Privacy Notice
Effective from 1 October 2026 · Version 1.5
PRIDETECH SOLUTIONS ("Countr") is the Data Fiduciary for the personal data described here, under the Digital Personal Data Protection Act, 2023.
1. What we collect, and why
| What | Why | On what basis |
|---|---|---|
| Mobile number | To identify you, sign you in, and tell you about your coins and transactions | Your consent, given at signup |
| Name | To address you | Your consent, given at signup |
| Your pincode | To show you shops near you before you have allowed location, and to decide which areas to onboard shops in | Your consent, given at signup |
| The month and year you were born — never the day | The year, to check you are 18 or over, which our Membership Terms require. The month, to give you a birthday offer. We never ask for the day and never store one | Your consent, given at signup |
| Email address, if you give it | Only for the purposes you chose, each recorded separately with the time you chose it: getting your account back if you change your number, and — only if you tick "Also email me a receipt for each bill" — a receipt for each bill. Never marketing, and never given to a shop | Consent, separately for each purpose |
| Your transactions — shop, bill amount, discount, coins, time | To apply the discount, keep a count of the coins you still hold, resolve disputes, prevent fraud, and give shops a count of visits | Consent; and our legal obligations for accounting and tax |
| The State you confirm when you buy a paid membership | Tax compliance. GST law requires us to print on your bill where the sale was made, so we ask you to confirm it before you pay and we print what you confirmed. We ask this only if you buy a paid membership — the free membership never asks — and the only answer we store is Karnataka, because that is the only State we can sell in today | Our legal obligations for accounting and tax |
| Device identifier | To keep you signed in and detect multiple accounts | Consent |
| Approximate location, only when you allow it | To show shops near you, and to flag transactions far from the shop for review | Consent; refusing only means the nearby list is less useful |
| Your neighbourhood, if you give it | To decide where to onboard shops | Consent |
| What you searched for in the app when we had no shop to show you — the words, how many times they were searched for, and the neighbourhood, never your name, number or account | To decide which shops to onboard next. This is the only thing we do with it | Consent |
We do not collect: payment card details, bank details, your income, your identity documents, or your contacts.
We ask for your pincode and your birth month and year when you join. We never ask for the day you were born.
A search that finds nothing is kept without you attached to it. We keep the words, a count and the area — not who typed them, and not where you were beyond the neighbourhood. We keep it because it is the clearest way to learn which shop to sign next, and we delete it as clause 5 sets out.
If you fill in a form on our website
Our website has a form for shops that want to join Countr and a form for people who want to know when they can use it. A form sends us only what you type into it, plus the following:
| What | Why |
|---|---|
| For a shop: the shop's name, the owner's name, a mobile number and the shop's category and neighbourhood; on the longer form also whether we may use WhatsApp, a monthly sales range and how you heard of us | To contact you about the shop joining Countr |
| For a member: a mobile number, your neighbourhood and the kinds of shop you would use | To contact you about using Countr near you |
| Your consent to be contacted, and separately your consent to marketing, each with the time you gave it | To show what you agreed to, and when |
| The page the form was on, and any campaign tags (utm) in the link you followed to it | To know which page or campaign reached you |
| Your internet address, in a count of form submissions per address per hour | To stop automated abuse of the forms |
We use what a form sends only to contact you about joining Countr, as a shop or as a member. We send you marketing only if you also ticked the separate box for it.
Your internet address is not stored with what you submitted. It is kept only in the hourly count, which is deleted as clause 5 sets out.
2. Consent, and how to withdraw it
2.1We ask separately for:
(a)consent to run your membership — without this we cannot provide the service; and
(b)consent to send you marketing — entirely optional.
(c)consent to email you a receipt for each bill — entirely optional, and off unless you tick it. If you do, each receipt shows the shop, the date and time, the transaction reference, the bill, the discount, what you paid, the coins used and the coins left.
2.2You can withdraw marketing consent at any time in the app, without affecting your membership.
2.2A You can stop email receipts at any time with the one-click link in any receipt, or in the app under Profile. Stopping receipts does not affect anything else we hold your email for; if receipts were the only reason we held it, we delete the address.
2.3Withdrawing consent to run your membership closes your account.
3. What shops see
3.1A shop sees the transactions approved at its own counters, and aggregate counts.
3.2A shop never receives your name, your mobile number, or any record of what you have done at any other shop.
4. Who else we share with
We use these processors, each under a written agreement limiting them to acting on our instructions:
| Processor | For | Where the data sits |
|---|---|---|
| Supabase | Database hosting | India (Mumbai) |
| Railway | Application hosting | Singapore |
| Cloudflare | Content delivery, security | Global edge |
| Cloudflare R2 | Storing shop photographs and logos only — never personal data. Photo metadata (EXIF), including GPS location, is stripped before a file is stored, so no location data is kept | Asia-Pacific |
| MSG91 | One-time codes by SMS | India |
| Resend | Sending the emails you asked for — receipts, and account-recovery messages. It receives your email address and what that email says | Japan (Tokyo) |
| Sentry | Recording errors so a failure is noticed and fixed. It receives the error, where in the app it happened, and which of our services it came from. It is not sent your name, mobile number, email address or any sign-in code, and the internet address a request came from is discarded. Kept for 30 days, then deleted | European Union (Germany) |
| Meta / BSP | One-time codes by WhatsApp | Global |
Our database is in India. Some processing happens outside India, which the DPDP Act permits except to countries the Government has restricted. We do not transfer personal data to any restricted country.
We do not sell your data. We do not share it for advertising.
5. How long we keep it
| What | How long | Why |
|---|---|---|
| Transaction records | 8 years from the transaction | Accounting and tax law. After you close your account these records are kept but stripped of anything identifying you. |
| Mobile number, name, device | Deleted within 90 days of you closing your account | No longer needed |
| Your pincode, and your birth month and year | Deleted within 90 days of you closing your account | No longer needed |
| The State you confirmed for a paid membership | Deleted within 90 days of you closing your account | No longer needed. The bill itself is a transaction record and is kept for 8 years, as the first row of this table says |
| Email address | Until you remove it or stop every purpose you gave it for, and deleted straight away when you close your account | Kept only while you want what it is for |
| The record that we emailed you: when, for which purpose (a receipt, say), and whether it was sent — never the address or what the email said | 90 days, then deleted by an automated job | To make sure an email is never sent twice, and to answer "did you send me that?" |
| One-time code records: the number a sign-in code was sent to, when, from which internet address, and how many attempts were made — never the code itself | 24 hours from when the code was sent, then deleted by an automated job | A code signs you in once and stops working after 10 minutes. The record is kept for a day so repeated guessing can be stopped and a failed sign-in can be looked into |
| Website form counts per internet address | 48 hours, then deleted by an automated job | Stopping automated abuse of the forms |
| What you send us through a form on our website | 24 months from when you sent it, or 90 days after you ask us to remove it, whichever is sooner | To contact you about joining Countr |
| What you searched for when we had no shop to show you: the words, a count and the neighbourhood — never linked to you or your account | 90 days from the last time anyone searched for it, then deleted by an automated job | To decide which shops to onboard next. After three months it no longer tells us anything useful |
| Marketing consent record | While consent stands, plus 3 years | To show consent existed |
Deletion is done by an automated job, not on request alone.
6. Your rights
You can, at any time:
- See the data we hold about you, and who we have shared it with
- Correct or complete anything inaccurate
- Delete your account and your personal data
- Nominate someone to exercise your rights if you die or become incapable
- Complain to us, and then to the Data Protection Board of India
The first three are available in the app, under Account. We do not require you to write to us.
7. What deleting your account does
7.1Your name, mobile number and device records are scrubbed straight away, and the remainder is removed within 90 days.
7.2Your transaction records are kept for 8 years as clause 5 requires, with everything identifying you removed.
7.3Unused coins are cancelled and cannot be restored.
8. Children
Countr is for people aged 18 and over. We do not knowingly collect data about children. If we learn we have, we delete it.
9. Security
We protect your data with encryption in transit, access controls, hashed credentials, audit logging of every administrative action, and least-privilege database access. No system is perfectly secure, and we do not claim ours is.
10. If there is a breach
We will tell the Data Protection Board of India and every affected person, as the DPDP Act requires, describing what happened, what data was involved, and what we are doing about it.
11. Changes
We will tell you of a material change at least 15 days before it takes effect. Every version is dated and kept; ask us for the one in force on any date.
12. Grievance Officer
Madhu
countr.grievance@gmail.com · +91 94493 52311
PRIDETECH SOLUTIONS, Vyshala, No. 3381, 20th E Main, Vijayanagar 2nd Stage, Mysore 570017
We acknowledge within 2 working days and resolve within 30 days. If you are not satisfied you may complain to the Data Protection Board of India.