STARS — Privacy Policy

• Version: 1.1
• Effective date: 16 August 2026
• Last updated: 26 August 2026

Important legal-review notice: This document is a business-ready draft prepared for STARS based on the information supplied by Simplify Planet Labs LLP. Indian privacy and digital-services law is evolving, and the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 have phased commencement dates. SPL should have this document reviewed by a qualified Indian technology and privacy lawyer before publication, and should verify that the wording matches its actual product, contracts, security practices, billing model and third-party services.

1. About this Privacy Policy

This Privacy Policy explains how Simplify Planet Labs LLP (referred to as “SPL,” “we,” “us” or “our”) collects, uses, shares, stores, protects and otherwise processes personal data in connection with STARS — Smart Tanker Activity Recording System (“STARS”), including its website, mobile applications, dashboards, APIs, communications and related services.

SPL’s address is:

A-503, Pristine Grandeur, Wakad Chowk, Sangavi Pune – 411027, Maharashtra, India

For privacy or grievance matters, contact privacy@simplifyplanetlabs.app. For general support, contact support@simplifyplanetlabs.app.

This Policy is intended to be read consistently with applicable Indian law, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and rules made under it, as and when the relevant provisions apply, together with applicable information-technology, contractual and consumer-protection requirements.

2. Who uses STARS

STARS is a software platform for recording and managing water-tanker activities. Its users may include:

• housing societies, commercial premises, institutions and other organisations that procure or receive tanker water (“Consumers”);
• tanker owners, operators, vendors and other water suppliers (“Suppliers”); and
• authorised individuals acting for a Consumer or Supplier, such as administrators, committee members, employees, caretakers, security personnel, drivers or other representatives (“Authorised Users”).

For convenience, Consumers and Suppliers that subscribe to or contract for STARS are referred to as “Customers.”

3. SPL’s role and the Customer’s role

Depending on the context, SPL may determine why and how certain personal data is processed—for example, account, subscription, security and support data. For operational data entered into STARS by or for a Customer, SPL generally processes that data to provide the service on the Customer’s instructions and under the applicable agreement. The Customer remains responsible for having a lawful basis and providing any notices or permissions required when it collects personal data from its Authorised Users, drivers, staff, visitors or other individuals and submits that data to STARS.

Nothing in this section limits an individual’s rights under applicable law or SPL’s independent legal obligations.

4. Personal data and other information we may process

Depending on the features used and the Customer’s configuration, STARS may process the following categories.

4.1 Account and identity data

Names, business or organisation names, roles, usernames, email addresses, mobile numbers, user identifiers, account status and authentication-related information.

4.2 Customer and subscription data

Billing contacts, subscription plan, invoices, payment status, tax-related information, commercial communications and records relating to the Customer’s use of STARS. Payment card or banking information may be processed by an authorised payment provider rather than stored directly by STARS.

4.3 Tanker and delivery data

Vehicle registration numbers, supplier details, tanker capacity, recorded or declared quantity, delivery date and time, entry and exit information, source or destination details, remarks, approvals, rejections and related transaction records.

4.4 Photographs and uploaded files

Delivery photographs are intended primarily to capture the tanker or vehicle as required by the applicable workflow. Depending on where and how a photograph is taken, it may incidentally capture identifiable people, other vehicles, registration numbers, premises or other objects. Users should take reasonable care to avoid capturing unrelated individuals or information where it is not necessary for the delivery record. Where the workflow supports it, a delivery photograph may be accompanied by the date and time it was captured and, where available, the location at which it was taken (see section 4.5).

4.5 Location information

When a delivery photograph is captured, STARS may record the device's geographic location (latitude and longitude) at the time of capture; for a photograph selected from the device's photo library, STARS may also read any location contained in the photograph's own metadata. This location is stored with the delivery record and used to help confirm that a delivery was recorded at the expected place and to support the duplicate-entry, anomaly and possible-fraud indicators described in section 4.7.

Location capture depends on the device or user granting location permission, which is requested through the operating system; a user may decline it or later revoke it through device settings. Declining location does not prevent a delivery from being recorded — the record is simply stored without a captured location (the absence of a location may itself be reflected in the analytical indicators). Location collected in this way is used only for the operational and security purposes described in this Policy; it is not used for advertising, marketing profiles or unrelated tracking. Other features may request device location separately, in each case only after the appropriate notice and permission.

4.6 Device, usage and security information

IP address, device and browser type, operating system, application version, device identifiers, access times, diagnostic data, activity logs, login events, error records and security-related events.

4.7 Audit and analytical information

Changes to records, user actions, timestamps, approvals and other audit-trail information. STARS may also produce duplicate-entry, anomaly, misuse or possible-fraud indicators. These indicators are analytical signals only and do not establish that fraud, misconduct or any legal violation occurred.

4.8 Communications and support data

Messages, support requests, feedback, call or meeting notes, screenshots and other information voluntarily provided when a Customer or user communicates with SPL.

We ask users not to upload sensitive or unrelated personal data that is not necessary for the intended STARS workflow.

5. How we collect information

We may collect information:

• directly from Customers and Authorised Users;
• when a user creates or uses an account, submits a tanker record, uploads a photograph or contacts support;
• from another authorised participant in a Consumer–Supplier workflow;
• automatically from devices, applications, logs and security systems; and
• from service providers or business partners where lawful and necessary, such as authentication, billing or technical-support providers.

If an Authorised User provides personal data about another person, the user and relevant Customer must ensure that they are authorised to do so and that any legally required notice or permission has been provided.

6. Why we process information

We process information for lawful purposes that may include:

• creating, authenticating and administering accounts;
• providing, operating and supporting STARS;
• recording and managing tanker activity and facilitating Consumer–Supplier workflows;
• maintaining audit trails and generating reports;
• verifying the time and location at which deliveries are recorded, and detecting duplicate records, anomalies, misuse and security threats;
• managing subscriptions, billing, taxes and service communications;
• responding to support, privacy and grievance requests;
• securing STARS, preventing unauthorised access and investigating incidents;
• maintaining, troubleshooting, analysing and improving STARS;
• producing aggregated or anonymised insights that do not reasonably identify an individual or Customer;
• enforcing agreements and protecting legal rights; and
• complying with applicable law, lawful requests, audits and regulatory obligations.

Where consent is the applicable legal basis, an individual may withdraw it through the method made available by SPL or by contacting us. Withdrawal does not affect processing already lawfully carried out and may prevent SPL from providing a feature that requires the relevant data.

7. Notices and choices

SPL will provide or facilitate an appropriate notice describing the personal data and purpose of processing where required by applicable law. A Customer may also be required to give notices to its Authorised Users and other affected individuals. Users should review permission prompts and Customer-specific notices before submitting data.

We do not sell personal data. We do not use delivery photographs or operational tanker records for unrelated targeted advertising.

8. Disclosure of information

We may disclose information only as reasonably necessary:

• to the Customer and its authorised administrators and users;
• between a Consumer and Supplier where required by the configured workflow or their commercial relationship;
• to vetted service providers that support hosting, communications, authentication, monitoring, billing, support, security or professional services, subject to appropriate safeguards;
• to an acquirer, investor or adviser in connection with a genuine corporate transaction, subject to confidentiality and applicable law;
• to courts, regulators, law-enforcement bodies or other authorities where required by law or valid process; or
• where reasonably necessary to protect users, SPL, STARS or another person from fraud, harm, security threats or unlawful activity.

Customers control which Authorised Users can access their workspace and should regularly review permissions. Information visible to another participant in a shared workflow may remain in that participant’s legitimate records even if the submitting party later changes or removes its own copy.

9. Data hosting and localisation

STARS is hosted on Google Cloud Platform (“GCP”). SPL has configured the core STARS infrastructure to operate within Google’s Mumbai, India region (asia-south1).

Personal data stored by the core STARS application is stored at rest within India. This includes, as applicable:

• application and transactional records in Cloud SQL for PostgreSQL;
• photographs, uploaded files and documents in Cloud Storage; and
• the application services operated through Cloud Run.

SPL does not intentionally store such personal data at rest outside India as part of the core STARS application infrastructure.

SPL may use service providers for supporting functions such as communications, authentication, monitoring, payments, analytics, diagnostics, support or professional services. Such providers may process limited data from locations determined by their infrastructure and contractual arrangements. SPL will handle such processing in accordance with applicable law and use appropriate contractual, technical and organisational safeguards. If a material change affects the location or manner of storage or processing, SPL may update this Policy and provide notice where required.

10. Data retention and deletion

For an active Customer, SPL retains account and operational data for as long as reasonably necessary to provide STARS, fulfil the purposes described in this Policy and meet contractual or legal obligations.

For a Customer that terminates, deregisters or remains inactive, SPL will ordinarily delete or anonymise Customer data within 365 days after termination or prolonged inactivity. Data may be deleted earlier when its purpose is no longer being served and retention is not otherwise necessary. SPL may retain particular records for longer where required or permitted for legal compliance, tax or accounting obligations, dispute resolution, fraud prevention, security investigations, enforcement of agreements, backup cycles or a documented contractual requirement.

Where a Customer controls operational data, an individual’s deletion request may need to be directed to that Customer. Deletion from active systems may not immediately remove data from secure backups; backup copies will be isolated and expire or be overwritten according to the applicable backup cycle, unless preservation is legally required.

11. Security

SPL uses reasonable and appropriate technical and organisational safeguards designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. These may include access controls, authentication, logging, encryption where appropriate, backups, monitoring and incident-response measures.

No system is completely secure. Customers and users must protect credentials, use appropriate device security, keep contact information current and promptly report suspected unauthorised access to support@simplifyplanetlabs.app.

Where required by applicable law, SPL will take appropriate steps concerning a personal-data breach, including notification to affected persons or authorities.

12. Rights and requests

Subject to applicable law and its commencement and exemptions, an individual may have rights to:

• obtain information about the processing of their personal data;
• access or obtain a summary of relevant personal data and processing activities;
• correct, complete or update personal data;
• request erasure where retention is no longer necessary or lawful;
• withdraw consent where processing is based on consent;
• raise a grievance; and
• nominate another individual to exercise rights in circumstances provided by law.

To make a request, email privacy@simplifyplanetlabs.app with enough information for SPL to verify identity, locate the relevant account or Customer and understand the request. SPL may ask for reasonable verification and may refer an operational-data request to the relevant Customer. SPL will respond within the period required by applicable law.

Requests should be genuine and must not impersonate another person, suppress material information or be frivolous or abusive.

13. Children

STARS is intended for use by organisations and authorised adults in connection with tanker operations. It is not directed to children, and SPL does not knowingly seek to create accounts for children. Customers must not authorise a child to operate STARS or submit a child’s personal data unless legally permitted and all required verifiable consent and safeguards are in place. If SPL learns that a child’s personal data was submitted contrary to this section, it may restrict or delete that data as appropriate.

14. Grievance mechanism

Privacy questions, rights requests and grievances may be sent to:

Privacy and Grievance Contact Simplify Planet Labs LLP A-503, Pristine Grandeur, Wakad Chowk, Sangavi, Pune – 411027, Maharashtra, India Email: privacy@simplifyplanetlabs.app

Please include the account or organisation name, a description of the issue and relevant dates. SPL will acknowledge and address grievances within the timeframe required by applicable law. Where available under applicable law, an individual may pursue a complaint before the competent authority after first using SPL’s grievance mechanism.

15. Third-party links and services

STARS may link to or integrate with third-party services. Their independent processing is governed by their own terms and privacy notices. SPL is not responsible for a third party’s separate practices, but will exercise reasonable diligence over providers processing data on SPL’s behalf.

16. Changes to this Privacy Policy

SPL may update this Policy to reflect legal, technical or service changes. The revised version will state its effective date. Where a change is material or additional notice or consent is required, SPL will use an appropriate method to notify affected users. Continued use after an update will not replace consent where applicable law requires fresh consent.

17. Contact

• Privacy, personal-data rights and grievances: privacy@simplifyplanetlabs.app
• General service support: support@simplifyplanetlabs.app