KavachPlus Privacy Policy

Version kavachplus-play-v1 · Effective 6 October 2026 · Updated 11 October 2026 · Applies to the KavachPlus Android app (in.digikavachplus.app) and its online services.

Who we are

KavachPlus is provided by DIGIKAVACH TECHNOLOGIES PRIVATE LIMITED, Bangalore 560094, India ("DigiKavach", "we"). We decide why and how your personal data is processed. Contact: support@digikavach.net, support line +91 99000 10895. Grievance Officer: K Phaneendra Kumar, Founder & CEO, DIGIKAVACH TECHNOLOGIES PRIVATE LIMITED, ceo@digikavach.net.

What KavachPlus does

KavachPlus helps you spot and respond to digital fraud: it checks links, QR codes, files, apps, messages and incoming callers for scam risk, guides you through reporting a fraud, and offers a fraud-safety assistant (KavachBot). It is not a government service and does not register police complaints. It never contacts your bank for you: Block & freeze only prepares the calls, SMS and e-mails, and you make or send them yourself.

Personal data we process and why

• Mobile number (required): to sign you in with a one-time password (OTP) through Google Firebase Authentication and to check that the number belongs to a SIM in your phone. On our servers the number is used for sign-in as a keyed hash. We also keep an encrypted copy with your account to run the referral programme; only authorised DigiKavach staff can read it. If you ask for an insurance call-back, the number is also used for that (below).
• Profile: your name, optional email address, optional profile photo (a small thumbnail), and the state and PIN code you choose, to personalise the app and show region-specific guidance.
• Device and installation: a cryptographic key created on your phone, a random installation ID, the app version and the Android version, to secure your account to this installation and to keep you signed in. We do not collect the device model, IMEI or the advertising ID.
• Notifications from apps you select (only if you turn on message protection and grant Notification access): the text of notifications from the messaging apps you choose is analysed on your phone for scam patterns. The raw text is not sent to us; for a flagged message we receive only a risk score, the warning signals, the name of the app it came from and a non-reversible fingerprint. If you turn on community reporting, that fingerprint is also reported anonymously so that other users can be warned.
• Incoming caller numbers (only if you make KavachPlus your call-screening app): each incoming caller's number, including numbers saved in your contacts, is sent to our server and checked against DigiKavach's caller-reputation service (caller.digikavach.net). Numbers you check yourself in Check a Caller are checked the same way. Numbers you report as spam are also sent there, without your identity, to warn other users. Your contact names are never sent.
• Contacts (only if you allow it): read on your phone to show the saved name of a caller. Contacts are not uploaded.
• Installed apps: the app list and the permissions those apps hold are checked on your phone to warn you about risky apps, and the full list is not uploaded. The names of the messaging apps you choose for message protection are saved with your settings so they can be restored, and the app a flagged message came from appears in your scan history.
• Microphone (only when you tap to speak): converted to text by your phone's speech service (usually Google's) for KavachBot or voice commands; that service may process your voice online. We do not record, receive or store audio.
• Camera, photos and files (only when you choose to scan or attach): QR codes, files and screenshots you choose are checked for risk on your phone (for an app file, only its fingerprint is checked online); evidence you attach to a fraud report is uploaded and stored encrypted.
• Scans, reports and fraud cases: links, numbers and items you check, and fraud reports you create (for example amount, date, the last four digits of an account, and transaction references, stored encrypted), to show your history, help you report to the authorities and improve scam detection.
• Emergency Block & freeze (only when you use it): to help you after a fraud, the app drafts letters to your bank (freeze and dispute) and to the bank that received the money (hold, or lien), using the details you enter or confirm. These are your name and mobile number, the banks, the transaction dates, amounts and references, the receiving account, IFSC and holder name, your cyber-crime (1930 / NCRP) acknowledgement number, and any documents you choose to attach. The letters and copies of your attachments are prepared on your phone and are not sent to our servers. Nothing is sent until you press Send in your own e-mail app, from your own e-mail address, or in your own SMS app for the bank's block command. Every e-mail also goes as a blind copy (BCC) to support@digikavach.net, which you see before sending. We keep that copy, with its attachments, as the record of your case and to help you if the bank asks for more, and authorised DigiKavach staff can read it. SMS block commands go from your SIM straight to your bank, and we do not receive them. The list of bank contacts is downloaded from our server; no personal data is sent to get it.
• KavachBot questions: questions you type are sent to our server and answered from approved KavachKnowledge answers. If no approved answer matches, the question, with common identifiers masked, is sent to an AI service (Google Gemini, or Groq as a backup) to write the answer, which the app marks as written by AI. If you accept the question-review notice, the latest question (with common identifiers automatically removed) may be reviewed by authorised DigiKavach staff for up to 30 days to improve answers. If you tap Report under an answer, we receive that answer, the question it answered, the reason you chose and any comment you add, with common identifiers masked and without your account details; authorised DigiKavach staff review it to fix harmful or wrong answers, and it is deleted after 180 days.
• Payments: your KavachPlus subscription is paid through Google Play billing (operated by Google) or through Cashfree Payments. We receive the purchase or order status, the plan, the amount and the subscription's expiry date; we never receive or store your card, UPI or bank details.
• Insurance call-back (only if you ask): your registered mobile number is stored encrypted so that the DigiKavach insurance team can call you about the plan you chose. You can withdraw this at any time in Profile → Privacy & data, which erases the stored number.
• Consents and security logs: records of the permissions and policies you accepted, sign-in events and security audit logs, to prove consent and protect accounts.

Legal basis

We process personal data with your consent, which you give in the app for each optional feature, and where needed to provide the service you asked for, to keep it secure, and to meet legal obligations under Indian law, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

Who we share data with

We do not sell your personal data and do not use it for third-party advertising. We share it only with service providers who process it for us under contract: Google Firebase (sign-in and OTP), Amazon Web Services in the Mumbai region (hosting and storage), Google Workspace (our e-mail, including the support mailbox that receives Block & freeze copies), Google Play billing (Google) or Cashfree Payments (subscription payments, depending on how you subscribe; we receive only the purchase status and expiry, never your card, UPI or bank details), AI providers used by KavachBot (Google Gemini and Groq) to answer questions that have no approved answer, and Google ML Kit, which scans QR codes and text on your phone and sends Google usage and performance data (not the images) to keep the service working. We may disclose data when required by law or a lawful request from a government authority.

Security

Data is encrypted in transit (HTTPS with certificate pinning) and sensitive fields are encrypted at rest. Access by DigiKavach staff is restricted and logged.

Retention

We keep your data while your account is active. When you delete your account, we delete or anonymise your personal data within 30 days, except records we must keep by law (for example payment and tax records, kept for 8 years) and security or consent logs needed to defend legal claims (kept for 3 years). Block & freeze e-mail copies sent to support@digikavach.net are kept for 3 years from the date you send them, so that we can help with your case and defend legal claims; you can ask us to delete them earlier by e-mailing support@digikavach.net, unless the law requires us to keep them. Scam fingerprints and anonymised caller reputation that no longer identify you may be kept to protect other users.

Your rights and choices

You can view and change your profile, turn optional features and permissions off at any time in the app or in Android settings, withdraw consents in Profile → Privacy & data, and delete your account (see how to delete your account). You may also request access, correction or erasure of your data, or nominate a person to exercise your rights, by emailing support@digikavach.net. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Children

KavachPlus is not intended for anyone under 18. We do not knowingly collect data from children.

Changes

We will tell you in the app before a material change to this policy takes effect.