KarmaVerse

Privacy Policy

Platform: KarmaVerse (Android application, iOS application, website, web application, and related digital interfaces) Operated by: 3R ZeroWaste Pvt. Ltd. Website: https://karmaverse.earth Support Email: cto.team@0waste.co.in

Version: 2.3 Effective Date: July 1, 2026 Last Reviewed: July 1, 2026

1. Introduction

3R ZeroWaste Pvt. Ltd. ("3R ZeroWaste," "Company," "we," "us," or "our") operates KarmaVerse, an Environmental, Social and Governance (ESG) rewards platform available as an Android application, an iOS application, a website, a web application, and, where made available in the future, a desktop application, together with any other digital interfaces, portals, or APIs operated by 3R ZeroWaste (collectively, the "Platform"). KarmaVerse enables users to earn KarmaCoinXP by recycling waste, scanning QR codes, participating in sustainability campaigns, completing ESG activities, engaging with the community, and, where enabled, referring other users. KarmaCoinXP may subsequently be redeemed for rewards offered by our partner organizations.

3R ZeroWaste is the Data Fiduciary (under the DPDP Act) and data controller (under the GDPR and UK GDPR, where applicable) responsible for your Personal Information. This Privacy Policy is drafted primarily for users located in India and is governed by Indian law. Where a user is located in the European Economic Area, the United Kingdom, or California, we additionally apply the relevant provisions of the GDPR, UK GDPR, or CCPA described in this Policy, as applicable to that user.

This Privacy Policy explains how we collect, use, disclose, store, and protect information about you when you access or use KarmaVerse, including our wallet, user profile, campaigns, QR verification, notifications, leaderboards, reward marketplace, Agent Portal, and Admin Portal features (collectively, the "Services"). It also explains the choices and rights available to you regarding your information.

By creating an account, downloading the KarmaVerse application, or otherwise accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Services.

This Privacy Policy applies to all users of the Platform, including individuals using the consumer-facing app and web platform, as well as authorized personnel accessing the Agent Portal or Admin Portal in connection with their role (see Section 9.1).

KarmaCoinXP is not currency. KarmaCoinXP is a loyalty/rewards credit issued solely for use within the Platform. It has no cash value in itself, is not transferable between users for consideration, and does not by itself constitute a "prepaid payment instrument," wallet, or similar financial product regulated by the Reserve Bank of India or any other financial regulator. KarmaCoinXP may be redeemed for rewards made available through the Platform's reward marketplace, which may, where we enable this feature, include a monetary payout in Indian Rupees disbursed to a bank account or UPI ID you provide (see Section 3.9 and Section 4, and our Terms of Service for the specific conditions governing monetary redemption).

This Privacy Policy is framed in accordance with, and is intended to comply with, the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and rules made thereunder, the Google Play Developer Policy, the Apple App Store Review Guidelines, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and, where applicable to users located outside India, the principles of the General Data Protection Regulation ("GDPR") and the UK General Data Protection Regulation ("UK GDPR").

2. Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

Term Meaning
Personal Data / Personal Information Any data or information about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act.
Processing Any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, or erasure.
Data Principal The individual to whom the Personal Data relates (i.e., the "user" under this Policy).
Data Fiduciary 3R ZeroWaste Pvt. Ltd., which determines the purpose and means of Processing of Personal Data.
Consent A freely given, specific, informed, and unambiguous indication of the Data Principal's agreement to the Processing of their Personal Data.
Consent Manager A person registered with the Data Protection Board of India through whom a Data Principal may give, manage, review, or withdraw consent, where such a mechanism is made available on the Platform.
Sensitive Personal Data Certain categories of Personal Data — including financial and wallet information and precise location — that we treat with enhanced safeguards as a matter of internal policy, consistent with the standard of care expected under the Information Technology Act, 2000 and its rules. The DPDP Act does not itself create a separate statutory category of "sensitive" data; it applies a uniform standard of protection to all Personal Data, with specific additional protections for children's data (see Section 15).
KarmaCoinXP The reward points/credits earned by users through qualifying activities on the Platform, redeemable per the Platform's redemption rules.
Agent Portal The interface used by authorized field agents or partner personnel to verify recycling activity, QR scans, or campaign participation.
Admin Portal The interface used by authorized 3R ZeroWaste personnel to administer, monitor, and manage the Platform.
Data Protection Board The Data Protection Board of India, established under the DPDP Act, which receives complaints and enforces compliance with the DPDP Act.
Sub-processor A third-party service provider engaged by us to Process Personal Data on our behalf, as described in Section 8.
Cross-Border Transfer The transfer of Personal Data to a country or territory outside India for storage or Processing, as described in Section 16.

3. Information We Collect

We collect information in the following categories:

3.1 Personal Information

3.2 Technical Information

3.3 Location Information

3.4 Information Collected via App Permissions

With your permission, the KarmaVerse app may access:

You may grant or deny these permissions through your device settings. Denying certain permissions may limit your ability to use specific features (for example, QR scanning requires camera access).

3.5 Activity Information

You earn KarmaCoinXP based on your activity on the Platform (such as recycling, QR verification, and campaign participation). Depending on the redemption option you choose, KarmaCoinXP may later translate into a monetary payout — see Section 3.9 and our Terms of Service for how this works.

3.6 Information You Provide Voluntarily

Information you submit when contacting customer support, participating in surveys, providing feedback, or communicating with us through any channel.

3.7 Biometric Data

We do not collect, process, or store any biometric data (such as fingerprints, facial recognition data, or voiceprints) through the Platform. The Camera permission is used solely to scan QR codes and, optionally, to capture a profile photograph — it is not used for facial recognition or any biometric identification purpose.

3.8 Which Categories Are Treated as Sensitive

Of the categories above, we treat your precise location (Section 3.3), your wallet/transaction information (Section 3.5), and your financial and payout information (Section 3.9) as Sensitive Personal Data under Section 2, and apply the enhanced safeguards described in Section 10 to that data specifically.

We do not knowingly collect more Personal Information than is reasonably necessary to provide and improve the Services.

3.9 Financial and Payout Information

Where you choose to redeem KarmaCoinXP for a monetary payout (see Section 4 and our Terms of Service), we collect the following financial information solely to process that payout:

When we collect it. We do not collect this information at account registration or at any other time by default. We collect it only if and when you initiate a redemption or payout request that requires it.

Why we collect it. This information is used exclusively to process payouts to you through our payment processor, RazorpayX (see Section 8.3). We do not use your financial information for marketing, analytics, profiling, or any purpose other than processing the payout you requested.

Sharing. Your financial information is shared only with our payment processor for the purpose of completing your payout. We do not sell this information, and we do not share it with any other third party except where required by law (see Section 9).

Verification. We, or our payment processor, may verify the bank account or UPI details you provide before processing a payout, and may reject a payout request if the details provided are invalid, incomplete, or cannot be verified. See our Terms of Service for the consequences of providing invalid payout details.

4. How We Use Information

We use the information we collect for the following purposes:

  1. Account creation and management — to register, verify, and maintain your account.
  2. Authentication — to verify your identity through OTP, email, Google Sign-In, Apple Sign-In, or Facebook Sign-In (see Section 8.2).
  3. Fraud prevention and security — to detect, investigate, and prevent fraudulent, abusive, or unauthorized activity, including duplicate account creation or manipulation of QR verification.
  4. QR verification — to validate genuine recycling and campaign activity.
  5. Wallet management — to accurately track, credit, and debit KarmaCoinXP.
  6. Reward redemption — to process redemption requests with partner organizations, including, where you choose a monetary redemption option, processing a payout using the financial information described in Section 3.9.
  7. Notifications — to send transactional alerts, OTPs, campaign updates, and reward-related communications.
  8. Customer support — to respond to your queries, complaints, and support requests.
  9. Analytics and performance improvement — to understand usage patterns and improve the Platform's features, stability, and user experience.
  10. Security monitoring — to protect the integrity of our systems and data.
  11. Legal and regulatory compliance — to comply with applicable laws, respond to lawful requests from authorities, and enforce our Terms of Service.

We do not use your Personal Information for purposes incompatible with those disclosed in this Policy without obtaining your fresh consent, where required by law. We do not sell your Personal Information, and we do not use it for cross-context behavioral advertising. See Section 13 for the specific rights this gives California residents.

5. Legal Basis for Processing

We Process your Personal Data on one or more of the following legal bases, consistent with the DPDP Act and, where applicable, GDPR principles:

6. Consent

By registering on KarmaVerse, you provide consent for the collection and Processing of your Personal Information as described in this Policy. Where required under the DPDP Act, we will present you with a clear notice, in plain language, at or before the point of collection, describing the Personal Data being collected and the purpose of such collection.

You may:

If we make a Consent Manager available on the Platform, you will also be able to give, manage, review, and withdraw consent through that mechanism, consistent with the DPDP Act.

Please note that withdrawing consent for certain essential Processing activities (such as OTP-based authentication) may result in your inability to access or use core features of the Platform.

7. Cookies & Tracking Technologies

The KarmaVerse web platform uses cookies and similar tracking technologies to operate effectively and to enhance your experience. The mobile application may use equivalent device-based identifiers and local storage mechanisms for similar purposes. These include:

Cookie/Identifier Type Duration Purpose
Session cookie First-party, essential Session (deleted on logout or browser close) Keeps you logged in while navigating the web platform
Authentication token First-party, essential Up to 30 days Verifies your identity and maintains a secure session
Analytics identifier (Firebase Analytics) First/third-party, analytics Up to 14 months Understands app and web usage to improve the Platform
Preference cookie First-party, functional Up to 12 months Remembers your language and display preferences

You can control or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the web platform, including your ability to remain logged in.

8. Third-Party Services

We work with trusted third-party service providers to operate and improve the Platform. These providers Process limited categories of information strictly for the purposes described below and are contractually or otherwise bound to handle your information responsibly.

8.1 Cloud Infrastructure

KarmaVerse uses a trusted cloud infrastructure provider, Amazon Web Services (AWS), to host, process, and secure the Platform. Specific services used include AWS S3 (object storage), AWS CloudFront (content delivery network), and AWS SES (transactional email delivery), supported by cloud hosting, storage, networking, backups, monitoring, and security services on AWS. These providers offer enterprise-grade infrastructure that helps ensure the availability, reliability, and protection of your information.

We implement appropriate technical and organizational safeguards when storing and processing Personal Data on these platforms, including encryption in transit and at rest, access controls, monitoring, and regular security practices.

8.2 Current Third-Party Services

Service Information Shared Purpose
Firebase Authentication (Google) Mobile number, email, authentication tokens To authenticate and securely sign you into your account
Firebase Cloud Messaging (Google) Device token, notification content To deliver push notifications (rewards, campaigns, alerts)
Firebase Analytics (Google) Device information, usage/interaction data To understand app usage and improve the Platform
Firebase Crashlytics (Google) Device information, crash logs, app version To identify, diagnose, and fix technical issues
Google Sign-In Name, email, profile information from your Google account Account registration and login using your Google account
Apple Sign-In Name, email (or Apple-relay email), authentication token Account registration and login using your Apple ID
Facebook Sign-In (Meta) Name, email, public profile information from your Facebook account Account registration and login using your Facebook account
Amazon Web Services (AWS) Application data, backups, infrastructure logs Cloud infrastructure, storage, networking, monitoring, and disaster recovery
AWS S3 Uploaded files (e.g., profile photos), backups, static assets Object storage for file uploads, backups, and static assets
AWS CloudFront (CDN) Cached static content, IP address (via edge/CDN logs) Content delivery network to serve app and web assets with low latency
AWS SES Email address, email content To send transactional and account-related emails
Supporting Cloud Infrastructure (hosting, storage, networking, backups, monitoring, and security services on AWS) Application code, configuration data, and operational logs To deploy, secure, and operate backend infrastructure
MapMyIndia (Mappls) APIs Approximate/precise location data To identify nearby recycling centers and provide location-based services
Fast2SMS / MSG91 (SMS Gateway Providers) Mobile number, OTP To deliver OTPs and transactional SMS alerts

For reference, the privacy policies of our principal processors are available at: Google — policies.google.com/privacy; Amazon Web Services — aws.amazon.com/privacy; MapMyIndia (Mappls) — mappls.com/privacy.

8.3 Planned Third-Party Services (Future Releases)

The services listed below are not currently active and do not currently collect or receive any information. They are planned for introduction in a future release. If you choose to use these features once they become available, we will collect and share the information indicated below for the stated purpose. We will update this Policy before any of these services become active in a manner that materially changes how your data is Processed:

Service Anticipated Information Shared Anticipated Purpose
Google Maps Location data Enhanced mapping and navigation features
RazorpayX (Payout Rail) Name, contact details, bank/UPI details, transaction details To process reward payouts and redemptions securely — RazorpayX is used for disbursing payouts to users, not for accepting payments from users
Google Analytics Usage and device data Deeper analytics on Platform usage
Mixpanel Usage/event data Product analytics and feature optimization

MapMyIndia (Mappls) (see Section 8.2) is our current mapping and location provider. Google Maps is a planned Version 1.0 feature that, if introduced, would supplement — not replace — Mappls, unless we update this Policy to reflect a change in provider.

Monetary redemption via RazorpayX. We expect to make a monetary redemption option available on or after August 1, 2026, subject to platform readiness and operational testing. This date is an expectation, not a guarantee, and we will update this Policy before this feature becomes active if doing so materially changes how your data is Processed.

Payment processing dependencies. Once active, payouts may be processed through RazorpayX's automated system or, during initial rollout, manually by our team. Payout timelines may be affected by factors outside our control, including delays at banks, UPI infrastructure, or our payment processor, and we do not guarantee a specific payout timeline. See our Terms of Service for further conditions governing payouts.

8.4 Referral Program

Where the referral program is enabled, if you refer another individual to KarmaVerse, we collect the referred individual's name and mobile number or email (as provided by you) solely to send them an invitation to join the Platform and to attribute the referral for KarmaCoinXP purposes. Similarly, if you are referred by another user, that user's identity may be visible to you as the "referrer" on your account, and your name/username may be visible to them once you successfully register. Please only refer individuals who have consented to being contacted by you for this purpose.

8.5 Google Play Data Safety / App Store Privacy Nutrition Label

We strive to ensure that our Google Play Data Safety disclosures and Apple App Store Privacy Nutrition Labels remain accurate and consistent with this Privacy Policy. If any discrepancy is identified, we will promptly update the applicable disclosure.

9. Sharing of Information

We may share your information in the following circumstances:

  1. With third-party service providers listed in Section 8, strictly for the purposes described.
  2. With partner organizations for the purpose of fulfilling reward redemptions you have requested (limited to information necessary to process the redemption, such as name and contact details).
  3. With Agent Portal users — authorized field agents may access limited activity information (e.g., QR scan status) necessary to verify recycling or campaign participation.
  4. With Admin Portal users — authorized 3R ZeroWaste personnel may access account and activity information strictly for Platform administration, support, and fraud prevention.
  5. For legal reasons — where disclosure is required to comply with applicable law, a court order, or a valid request from a government or regulatory authority; to enforce our Terms of Service; or to protect the rights, property, or safety of 3R ZeroWaste, our users, or the public.
  6. In connection with a business transaction — such as a merger, acquisition, restructuring, or sale of assets, subject to appropriate confidentiality safeguards.
  7. With your consent — for any other purpose disclosed to you at the time of collection or with your explicit agreement.

We do not sell Personal Information, and we do not share Sensitive Personal Data with third parties for marketing or advertising purposes without your explicit, separate consent.

9.1 Third-Party Sign-In and Portal Personnel Data

Google Sign-In, Facebook Sign-In, and Apple Sign-In are available authentication methods on the Platform. If you choose to use any of these sign-in methods, we will receive only the information you authorize the respective platform to share with us at the time of login — typically your name, email address, and public profile information. We will not receive or store your Google, Facebook, or Apple account password. You will be able to revoke KarmaVerse's access to any of these accounts at any time through that platform's own account settings, though doing so may require you to use an alternative sign-in method (such as mobile OTP) to continue accessing your KarmaVerse account. We will update this Policy before any material change to how data is Processed through these sign-in methods.

If you choose to use Apple Sign-In, Apple may provide a private relay email address instead of your actual email address, at your choice. We will use whichever email address Apple provides to us in the same manner described in this Policy, and we do not attempt to determine your actual email address if you choose to use Apple's private relay service.

Authorized personnel who access the Agent Portal (e.g., field verification agents) or the Admin Portal (e.g., 3R ZeroWaste employees) also have their own account and activity data (such as login credentials, name, and action logs) collected and Processed by us for the purpose of operating and securing those portals. This Privacy Policy applies to such personnel in their capacity as Platform users, in addition to any separate employment or contractual agreements governing their engagement with 3R ZeroWaste.

10. Data Security

We implement reasonable technical and organizational security measures designed to protect your Personal Information, including:

No method of transmission or electronic storage is completely secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials and for promptly notifying us of any unauthorized use of your account.

10.1 Data Breach Notification

In the event of a Personal Data breach that is likely to compromise the confidentiality, integrity, or availability of your Personal Information, we will:

We will also take prompt remedial action to contain and investigate any such breach.

11. Data Retention

We retain your Personal Information only for as long as necessary to fulfill the purposes described in this Policy. Our retention periods are as follows:

Once the applicable retention period expires, we securely delete, anonymize, or aggregate your Personal Information such that it can no longer be used to identify you.

12. User Rights

Subject to applicable law, including the DPDP Act, you have the following rights in relation to your Personal Information:

To exercise any of these rights, please contact us at cto.team@0waste.co.in. We may need to verify your identity before processing certain requests. We will acknowledge your request within 7 days and respond substantively within 30 days of receipt. Where a request is complex or we receive a high volume of requests, we may extend this period by up to 60 additional days, and we will notify you of any such extension and the reason for it within the initial 30-day period.

12.1 Grievance Officer

In accordance with the Information Technology Act, 2000, the rules made thereunder, and the Digital Personal Data Protection Act, 2023, we have designated a Grievance Officer to address your complaints and concerns regarding this Privacy Policy and our Processing of your Personal Information:

Grievance Officer Name: Shiv Shankar Rao Challa Designation: Founder & Chief Executive Officer 3R ZeroWaste Pvt. Ltd. Email: cto.team@0waste.co.in Registered Office: Gurgaon/Manesar, Haryana, India

We will acknowledge your grievance within 7 days and endeavor to resolve it within 30 days of receipt. If you are not satisfied with the resolution provided, you retain the right to escalate your complaint to the Data Protection Board of India or other competent authority, as applicable.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"):

To exercise these rights, contact us at cto.team@0waste.co.in. We will verify your identity before processing your request and will respond within the timeframe required by the CCPA.

14. Account Deletion

You may request deletion of your KarmaVerse account at any time by:

  1. Using the in-app "Delete Account" option (where available), or
  2. Emailing cto.team@0waste.co.in with your registered mobile number/email and a clear request for account deletion.

Upon receiving a valid deletion request, we will:

Please note that any unredeemed KarmaCoinXP may be forfeited upon account deletion, in accordance with our Terms of Service.

15. Children's Privacy

KarmaVerse is intended for use by individuals 18 years of age or older. We do not knowingly permit registration by, or knowingly collect Personal Information from, individuals under 18.

Where we identify or are notified of an account registered by a person under 18, we will suspend the account and delete the associated Personal Information within a reasonable period, except where retention is required by law.

If you are a parent or guardian and believe a minor has created an account or provided us with Personal Information, please contact us at cto.team@0waste.co.in, and we will investigate and take appropriate action, including deletion of the account and associated data.

16. International Data Transfers

Your Personal Information is primarily stored and Processed on servers located in India. Where any of our third-party service providers (as described in Section 8) Process or store data outside India, we take reasonable steps to ensure that such transfers are conducted in compliance with applicable law, including the DPDP Act, and that the receiving party maintains an adequate standard of data protection consistent with this Policy.

Your Personal Data may be processed or stored on infrastructure operated by Amazon Web Services (AWS), which may involve transfers outside India. Where required, we rely on Standard Contractual Clauses, our processors' own certifications and compliance programs, or other legally recognized mechanisms to protect your Personal Information in connection with any cross-border transfer.

The Central Government of India may, from time to time, notify countries or territories to which the transfer of Personal Data is restricted or prohibited under the DPDP Act. We will comply with any such restrictions and will not knowingly transfer your Personal Information to a restricted country or territory in contravention of applicable law.

17. AI, Analytics & Automated Processing

We may use anonymized and aggregated usage data to power analytics, fraud detection, and platform improvement, including:

Where we use automated or AI-assisted processes that may have a significant effect on you (for example, in fraud-detection decisions affecting your wallet), we aim to ensure appropriate human oversight and provide you an opportunity to seek review, consistent with applicable law. We do not use AI or automated decision-making to make solely automated decisions that produce legal or similarly significant effects concerning you without appropriate safeguards.

18. Push Notifications

With your permission, KarmaVerse sends push notifications and SMS messages for purposes including:

Transactional vs. Promotional Messages. OTPs and transaction alerts are transactional in nature and are sent as an essential part of providing the Services; these cannot be disabled without affecting your ability to use core account and security features. Campaign announcements, reward promotions, and general marketing communications are promotional in nature and are sent only where you have separately opted in, consistent with the Telecom Regulatory Authority of India's (TRAI) Do Not Disturb (DND) and Distributed Ledger Technology (DLT) regulations governing commercial communications. You may opt out of promotional messages at any time without affecting transactional communications.

You may disable push notifications at any time through your device's notification settings. Please note that disabling notifications may prevent you from receiving time-sensitive alerts, including OTPs delivered via push notification (where SMS is unavailable) and transaction confirmations.

19. Third-Party Links

The Platform may contain links to third-party websites, partner platforms, or services that are not owned or controlled by 3R ZeroWaste (for example, partner reward providers). This Privacy Policy does not apply to such third-party websites or services. We encourage you to review the privacy policies of any third-party websites or services you visit or interact with through the Platform. We are not responsible for the privacy practices or content of any third-party websites or services.

20. Intellectual Property Notice

All content, trademarks, logos, and materials associated with KarmaVerse and 3R ZeroWaste Pvt. Ltd., including but not limited to the KarmaVerse name, branding, and platform design, are the property of 3R ZeroWaste Pvt. Ltd. or its licensors. Nothing in this Privacy Policy shall be construed as granting any license or right to use such intellectual property without prior written consent.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Services we offer. When we make material changes, we will:

Where a material change affects Processing that relies on your consent, we will seek your renewed consent before that change takes effect. For all other changes, your continued use of the Services after the change takes effect constitutes your acceptance of the revised Policy.

22. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of India, without regard to conflict of law principles. Any disputes arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts located in Gurugram, Haryana, India, subject to applicable law. If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with mandatory consumer-protection or data-protection laws, this Section does not deprive you of any protection afforded to you by the mandatory laws of your country of habitual residence.

23. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices — including the rights described in Sections 12 and 13, or a complaint for our Grievance Officer (Section 12.1) — please contact us at:

3R ZeroWaste Pvt. Ltd. Platform: KarmaVerse Website: https://karmaverse.earth Support Email: cto.team@0waste.co.in

We aim to respond to all privacy-related inquiries within the timeframes described in Sections 12 and 13.

This Privacy Policy (Version 2.3) was last updated on July 1, 2026, and is effective as of the date stated above.