Privacy Policy

Kasa Chemicals Private Limited ("Kasa", "we", "us") is the data fiduciary for personal data processed through https://www.kasachemicals.com and the Scanner Reward System described in our product requirements. Address: 230, Opp. Sunny Trade Center, New Aatish Market, Gopalpura Bypass, Mansarovar, Jaipur (Raj.) 302020. Email: info@kasachemicals.com. Phone: +91 91166 15669.

This policy covers visitors to public pages, Customers (retail reward users), and Dealers. It does not cover the separate Super Admin application, except that Admin-side processing of Customer and Dealer data (for example KYC review, bill upload, or PAN export for chartered-accountant compliance) is part of the same programme and is summarised here where it affects you.

We process personal data in line with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and applicable rules. This Site is intended for use in India.

• Visitors: limited technical data from browsing; enquiry details if you email us from Contact.
• Customers: account, profile, coupon redemptions, CP wallet and history, KYC, bank/UPI, cashback, gift claims, and campaign progress.
• Dealers: account, profile, companies/firms (including GSTIN), bill/order history, DP, milestones, and Credit Notes. Company records are created by Admin, not by this Site.

Customer profile (finalised programme fields): first name, last name, mobile number (required, unique), optional email, optional profile image, optional address, optional date of birth, mobile/email verification flags, and account status. On successful login we automatically store last login time and IP address. We do not invent additional profile fields.

Customer KYC and payout: PAN (stored masked for ordinary use; full PAN is application-encrypted for authorised chartered-accountant export only), Aadhaar (stored as a hash, not as ordinary plaintext), bank name, account holder name, account number, IFSC (masked at rest for ordinary APIs), optional UPI ID, verification status and mode, KYC validity dates, failed-attempt count, customer-care escalation flag, KYC initiation/completion dates, and KYC IP address.

Customer programme data: coupon redemptions and purchase history (product name, date, CP earned — no purchase location), spendable CP balance, lifetime CP earned, ledger entries, cosmetic level, cashback requests (CP amount, INR equivalent, status), gift claims, and campaign progress.

Dealer data: name, unique phone number, optional email and address, activation status, companies (company name, GSTIN, optional PAN and address fields), bills (Invoice ID / bill ID, line items, DP amounts), cumulative DP, milestone unlocks, and Credit Notes. Dealers do not need to view the uploaded bill file on this Site.

Contact: if you use Get a Quote, we store your name, email, optional phone, message, and the submitting IP address so we can respond and prevent abuse.

We do not log OTP codes, redeem tokens, unmasked PAN, or secrets in the Customer application.

• Directly from you: mobile number, OTP confirmation, profile, KYC and bank/UPI details, coupon entry, gift claims, cashback requests, the Contact / Get a Quote form, and emails you send us.
• From pack QR / coupon use: the encrypted redeem token in the URL, then redemption against your authenticated session.
• Automatically: login and KYC IP address, login time, the IP address on a Contact form submission (for abuse prevention), and essential cookies described in the Cookies Policy.
• From Kasa Admin (Dealers): onboarding, company/GSTIN records, and uploaded bills that create the Invoice ID and DP you see.
• From processors: Twilio confirms OTP verification; Cashfree supports KYC and cashback payout; hosting and database providers store the resulting records.

• To operate public pages and respond to enquiries.
• To identify you with a unique mobile number, send OTP on WhatsApp (and SMS fallback for Customers), and keep you signed in.
• To redeem single-use coupons, credit CP, show wallet, history, and cosmetic levels, and run gifts and campaigns.
• To verify identity and bank/UPI details, process Customer cashback, and meet tax/compliance needs (including authorised PAN export of redemption and cashback rows).
• To show Dealers bill history, DP, milestones, and Credit Notes.
• To protect the programme against duplicate redemption, fraud, and unauthorised access, and to keep audit records of Admin actions.
• To host, back up, and secure the service in the environments we operate (development, UAT, and production).

We do not use Customer or Dealer programme data to send marketing WhatsApp, SMS, or email from this application. Devaluation and other programme notices that this Site shows are in-app only.

Requesting an OTP and using a Customer or Dealer account is consent to process your mobile number and related account data for authentication and the reward programme. Submitting KYC and bank/UPI details is consent to verify those details and, for Customers, to pay cashback. You may withdraw consent by stopping use and contacting us, understanding that we may then be unable to operate your account, complete KYC, or pay cashback, and that we may still keep data where the law or programme integrity requires it.

We also process data where it is necessary for these Terms (a legitimate programme purpose) or to comply with law, including tax and identity-verification obligations.

We do not sell personal data. We share it only as needed to run the programme:

• Twilio: delivery and verification of WhatsApp OTP (Customers and Dealers) and SMS OTP (Customers only).
• Cashfree: Customer KYC (PAN, Aadhaar, bank/IFSC) and cashback payout to verified bank or UPI.
• Cloudflare R2: storage of files such as profile or product images and Admin-uploaded bill attachments (the database stores the URL).
• Hosting and database: production on AWS (Mumbai); UAT on GCP (Mumbai); MongoDB Atlas in Mumbai. The Customer Site does not connect to MongoDB directly; the backend does.
• Kasa Admin / authorised personnel: dealer onboarding, bills, KYC review or override, valuation, campaigns, Credit Notes, and audit.
• Chartered-accountant export: authorised Admin may export CP-redemption and cashback rows with unmasked PAN. The export file is assembled for download; unmasked PAN is not kept as the ordinary stored form, and the export event is logged without storing the CSV body.
• Professional advisers, banks, and authorities when required by law or to establish or defend legal claims.

Google Maps may process data if you load the map on the Contact page (see the Cookies Policy). Public social links (Facebook, Instagram) are off-site services with their own policies.

Programme data is stored in India (Mumbai regions for production, UAT, and MongoDB Atlas as configured). Processors such as Twilio, Cashfree, and Cloudflare may process data in other countries as their services require; we use them only for the purposes above.

We use access controls, HTTPS, HttpOnly session cookies, masked PAN and bank details in ordinary APIs, hashed Aadhaar/PAN for matching, encrypted full PAN for authorised export, and encrypted redeem tokens that this Site must not display. No security measure is perfect. Do not share OTPs or account access.

The product requirements do not set a fixed general retention or account-deletion period. We keep account, ledger, redemption, KYC, cashback, gift, campaign, dealer bill, and audit records for as long as needed to operate the programme, prevent duplicate coupon use, pay or evidence cashback, meet tax and KYC obligations, and resolve disputes. Session cookies expire as described in the Cookies Policy.

If you want your account closed or data erased, contact us using the details below. We will consider the request under applicable law. We may retain information where we must (for example, completed redemptions, cashback, PAN-related compliance, or fraud prevention) or where deletion would break single-use coupon integrity.

Subject to the Digital Personal Data Protection Act, 2023 and other applicable law, you may request access to the personal data we hold about you, correction of inaccurate data, erasure where the law allows, and information about our processing. You may also withdraw consent as described above and raise a grievance with us.

Write to info@kasachemicals.com from a reachable address, with your registered mobile number and enough detail for us to identify you. We may need to verify it is you before we act. You may also have the right to complain to the Data Protection Board of India after you have raised the matter with us.

You can view and update supported profile fields in the Customer or Dealer experience when that flow is available. Ordinary APIs show masked PAN and masked bank details, not full identifiers.

The reward programme is for users aged 18 or over. We do not knowingly create Customer or Dealer accounts for children. If you believe a minor has registered, contact us and we will take appropriate steps.

We use essential cookies to keep Customers and Dealers signed in. Details, including cookie names and third-party maps, are in the Cookies Policy.

We may update this policy when the programme, processors, or the law change. The effective date at the top will change. Material changes may also be shown in the app or on the Site.

Privacy and grievance contact: info@kasachemicals.com, +91 91166 15669. Postal: 230, Opp. Sunny Trade Center, New Aatish Market, Gopalpura Bypass, Mansarovar, Jaipur (Raj.) 302020. Please use this channel first for access, correction, deletion, or complaints about personal data.