Privacy Policy

1. Who we are

Xentra is a product of Promotive Digital Solutions LLP, a limited liability partnership in India ("Xentra", "we", "us"). Postal address: 168, Vill Hosiyarpur, Gautam Buddha Nagar, Noida, Uttar Pradesh 201301, India.

Businesses (clients) use Xentra to create campaigns of real-world and digital tasks. Verified individuals (executors) and teams (vendors) do the work and submit proof. Xentra reviews the proof, invoices clients and pays executors and vendors. For the personal data described here, Xentra decides why and how it is processed, and acts as the data fiduciary under India's Digital Personal Data Protection Act, 2023 (the DPDP Act).

2. The short version

• We collect what we need to run accounts, campaigns, proof review, invoicing and payouts.
• Executors share their device location once, in the foreground, when they submit proof. The app does not track location in the background.
• Identity checks (PAN, bank account, UPI, GSTIN) go through Cashfree. Sensitive numbers are stored encrypted.
• Proof may be checked with the help of AI. Work the AI cannot confirm is decided by a person.
• Website analytics run only after you choose "Allow analytics". We use no advertising cookies or advertising SDKs.
• You can ask to see, correct or delete your data, withdraw consent and raise a grievance.

3. Personal data we collect

Account and sign-in

• Name, email address, mobile number, account type (client, executor or vendor) and, for vendors, the vendor type and an optional company name.
• Your password, stored only as a one-way hash. One-time verification codes sent by email or SMS are stored only as a hash.
• If you continue with Google: your Google account identifier, email address and name. If you use Sign in with Apple: your Apple identifier, the email address Apple shares (which may be a private relay address) and your name the first time.
• Sign-in sessions: a session cookie, and the IP address, browser and device type used when you signed in.
• On the mobile apps: a push notification token for your device.

Organisations and billing

• For clients: company name, GSTIN, business PAN, billing address, city, state and PIN code, billing contacts (name, email, phone and role) and bank account details (stored masked).
• For vendors: company information you enter, including the business address. Optionally, a map point for your business that you choose to capture; it is rounded to about 110 metres and you can remove it at any time.
• Names and email addresses of colleagues you invite, and of campaign participants a client adds.

Campaigns, tasks and proof

• Campaign briefs, drafts, targets, places where work should happen and attachments that clients upload.
• Proof that executors submit: photos, videos, audio, files, typed answers and comments, the time of submission and the device location at submission (see Location data).
• Review outcomes: approvals, rejections, requests for correction and the reasons given.

Executor work profile

• Information that helps match you to suitable work: city, region and PIN code, an optional home base point and travel radius, languages, devices and equipment, experience, working days and hours, capacity and availability.
• Answers to profile questions and an optional profile photo.
• Only if you choose to share them, with your consent: your interests (for example sports and fitness or electronics), date of birth, gender, marital status and whether you have children. They are used only to offer you campaigns that ask for them; only your age is used, never your date of birth; clients see only how many people match, never your answers. You can answer "prefer not to say", change your answers, or withdraw your consent at any time in your Work Profile, which deletes these answers. Declining never affects your other work. We do not ask about religion, caste, political views, health or sexual orientation.

Identity and verification

• PAN, and the name and other details returned by the PAN check.
• Bank account number, IFSC, bank name and account holder name, and UPI ID, with the result of the verification.
• GSTIN and business details for businesses.
• Where offered and only if you choose it: Aadhaar verification through DigiLocker, an identity document photo, and a face match or liveness check using a selfie. The selfie is sent to the verification provider for that check and is not stored by Xentra.
• Your consent to verification, the time you gave it, and whether you opted in to promotional messages.

Payments, wallets and payouts

• Campaign funding payments, wallet balances, reservations, transactions, invoices and settlements.
• Withdrawal requests and the bank details they are paid to, with the IP address and device recorded for security.
• Card and UPI details for funding are entered on Cashfree's payment page. Xentra does not receive or store them.

Support, contact and Friday

• Support conversations and any attachments you send.
• If you use the contact form: name, work email, optional phone and company, who you are (business, vendor, executor or other), your message and your consent to be contacted.
• If you use Friday, Xentra's AI assistant: what you type or say to it and its replies.

Website analytics and diagnostics

• With your consent only: an anonymous visitor identifier, the pages and buttons you use on the public website, and where your first visit came from (campaign tags, the referring website and the landing page, without query strings).
• Error reports from the website and apps, with sensitive values such as PAN, bank and identity numbers masked before they are sent.

4. How we use personal data

• To create and secure accounts, verify email addresses and mobile numbers, and keep you signed in.
• To run campaigns: match executors and vendors to tasks, assign work and show each party what it needs.
• To review proof, including AI-assisted checks, and to detect duplicate, fraudulent or unsafe activity.
• To verify identity, bank accounts and businesses before money is paid out and to meet legal obligations.
• To invoice clients, collect payments, keep wallets and ledgers, and pay executors and vendors.
• To send service messages by email, SMS and in-app notifications, and to answer support requests.
• To understand which parts of the public website work, only with analytics consent.
• To find and fix errors and to protect the service against abuse, for example by limiting repeated requests.

We process personal data on two grounds under the DPDP Act. Consent: for website analytics, for optional checks such as Aadhaar through DigiLocker, face match and liveness, and for any promotional messages. You can withdraw consent at any time. Legitimate uses: data you give us to use Xentra is used for the purpose you gave it for (your account, campaigns, proof review, invoicing and payouts), and we process data where the law requires it, for example to keep tax and payment records or to answer a lawful request from an authority.

Xentra does not send promotional emails or text messages today. If we start, we will ask for your consent first, and every promotional message will explain how to stop receiving them. Messages about your account, tasks, payments and security are part of the service and are not promotional.

5. Location data

• Proof location (executors): when you tap to submit or resubmit proof in the Executor app, the app asks for foreground location permission and takes one position reading. It starts no background tracking, no repeated polling and no location watcher. Proof cannot be submitted without it. Xentra converts the reading into an approximate place name (city, state, PIN code), which is shown with a note that it is approximate and not a verified address.
• Who sees proof location: the people who review that proof and are responsible for the task, which can include Xentra administrators, the client that owns the campaign and the vendor managing the work.
• Business location (vendors, optional): a map point captured once, only when you ask for it, after your browser asks for permission. It is rounded to about 110 metres, is used to show administrators where your business is based, is never used as proof of work, and can be removed at any time.
• Work profile area (executors, optional): your city and, if you choose, a home base point and a travel radius, used to offer you work you can reach.

6. Identity and business verification

Executors and vendors verify their email address and mobile number, then their PAN. Bank account, UPI and GSTIN checks are used before payouts and for businesses. Clients can complete optional verification from their profile. These checks are made through Cashfree's verification service.

PAN, bank account number, UPI ID, GSTIN and the identity details returned by a verification are encrypted before they are stored. Screens show masked versions. Aadhaar through DigiLocker, face match and liveness checks are offered only where switched on, and only if you choose to use them.

7. AI-assisted processing

• Proof checks: photos, files, typed answers and the task requirements may be sent to an AI model (from OpenAI or Anthropic, depending on configuration) to check whether the proof matches what was asked. Audio proof may be transcribed with OpenAI's speech recognition. Where a campaign uses automatic approval, work can be approved automatically when the checks pass. Work the checks cannot confirm stays with a human reviewer, who can approve it, reject it or ask for a correction.
• Friday: Friday is Xentra's AI assistant for administrators and, where it is switched on, for clients. What you type or say to Friday, and the Xentra data Friday reads to answer you, are sent to Anthropic (its Claude models) to produce the replies. In a web browser, what you say to Friday is turned into text by the browser's own speech service (in Google Chrome, by Google). When you turn on spoken replies, the text of the reply is sent to ElevenLabs to produce the voice; if that is unavailable, your device's built-in voice reads it instead. The founder's Friday Command Center runs on a server operated for Xentra on Oracle Cloud and uses ElevenLabs for its voice. Anthropic and ElevenLabs process this data under their own terms and may keep it for a period those terms set (for example, ElevenLabs keeps a history of generated speech unless zero-retention is available on the account); Xentra does not control that retention.
• OpenAI and Anthropic receive this data through their business APIs only to perform the checks and to produce Friday's replies, and Xentra does not ask them to use it to train their models. Under their standard terms for API customers, they do not use API data for training unless the customer opts in, and they may keep it for a limited period to monitor abuse.

8. Cookies and website analytics

The public website shows a choice between "Essential only" and "Allow analytics". Nothing is written to an analytics cookie and no analytics event is sent before you choose "Allow analytics". Choosing "Essential only" removes the analytics cookies. To change your choice, clear this site's cookies in your browser and choose again.

We do not use advertising cookies, and the website and apps contain no advertising or third-party analytics SDKs.

9. Who we share personal data with

• Other users, as the service needs: a client sees the proof and results for its own campaigns; a vendor sees the name, email and phone number of executors in its team and their work; executors see the task details they need. Each party sees only the work it is part of.
• Service providers that process data for us, listed below, under their own security and confidentiality obligations.
• Authorities, courts or other parties when the law requires it, or to protect the rights, safety and property of Xentra, its users or others.

We do not sell personal data.

10. Service providers

Some of these providers are used only where the matching feature is switched on, for example Resend or SendGrid for email and MSG91 or Twilio for text messages. We will update this list when we add or change a provider that receives personal data.

11. Where data is processed

Some providers above store or process personal data outside India. Xentra's database is hosted by Neon in Singapore, and the website, portals and APIs run on Vercel, mainly in the United States. Other providers may process data in the countries where they operate, which can include the United States and countries of the European Union. The DPDP Act allows personal data to be processed outside India except in countries the Government of India restricts by notification, and we will not transfer personal data to such a country.

12. How long we keep data

• Account, campaign, proof, location and support records are kept while your account is active.
• After an account is closed, we delete or anonymise the personal data we no longer need. We keep the records described in the next point, and records reasonably needed to resolve an open dispute, complaint or suspected fraud for as long as that takes.
• Invoices, payments, wallet and ledger records, tax records and identity verification records are kept for as long as the law requires. For example, Indian law requires a limited liability partnership to keep its books of account for eight years, and GST and income tax law set their own periods.
• Proof uploads that were abandoned or withdrawn before review are removed from file storage by a scheduled clean-up, unless they are still needed for a review.
• Selfies used for a face match or liveness check are not stored by Xentra.
• Friday: conversations in the Client and Admin portals and apps are stored in Xentra's database so that a conversation can continue later. There is no automatic deletion period; you can ask us to delete them. Spoken replies are produced when needed and not stored. In the founder's Command Center, conversations are stored on its server in the same way, and voice recordings are converted to text there and each recording is deleted as soon as its text is ready.
• Cookies are kept for the periods listed in the cookie table.

13. How we protect data

Xentra uses encrypted connections (HTTPS), stores passwords and one-time codes only as hashes, encrypts PAN, bank account numbers, UPI IDs, GSTINs and verified identity details before storing them, limits what each role can see, masks sensitive values in error reports, and limits repeated requests. No system is completely secure, so we cannot guarantee absolute security.

14. Your rights and choices

Under the DPDP Act you can:

• Ask for a summary of the personal data we process about you and the providers we share it with.
• Correct, complete or update your data. You can change most profile details yourself in the web portal or app.
• Ask us to erase your data, subject to records the law requires us to keep.
• Withdraw consent at any time, for example for analytics or promotional messages. Withdrawal does not affect processing that already happened, and some features may stop working.
• Nominate another person to exercise your rights if you die or become unable to.
• Raise a grievance with us, and if you are not satisfied with our response, complain to the Data Protection Board of India.

Account deletion: in the Client, Executor and Vendor apps, open More, then Delete account. This records a request that the Xentra team reviews; your account keeps working until the request is processed. The team checks for anything still open, such as a wallet balance, a pending withdrawal or work under review, and settles it with you. It then closes the account and deletes or anonymises your personal data, except the records described under "How long we keep data" that must be kept. You can cancel the request while it is still pending.

For any other request, write to support@xentra.live from the email address on your account, or contact the Grievance Officer below. Never send passwords or one-time codes by email.

15. Children

Xentra is meant for adults. You must be at least 18 years old to create or use any Xentra account, including as a user for a client or vendor business. We do not knowingly process the personal data of children. If you believe a child has created an account, write to us and we will close it.

16. Changes to this policy

We will update this page when our practices change and change the "Last updated" date above. If a change is significant, we will also tell signed-in users in the product or by email.

17. Contact and Grievance Officer

• Grievance Officer: appointed by Promotive Digital Solutions LLP and reachable at the contact details below
• Contact: support@xentra.live, or by post to the address below, marked for the attention of the Grievance Officer
• Response time: we acknowledge and resolve grievances within the time limits set by applicable Indian law.
• Privacy questions and requests: support@xentra.live
• Postal address: Promotive Digital Solutions LLP, 168, Vill Hosiyarpur, Gautam Buddha Nagar, Noida, Uttar Pradesh 201301, India

See also the Terms of Service.