Privacy policy for India

This policy explains what information VizzBox collects, why, and what you can do about it. We've tried to write it the way we'd explain it to you in person. It's the version for people in India.

It covers our website at vizzbox.com, the VizzBox portal your organisation uses at its own address (for example, yourcafe.vizzbox.com), and the VizzBox player on your screens. VizzBox is the Data Fiduciary for your personal data under India's Digital Personal Data Protection Act, 2023, and you can reach us at support@vizzbox.com.

The short version

• We collect what we need to run VizzBox, and we use it for that.
• We don't sell personal data, and we don't use it to show you ads.
• We only measure your visits to our website if you say yes.
• The content an organisation puts on its screens belongs to that organisation.
• You can ask us to show you, correct or delete your data at any time.

When you visit our website

Measuring visits, only with your consent. When you first visit vizzbox.com, a banner asks whether we may measure your visit with Google Analytics (through Google Firebase). Nothing is measured unless you say yes. If you do, Google Analytics sets cookies and records things like the pages you look at, roughly where you are (worked out from your IP address), and your device and browser, so we can see which pages are useful. You can change your mind at any time with "Cookie settings" at the bottom of every page. It never runs in organisations' portals or in our staff console, or if your browser sends a "Do Not Track" or "Global Privacy Control" signal.

Prices in your currency. To show prices in rupees or dollars, our server looks up which country your IP address is in, using a database that runs on our own server (from DB-IP). The same lookup decides which version of this policy you see. Your address isn't sent anywhere else for this.

Your choices in your browser. The language you pick and your answer to the measurement question are kept in your browser's local storage, so we don't ask again.

Fonts. The site's typefaces come from Google Fonts, so Google receives your IP address when a page loads.

Logs and error reports. Like most websites, our servers keep short technical logs (IP address, the page requested, browser type) to keep the service running and secure. If something breaks in your browser, the page may send us a report of what went wrong.

The live demo. The demo page plays our own made-up café's screen. Watching it records nothing about you beyond what's described above.

When your organisation uses VizzBox

Your account. Your name, email address, role and preferred language, and your password, which we store only as a secure hash that nobody can read back.

Your organisation. Its name and portal address, the locations and screens you add, and the people you invite.

Your content. The pictures, videos, PDFs, web page links, designs and schedules you add. They're yours: we store and process them only to show them on your screens.

Your screens. Each player sends us what's needed to manage it: the device model, its Android version or browser, screen size, app version, network status and when it last checked in. It also records what it played and when (proof of play), which you can download as reports. On an Android player, someone in your organisation can ask for a screenshot of what the screen is showing; screenshots are kept with your organisation's data.

Payments. When you subscribe, the payment is handled by Razorpay. It collects your card, UPI or bank details; we never see or store them. We keep a record of your plan, your payment status and your billing country.

Emails. We send the emails the service needs: help signing in, invitations, alerts when a screen goes offline, and billing notices. We don't send marketing emails unless you've asked for them.

We process this data to provide the service your organisation signed up for, and for the legitimate uses the Act allows, such as keeping the service secure and meeting our legal obligations.

Who else handles data for us

We use a small number of service providers, only to run VizzBox:

• DigitalOcean hosts our servers, where the data above is stored.
• Google measures visits to our website if you agree (Firebase and Google Analytics), sends update notifications to Android players (Firebase Cloud Messaging), and serves our fonts (Google Fonts).
• Razorpay handles payments in India, and Stripe elsewhere.
• An email delivery service sends the emails described above.

Some of these providers process data outside India. We give each one only what it needs to do its part. We may also disclose data where the law requires us to.

Cookies and browser storage

• Needed for the service to work: in the portal and during sign-up, a session cookie keeps you signed in and a security cookie protects forms. Without them you can't sign in.
• Your choices: your language and your answer to the measurement question, kept in your browser's local storage.
• Measuring visits: Google Analytics cookies, on vizzbox.com only, and only if you said yes.

How long we keep it

• Your account and your organisation's data are kept for as long as your organisation uses VizzBox.
• When an organisation is closed, we keep its data for 30 days in case the closure was a mistake, then delete it, apart from records the law requires us to keep, such as invoices and payment records.
• A copy of your data that you ask to download stays available for a week, then it's deleted.
• Backups and server logs are kept for a limited time and then removed.

Your rights

Under the Digital Personal Data Protection Act, 2023, you can:

• ask what personal data we hold about you, how we use it, and who we've shared it with;
• ask us to correct, complete or update it;
• ask us to erase it, unless the law requires us to keep it;
• withdraw your consent at any time, as easily as you gave it, for example to measuring your visits;
• nominate someone to exercise these rights for you if you can't;
• have a grievance about how we handle your data answered.

An organisation's owner can also download a copy of the organisation's data from the portal, and close the organisation there, which deletes its data as described above.

Write to support@vizzbox.com. We'll answer as quickly as we can, and within the time the law allows. If you're not satisfied with our answer, you can complain to the Data Protection Board of India.

If you use VizzBox as a member of an organisation, that organisation decides much of what's stored about you, such as who is invited. You can ask them, or us.

Children

VizzBox is a tool for businesses and isn't meant for children. We don't knowingly collect personal data from anyone under 18.

Keeping it safe

Passwords are hashed, the website and the portal only work over encrypted connections, each organisation's data is kept separate from every other organisation's, and only the staff who need it can reach it. No system is perfectly secure, so please use a strong password, and tell us at support@vizzbox.com if you notice anything wrong.

Changes to this policy

When we change this policy we'll update the date at the top, and we'll email account owners about any change that matters to them.

Contact

VizzBox, support@vizzbox.com