Privacy notice
Plain words about what we collect from partners, why, and the rights you keep.
Who gives this notice
This notice is given by David Carealle Digital Services Pvt. Ltd. (CAREALL Labs and Innovations), Tirunelveli, Tamil Nadu — the company that runs the CAREALL Partner Programme and decides how the data described here is used.
What we collect
When you apply or enrol: your name, your gender if you give it, your mobile number and your email address; your confirmation that you are 18 years of age or older; on the Partner sign-up, your town and district; the code of the member, Channel Partner or Relationship Manager whose link you used or whose code you give; depending on the tier you apply for, the area you will cover, whether you apply as an individual, a proprietorship or a firm (and, for a firm, its entity type), and business details such as your firm name, registration or UDYAM number, GST number, business and office address, qualification and experience, with a business registration certificate or similar if you upload one; for a Master Partner, your current occupation or business if you give it; whether and when your mobile number or your email was confirmed with a one-time code; and when you tick each box and the language the form was shown in. To stop misuse, when you apply we also keep scrambled codes of your mobile number, your email and your connection’s IP address, made with a secret key, and, if you upload a document on the application form, your IP address itself with the upload. Your KYC is not asked for when you apply: once you join, you give it once, inside the partner portal — your PAN, the last four digits of your Aadhaar number, your date of birth, residential address and PIN code, your settlement bank details (account holder name, account number, IFSC, bank and branch), an alternate mobile number (required — a family member’s or your office number is fine), one reference if you choose to give one (their name, how you know them and their mobile number), your nominee’s name and mobile number if you name one, and the documents you upload with it (your PAN card, a bank proof and, if you choose, another photo ID). When you use the portal: your leads, applications and activity within the programme; when your mobile number and your email were last confirmed with a one-time code; and whether you chose a code to your mobile when you sign in.
Why we collect it — and nothing else
Four purposes only: verifying your identity and eligibility under the Partner Programme; executing and administering your enrolment; crediting and paying your earnings, including TDS compliance; and statutory compliance and audit. We do not sell your data, and we do not use it for any purpose not listed here.
Aadhaar and bank account
We do not collect your full Aadhaar number — only its last four digits, so head office can match you on the verification call. We do ask for your full bank account number, because your earnings are paid into it. It is encrypted before it is stored, using AES-256-GCM, with the key held outside the database, and is never shown in full in the portal; the partners above you never see it at all. The full number can be read only by authorised head-office staff, and every such reading is written to an audit record that cannot be edited or deleted.
Who sees what
You see your own orders and earnings in the portal; for anything else we hold about you, ask head office (see Contact below). The partners above you see your name, member ID, status, joining date and order totals, and, for each order that earns them a share, the client’s name, town, service and order value — never the client’s phone number or notes. Your Relationship Manager, if head office assigns you one, sees your name, mobile number and area and the orders they look after, and can open a client’s phone number and notes on such an order; every such opening is recorded. A Relationship Manager who looks after one of your orders also sees your name and mobile number. Client data belongs to and stays with the company. Head office sees everything needed to run the programme.
CAREALL Cards
CAREALL Cards is the company’s own service for making shops’ digital cards, and one of the programme’s products. The first time you open CAREALL Cards from the portal, your name, mobile number and member ID are copied into CAREALL Cards to make your Cards account; or, if CAREALL Cards already has a Partner account with your mobile number or your member ID, your name and member ID are kept beside that account while head office checks whether it is yours, and no longer than the period below. Each time you open it from the portal, the portal sends CAREALL Cards your name, mobile number, member ID, tier and membership status to sign you in, and a changed mobile number is updated there. Your CAREALL Cards sales are kept in CAREALL Cards under your member ID; the portal reads them from there when you open Cards sold, and keeps no copy. The partners above you see only the totals of your Cards sales — how many cards and renewals, and their value — never the shops’ names. If head office pauses or removes you, the portal sends CAREALL Cards your member ID and mobile number, so that it ends your Cards sign-ins. What is copied or kept in CAREALL Cards for you in this way is kept while you are a member and for up to one year after you leave, then erased or made anonymous; the invoices and payment records of your Cards orders are kept as tax law requires. What CAREALL Cards itself keeps when you use it — your sign-ins, the shops’ pages, your orders, payments and invoices — is in its own privacy notice, on the CAREALL Cards site.
How it is protected
Data lives in access-controlled systems with row-level security enforced by the database itself, and is encrypted in transit. We keep only the last four digits of your Aadhaar number, not the full number. Your full bank account number is additionally encrypted at rest. Uploaded documents are held in private storage that is not readable from the internet; head office, or the Relationship Manager who checks your KYC first, opens one through a link that expires in sixty seconds. Privileged actions — reading your full bank account number or opening one of your documents — are written to an append-only audit record that cannot be edited or deleted.
Who processes it for us
Two service providers handle the data for us, under contract and only on our instructions: Vercel hosts the website and the portal, and Supabase runs the database and the private storage for uploaded documents. Messages between you and head office go over WhatsApp, under WhatsApp’s own terms. When you apply, your mobile number is confirmed with a one-time code: the one-time code that confirms your mobile number is sent to it by Meta’s WhatsApp Business Platform, which receives your mobile number and the code only to deliver that message. Only if that code cannot reach you is a code sent to your email instead, by the company’s email service provider, which receives your email address and the code only to deliver it; your mobile number is then confirmed later, inside the partner portal. The same kinds of code confirm your mobile number and email inside the portal.
Protection against misuse
To stop automated misuse, the application, enquiry, document-upload and password-reset forms count how many requests arrive within a short time — from each connection (its IP address) and, on the application, enquiry and password-reset forms, for each mobile number or member ID; head office’s own password check counts attempts for each staff account. The addresses, numbers and IDs are kept only as scrambled codes made with a secret key, in a table that only our server can read; they are used for nothing else and are deleted within two days. When you upload a document on the application form, the connection’s IP address is kept with the upload link until your application is sent; if it is never sent, the upload and the address are deleted after 24 hours. When you ask for a sign-up code, we keep a scrambled copy of the code and of your mobile number — never the code or the number as typed — for the ten minutes the code can be used, and every such record is deleted after 24 hours. Our hosting providers also keep short-lived technical logs of requests, which include the IP address, to keep the service running and secure.
How long we keep it
If your application is not approved, we erase it — with any documents you uploaded — one year after the decision. Proof documents can be uploaded only after you give your data consent on the form; an upload that is not attached to an application you send is deleted after 24 hours, and you can delete it sooner with Remove. The scrambled codes of your mobile number and IP address are kept for up to two days; the IP address kept with an upload is deleted when you send the upload with your application, or together with the upload. While you are a member, we keep what is needed to run your membership. After you leave, we erase within one year everything that was needed only for that: the last four digits of your Aadhaar number, full bank account number, account holder name, IFSC and branch, phone, email, address and town, date of birth, nominee, references and uploaded documents. We keep your name, member ID, PAN, the district you worked in, the last four digits of your bank account, and the record of every earning, payment and TDS deduction — each payment record also keeps the account holder name, masked account and IFSC it was paid to — for eight financial years after the year it relates to, because company and tax law require it (Companies Act 2013, section 128(5)); then those are erased too. Records of who opened your details are kept for at least one year (Digital Personal Data Protection Rules, 2025), and for as long as the payment records they belong to. Since 2026, records of who opened or changed your details record what was done, not your details — at most the last four digits of a number. What is copied or kept in CAREALL Cards for you is kept as “CAREALL Cards” above says.
If you send us an enquiry
If a partner sends you our enquiry link and you use it, we collect your name or business name, mobile number, town, the service you asked about and anything you write to us, together with the partner whose link it was. We use it to contact you about that enquiry. Head office sees your enquiry first. The partner whose link you used sees your name, town and the service you asked about, and whether the enquiry became an order or was closed (with head office’s reason) — not your mobile number or what you wrote. If it becomes an order, that partner sees your name, mobile number and what you wrote; the partners above that partner see your name and town; and the Relationship Manager who looks after the order sees your name and town and can open your mobile number and what you wrote — every such opening is recorded. No other partner sees it. If you do not become a client, we erase it one year after you sent it.
If a partner books you as a client
If a partner books you as a client, we receive from that partner your name or business name, mobile number, town, the service you need and anything the partner notes about the work. We use it to quote, deliver and bill that service, to contact you about it, and to check whether another partner has already brought you to us. Head office sees all of it. The partner who booked you sees what they entered; the partners above that partner see your name, town, the service and its value — never your mobile number or the notes; and the Relationship Manager who looks after the order sees your name and town and can open your mobile number and the notes — every such opening is recorded. No other partner sees it.
Your rights — DPDP Act 2023
You may access, correct, or seek erasure of your data; withdraw consent at any time (withdrawal is as easy as giving it, though it may make continuation in the programme impossible); nominate a person to exercise your rights; and complain to the Data Protection Board of India. To correct your bank account, IFSC, branch, account holder, nominee, PAN or address, use “Correct or erase your data” in the portal or message head office; we call you on the number on record before changing anything. Erasure on request ends your membership and keeps only what company and tax law require (see How long we keep it).
Contact
For any request, question or withdrawal: info@careall.org, or +91 98421 10180 on WhatsApp. We respond within a reasonable time, normally two working days.