Mivi Care Privacy

Summary

• Mivi Care is the service and warranty app for the Mivi Phone. We collect only what we need to run your warranty, book repairs and answer your complaints.
• On a Mivi Phone, warranty activation happens automatically when you finish the Setup Wizard. We record your phone's IMEIs, serial number, model, firmware, Android version, the setup time, the app version and the approximate location (country, region, city) of your internet connection. We never use GPS. On any other phone we cannot and do not read these identifiers.
• You sign in with your mobile number and a one-time code. You can browse help articles, run diagnostics and check warranty without signing in.
• We do not sell your data and we do not use it for advertising. We share it only with service providers who work for us (cloud hosting, SMS, WhatsApp, payments) and with the service centre handling your repair.
• You can see and change your details in the app, delete your account from Settings, and reach our Grievance Officer at privacy@mivi.in. If you are not satisfied, you can complain to the Data Protection Board of India.
• This notice is available in English and, on request to privacy@mivi.in, in any language listed in the Eighth Schedule of the Constitution of India.

1. Who we are

Mivi Care is provided by NEBULUX TECHSOLUTIONS PRIVATE LIMITED (“Mivi”, “we”, “us”).

• CIN: U26305TS2026PTC218084
• Registered address: Floor No.: 1, Buildiing No./Flat No.: S10, Name Of Premises/Building: 24P,25P, Road/Street: ORR Service Road, Nearby Landmark: West Coast Optilinks, Locality/Sub Locality: FAB City, City/Town/Village: FAB City, District: Rangareddy, State: Telangana, PIN Code: 501359
• Privacy contact: privacy@mivi.in

Under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), Mivi is the “Data Fiduciary” for the personal data described in this policy. That means we decide why and how your data is used, and we are responsible for it.

Languages. This notice is published in English. You may ask for it in any language listed in the Eighth Schedule of the Constitution of India by writing to privacy@mivi.in, and we will provide it. [PLACEHOLDER: Hindi and the languages of the main sales regions to be published on this page - list the languages once translated.] The leaflet in the Mivi Phone box carries the same offer.

2. What this policy covers

This policy covers:

• The Mivi Care app (package com.mivi.care), whether it came preinstalled on your Mivi Phone or you installed it from Google Play on any Android phone.
• The Mivi Care service behind the app: our servers, the public repair-tracking page you reach from an SMS or WhatsApp link, and the customer-service tools used by our staff and call centre.
• Mivi’s service-centre network: the authorised service centres and Mivi staff who repair your phone and handle your complaints. [PLACEHOLDER: confirm whether independent doorstep pickup partners exist and receive any customer data - no pickup-partner role or courier integration exists in our systems today; only a courier reference number typed by staff.]

It does not cover the mivi.in online store or other Mivi apps, which have their own policies.

3. Data we collect and why

We only collect the data listed below. Each table says what we collect, when, why, and how long we keep it. Items marked “you choose” are optional; the app still works if you leave them blank.

3.1 Your account

You need an account only to book a repair, track requests or raise a complaint. Help articles, on-device diagnostics and the warranty check work without signing in. Note that diagnostic reports are uploaded to our server even when you are not signed in (see Section 3.3).

The app keeps your sign-in tokens, user ID, name and number in its private storage on your phone so you stay signed in. This data is excluded from Google backup and phone-to-phone transfer.

3.2 Your phone (warranty activation)

On a Mivi Phone the app is preinstalled with system privileges. When you finish the Setup Wizard, the app automatically sends the following to us to start your warranty. You do not need to sign in and no account is created. The in-box leaflet and the Setup Wizard terms tell you this is happening; Section 9 explains the legal basis and how to object.

On any other phone (for example, if you install Mivi Care from Google Play on a non-Mivi device), the app cannot read IMEIs or the serial number: Android refuses the request and the app treats the answer as “no IMEI”. Everything works without them. The only IMEI we receive is one you type yourself on the Warranty screen to check a Mivi Phone’s warranty; the app remembers it on your phone until you clear the app’s data and re-checks it with our server each time you open the app.

For more on how activation works, see Section 9.

3.3 Service and repairs

Payments. Some repairs (for example, out-of-warranty repairs) are chargeable. You see the estimate in the app and approve or decline it. If you choose to pay online, we create a payment link or QR code through Razorpay. Razorpay receives the amount, a repair reference number and your mobile number, and tells us when the payment succeeds. The Mivi Care app never sees or stores your card, UPI or bank details; you enter them only on Razorpay’s own page. Our servers, however, keep the payment confirmation Razorpay returns, which may include your contact number, email and UPI ID or masked card details, until you delete your account or for as long as tax law requires. If you pay at the counter, staff record the method (cash, card, UPI) and a reference number only.

3.4 Notifications

We do not send push notifications and the app does not use Google’s push notification service. Instead:

WhatsApp is used only where it is switched on for your number; otherwise you get SMS. Tracking links contain a signed code that opens only your repair.

3.5 Technical data

What we do not collect. The app has no analytics or advertising SDK, no crash reporter, and does not read your contacts, SMS inbox, call log, calendar, files, photos, installed apps or clipboard. You type the sign-in code yourself; the app does not read it from your SMS. The app never uses your GPS location.

4. Who we share your data with

We do not sell your personal data and we do not use it for advertising. We share it only as follows.

Service providers who process data on our instructions (“Data Processors”):

Mivi’s service network: the authorised service centre handling your repair sees your name, a masked mobile number, your phone’s IMEI and the issue you described. Staff can reveal your full number only when needed to contact you, and each reveal is recorded in an audit log. Centre staff can see only repairs at their own centre. [PLACEHOLDER: confirm how doorstep pickup staff obtain the pickup address - no service-centre screen shows it today.] [PLACEHOLDER: confirm the basis on which service centres receive this data - either they act on Mivi’s instructions under a written agreement, or they are independent businesses, in which case they are named here as separate recipients.]

The phone’s manufacturer: the factory that builds the Mivi Phone loads each unit’s IMEIs, serial number and shipping date into our system before sale; the shipping date is what lets us tell a customer’s setup from a factory test (Section 9). The factory can later check whether a unit has been activated (yes or no only). It never receives the activation date, city or any customer details.

Legal requirements: we may disclose data if required by law, a court or a government authority, or to establish or defend a legal claim, including a warranty dispute.

5. Where your data is stored and how we protect it

• Our servers, database and file storage run on Google Cloud in the asia-south1 (Mumbai, India) region. The exception is data we hand to a provider to deliver a message or take a payment: WhatsApp messages are processed by Meta Platforms on its own servers, which may be outside India [PLACEHOLDER: add MSG91 and Razorpay once their hosting statements are confirmed]. The DPDP Act allows these transfers.
• All traffic between the app and our servers, and between our servers and our providers, is encrypted with HTTPS. The app refuses unencrypted connections.
• Data at rest is encrypted by Google Cloud by default. Screen-lock PINs and pickup codes are additionally encrypted with a key held in a secrets vault. One-time codes and sign-in tokens are stored only as hashes.
• Staff sign in with their own credentials and a PIN, see masked phone numbers by default, and every reveal of a full number, PIN or ID document is audited.
• Rate limits protect sign-in and warranty lookups from abuse.
• On your phone, the app’s own data (sign-in tokens, diagnostic history, warranty cache and the activation record) is stored in the app’s private storage and is excluded from Google backup and device-to-device transfer.

No system is perfectly secure. If a breach affects your data we will tell you and the Data Protection Board of India as the DPDP Act requires.

6. How long we keep your data

The DPDP Act lets us keep records we need to establish or defend legal claims, such as a warranty dispute, and records the law requires us to keep; that is the basis for the periods above that run past account deletion.

7. Your rights and choices

Under the DPDP Act you have the right to:

• Know what personal data we hold about you and how we use it: this policy, plus on request a summary of the personal data we hold, what we do with it, and the list of providers and service centres it has been shared with.
• Correct or update your data.
• Erase your data, subject to the legal-retention exceptions in Section 8.
• Withdraw consent for your account data at any time, by deleting your account in the app or by emailing privacy@mivi.in. Withdrawing consent does not affect what we did before, and some services (for example, repairs booked under your account) cannot be provided without the data. Warranty activation data is not collected on the basis of consent; Section 9 explains its legal basis and how to object to it. Once registered Consent Managers are available under the DPDP Act, you will also be able to give or withdraw consent through one.
• Nominate another person to exercise these rights for you if you die or become incapacitated.
• Complain to our Grievance Officer (Section 11) and then to the Data Protection Board of India (Section 12).

How to use them:

• In the app: Settings lets you change your name, email and saved addresses, sign out, and delete your account. The Warranty screen shows what we hold about your phone’s warranty.
• By email: write to privacy@mivi.in from any address, giving the mobile number on your account. We may send a one-time code to that number to confirm it is you.
• Without an account: you can use help articles, the diagnostics tests and the warranty check without signing in at all.

Permissions you control on your phone: the camera, microphone, phone-state and Bluetooth permissions are asked for only when you start a diagnostic test that needs them. If you refuse, that test is marked as skipped and everything else works.

8. Deleting your account — exactly what happens

Go to Settings → Delete account and confirm. The app then asks our server to delete you and signs you out. This is what the server does immediately:

• Your mobile number, name, email and saved addresses are removed from your account. A one-way hash of the number is kept only as a record that this number’s account was deleted; the same number can sign up again.
• Your refresh token is revoked and your one-time-code history is deleted. The short-lived sign-in token expires by itself within 30 minutes.
• Text you wrote - issue descriptions, messages, cancellation reasons, grievance descriptions - is replaced with “[deleted]”.
• Your phone’s device records and diagnostic reports are disconnected from your account. The IMEI stays on them so the warranty for that handset continues to work for whoever owns it.
• Payment details returned to us by Razorpay are wiped. Notification logs lose their message content and your number.

What we keep, and why: repair jobs, tax invoices (with the name and masked number on them), payment amounts, warranty claim decisions and warranty activation records are legal and accounting records and survive deletion, without your contact details. Repair and grievance records keep their reference number, category, status and timeline, and on a Mivi Phone the IMEI; our staff can still see those records under the repair, but your deleted account no longer appears in customer searches. Condition photos and any ID photo taken at the counter are not deleted automatically; email privacy@mivi.in to ask for them to be removed. Ratings and comments you left about a repair are kept with the repair record, without your contact details.

On your phone: deletion clears your sign-in details from the app, but your local diagnostic test history, the warranty cache (including any IMEI you typed) and the activation record stay in the app’s private storage until you clear the app’s data in Android Settings or uninstall it (on a Mivi Phone the preinstalled app cannot be uninstalled, but its data can be cleared).

Staff accounts cannot be deleted from the app; staff should contact HR.

9. Warranty activation — the details

What happens at setup. When you finish the Setup Wizard on a new Mivi Phone, the app records the facts listed in Section 3.2 and uploads them as soon as the phone is online. Nothing on screen interrupts you; the leaflet in the box and the terms shown in the Setup Wizard are your notice. If the phone is offline, the record waits on the phone and is uploaded later; it is not backed up to Google and cannot be moved to another phone.

Legal basis. [PLACEHOLDER: counsel to confirm one of the two options below and delete the other.]

(a) Consent: you agree to the activation upload by an affirmative action in a standalone Mivi notice shown during the Setup Wizard. [This option conflicts with the current decision to show no Mivi screen in the wizard - escalate.]

(b) Legitimate use: we process the activation data under section 7(a) of the DPDP Act, because you voluntarily set up the phone for the purpose of using it under warranty, the in-box leaflet and wizard terms tell you before setup that the upload will happen, and you have not indicated that you object. We do not rely on consent for this data, which is why Section 7’s “withdraw consent” route applies to your account data and the “object” route below applies to activation data.

Why we do it this way. Your warranty starts on the day you first set up the phone, not the day it left the factory. Recording that day automatically means you do not have to register, keep a bill or prove a purchase date to claim warranty.

When the warranty shows “pending”. We activate a unit only after the factory has told us it exists and the date it shipped. If your phone’s setup record arrives before that shipping record, the Warranty screen shows the warranty as pending; it is confirmed automatically once the factory data catches up, with your original setup date. A setup reported before the unit’s shipping date, or from a factory network or factory test build, is treated as a factory test rather than a customer activation.

First activation wins. The first valid setup record for an IMEI sets the warranty start date. A factory reset, a software update or reinstalling the app does not create a new warranty or change the start date; the app sends a new setup record, and our server stores it but keeps the original activation date.

Daily check-ins. Each day you open the app or sign in on a Mivi Phone, it tells our server the phone’s IMEIs, serial number, model, memory and storage size, firmware build and app version. This keeps the warranty status you see up to date and lets us re-check activation decisions. At most one such record is stored per day for app opens and one for sign-ins.

The warranty follows the phone. Warranty is tied to the IMEI, not to your account. If you sell or give away the phone, the remaining warranty goes with it, and deleting your account does not cancel it.

Non-Mivi phones. Without system privileges the app cannot read the IMEIs and never sends them, so it never has anything to activate; our server additionally rejects any setup-time activation report that does not declare itself as the preinstalled app.

If you object. Activation data is collected automatically, so there is no “Not now” button in the app. If you do not want us to hold an activation record for your phone, email privacy@mivi.in with the IMEI (dial *#06# to see it). We will record your objection and stop using the record for anything other than confirming warranty and meeting legal requirements. [PLACEHOLDER: Mivi to define the manual procedure (who acts, which records, what is retained under the DPDP Act’s legal-claims exemption) before promising deletion; no tool exists today to suppress or delete an activation record.] Please note that without the activation record we cannot confirm your warranty start date, so you would need your purchase invoice to make a warranty claim. Setting up the phone without an internet connection delays the upload; it does not prevent it.

10. Children

Mivi Care is for adults. You must be 18 or older to create an account. [PLACEHOLDER: when you sign in you confirm that you are 18 or older and have read this notice - ships with the age confirmation on the sign-in screen, which does not exist in the app today.] We do not knowingly collect personal data from anyone under 18, and we do not track children or show them advertising. If a phone is used by a child, the account should be held by a parent or guardian. If you believe a child has created an account, email privacy@mivi.in and we will delete it.

Warranty activation records describe the phone, not a person, and are not linked to anyone until an adult signs in.

11. Grievance Officer

If you have a question, request or complaint about your personal data, contact our Grievance Officer:

• Name: [PLACEHOLDER: Grievance Officer name - must be filled before publication]
• Email: privacy@mivi.in
• Postal address: [PLACEHOLDER: office address - must be filled before publication]
• Response time: we acknowledge within [PLACEHOLDER: 48 hours] and resolve within [PLACEHOLDER: 30 days] (the law caps this at 90 days)

You can also raise a grievance about a repair or service centre inside the app under Grievances; that goes to our service team rather than the Grievance Officer.

12. Complaints to the Data Protection Board of India

If you have contacted our Grievance Officer and are not satisfied with the response, or you have not received one within the time above, you have the right to complain to the Data Protection Board of India set up under the DPDP Act, 2023. The law requires you to use our Grievance Officer route first. How to complain: [PLACEHOLDER: Board complaint portal address / postal address and the form of complaint, once published - must be filled before publication.]

13. Changes to this policy

We will update this page when the app or our practices change. Material changes will be shown on this page and, if you have an account, sent by SMS or WhatsApp. [PLACEHOLDER: replace with “flagged in the app” once an in-app notice ships; the app has no policy link or change banner today.] The version and date at the top tell you which policy applies. Earlier versions are available from privacy@mivi.in.

This notice is available in English and, on request, in any language listed in the Eighth Schedule of the Constitution of India (Section 1).