.Who we are and our role

For the personal data you give us to run your account and use the platform, SurveyX Technologies Private Limited is the Data Fiduciary and you are the Data Principal. Our registered office is at Flat 201, Shivsai Complex, S. No. 68A/2, Hadapsar Road, Manjri, Pune, Maharashtra 412307. GSTIN 27ABRCS5448P1Z8.

When you apply to an RPTO through DroneSetu™ and share identity documents with it, that RPTO is a separate Data Fiduciary for those documents and for your training records. It is responsible for its own use of them, including the records it is required by law to keep. We store and transmit those documents on the RPTO’s behalf as a processor, and on your behalf as the person they belong to.

2.Information we collect

• Account and profile: your name, email address, mobile number, profile photo, and, if you choose to add them, your remote-pilot certificate details (licence number, expiry and registration status).
• Fleet and logbook data: the drones and batteries you add (including any nicknames you give them), and the flight, maintenance and battery logbook entries you create, whether from a flight log or entered by hand.
• Flight-log analysis: when you open a flight log (.bin, .ulg, .csv and similar) in the app, it is read in your browser. The raw file stays on your device; we save only the summary used for your logbook and dashboard (date, duration, the location you enter, altitude, distance and detected issues).
• Flight logs you post to the forum: if you post a flight to the pilots’ forum, we upload that raw log file so other signed-in pilots can replay it in 3D and comment on it. This happens only for the posts you create, and you can delete them.
• Live telemetry you share: if you share a live flight with someone by email, the telemetry is relayed to the people you invited while you share it. We store who you shared with, not the telemetry itself.
• Identity and eligibility documents (training portal): if you apply to an RPTO for pilot training, you may upload documents such as a government ID (we ask for a masked Aadhaar), a medical certificate, a class-10 marksheet and an ID proof, with the details on them, so the RPTO can admit you. Section 5 explains how they are protected and when they are deleted.
• Training records: applications, enrolments, attendance, simulator and flying sessions, test results, fee records and certificate details created during your training.
• Enquiries: if you send an enquiry to an RPTO (for example through its enquiry form or a lead it imports), the RPTO’s staff see your name, contact details and what you asked about in its CRM.
• Payments: if you buy a paid plan, our payment processor (Razorpay) handles your card, UPI or bank details. We receive only the payment status, amount and a reference, never your full card number.
• Approximate location: to show aggregate usage to our administrators, we record a city-level location derived from your IP address while you use the app. We do not keep the IP address for this purpose or any precise GPS position of yours.
• Security and usage: last-seen time, consent records, and, for actions on sensitive documents and on connected AI apps, an access log of who did what and when, including the IP address and browser for those events.

3.How we use your information

• To provide the service: keep your fleet and logbooks, analyse and replay your flights, and run the training portal (admissions, batches, schedules, tests and certificates).
• To share your documents and training data with the specific RPTO you apply to, so it can check your eligibility, train you and certify you.
• To operate, secure and improve DroneSetu™, keep an audit trail of access to sensitive data, and understand usage in aggregate.
• To contact you about your account, for example email verification, password resets, payment receipts, and notices about your data such as an upcoming deletion of documents.

4.Consent and legal basis

We process your data to provide the service you sign up for. Where the DPDP Act requires consent, we ask for it when we collect the data. For example, you must give specific, informed consent before uploading identity documents, and we keep a dated, versioned record of that consent.

You can withdraw your consent at any time. Withdrawing it for a purpose may mean we or the RPTO can no longer provide the related service; for example, an admission cannot go ahead without the required documents. Withdrawal does not affect processing already carried out.

5.Identity documents: extra protection

• Encrypted at rest: uploaded documents are encrypted with AES-256-GCM before they are stored, using a key held outside the database.
• Encrypted in transit: all traffic uses HTTPS (TLS).
• Access-limited and logged: only staff of the RPTO you applied to, in the roles that need them, can view your documents, and every view is recorded.
• Deleted when no longer needed: your uploaded ID documents are deleted from DroneSetu™ when your Remote Pilot Certificate is issued, when your admission is cancelled, or about two months after upload if you never go ahead with an admission. Before an automatic deletion we tell the RPTO handling your application, so it can keep the copy it is required to hold. We keep a short verification record (that a document of a given type was checked) as proof the check was done.

Aadhaar: we ask you to upload a masked Aadhaar, with the first 8 digits hidden. We do not use your Aadhaar number to authenticate you, and we do not share it beyond the RPTO you apply to.

Identity documents are never shared with connected AI assistants (section 6).

6.AI assistants you connect (Claude, ChatGPT)

You can choose to connect an AI assistant, such as Anthropic’s Claude or OpenAI’s ChatGPT, to your DroneSetu™ account. Nothing is connected unless you set it up and approve it.

• Pilots: a connected assistant can read your logbook, totals, drones, batteries and maintenance records, and prepare new logbook entries. Entries it prepares wait as drafts until you approve them in the app; it cannot approve them, edit or delete existing entries, or export your logbooks.
• RPTO staff: an RPTO can allow its accountable manager, admins and business-development staff to connect an assistant. It sees what that person’s role sees in the RPTO portal, can add leads, lead notes and follow-up dates, and can save batch drafts that an authorised person approves in the app. It cannot change training records, attendance, tests, certificates, admissions or fees. The RPTO can turn this off for all its staff at once.
• What leaves DroneSetu™: the information the assistant reads to answer your question, which may include trainee or lead details for RPTO staff, is sent to the AI provider you use and handled under that provider’s terms and privacy policy. Identity documents and their numbers are never shared.
• Control: the assistant signs in as you and sees only what you can see. You can disconnect it at any time from Settings → AI assistant; actions taken through it are recorded in the access log.

7.Sharing and service providers

We share personal data only as described here or where the law requires it.

These providers process data on our behalf under their own security and privacy terms. Some of them may process data outside India; where they do, we rely on their contractual safeguards.

8.Where your data is stored and how it is secured

Your account data is stored in a managed PostgreSQL database hosted in India (Mumbai region), encrypted at rest and protected by row-level security so each person can access only the records they are allowed to see. All traffic uses HTTPS, identity documents are additionally encrypted, and two-factor authentication (an authenticator app) is available on your account.

No method of storage is completely secure, but we take reasonable technical and organisational measures to protect your data, and we will assess any personal-data breach and notify affected people and the Data Protection Board of India where the law requires.

9.How long we keep data

• Account, fleet and logbook data: kept while your account is active, and deleted when you delete your account, except where the law requires us to keep it.
• Identity documents: deleted when your certificate is issued, your admission is cancelled, or about two months after upload if you do not go ahead (section 5).
• Training and verification records: kept for five years to meet the record-keeping obligations of RPTOs.
• Forum posts and their flight logs: kept until you delete them or your account.
• Payment records: kept as long as tax and accounting law requires.

10.Your rights

Subject to the DPDP Act, you can:

• Access your data: download a copy of the data we hold about you from Account → Security → Download my data.
• Correct it: edit most details yourself in Account settings, or ask us to correct or complete them.
• Erase it: delete your account and the personal data linked to it from Account → Security.
• Withdraw consent for a specific purpose (section 4).
• Raise a grievance with our Grievance Officer (section 14) and, if you are not satisfied, with the Data Protection Board of India.
• Nominate another person to exercise your rights if you die or become incapable. Contact us to do this.

11.This website

The dronesetu.in website does not use advertising or analytics cookies, and it does not track you across other sites.

• To display the page, your browser loads fonts and code libraries from Google Fonts, jsDelivr and unpkg. These services receive your IP address and browser details as part of serving the files.
• The WhatsApp button is provided by Privyr. If you use it, the name, phone number and message you enter go to us through Privyr, and messages sent through WhatsApp are also handled by WhatsApp (Meta) under its own terms. We use them only to reply to your enquiry.
• If you email us, we use your email address and message only to reply.

The DroneSetu™ apps use cookies and browser storage that are needed to keep you signed in and remember your settings.

12.Children

The training portal is intended for adult trainees, and the wider service for certified or registered remote pilots. We do not knowingly process the personal data of a child (under 18) without verifiable parental consent, as the DPDP Act requires.

13.Changes to this policy

We may update this policy from time to time. We will change the “last updated” date above and, for material changes, tell you in the app.

14.Contact and Grievance Officer

For any question about this policy, or to exercise your rights, write to yogesh@surveyx.in.