Privacy Policy

GISweaver Privacy & Data Protection Policy

Last Updated & Effective Date: 13 October 2026
Document Version: 2026-10-13
Amendment: 24 September 2026 — Sections 3.1, 3.2, 3.3, 3.4, 4.1, 8.1, 8.2, 8.3, 13 and 14 are restated to what the Platform does on that date; amends the version of 30 August 2026.
Amendment: 26 September 2026 — Sections 3.3 and 4.1 are restated: project attachments include photographs in WebP and HEIC or HEIF as well as PNG and JPEG, and the position and time of capture read from a project photograph are kept with it and shown to the Organisation's members, while the rest of its embedded metadata is removed; amends the version of 24 September 2026.
Amendment: 26 September 2026 — Section 6 is restated: when an Organisation asks to connect its record of a client to the client's own Organisation by organisation code, each Organisation is shown the other's legal name and the request, and no person of either; amends the version of 26 September 2026.
Amendment: 26 September 2026 — Sections 2.2, 3.3 and 4.1 are restated: the word "document" and the term "project attachment" are withdrawn; a photograph, PDF or ZIP archive uploaded to a project is a file kept with the project, not an attachment; amends the version of 26 September 2026.
Amendment: 26 September 2026 — Section 6 is restated: where a client Organisation chooses to share its contact card, GSTIN or billing address with an Organisation connected to it, the fields it shares are copied into that Organisation's record of it and held there as that Organisation's own record; amends the version of 26 September 2026.
Amendment: 26 September 2026 — Section 6 is restated: an Organisation that names members of its own as contact persons for the Organisations connected to it discloses their name, email address and marks to each connected Organisation while the link stands, as the Data Fiduciary for its own people; each person named is notified and may remove themselves; amends the version of 26 September 2026.
Amendment: 26 September 2026 — Section 6 is restated: when a project of an Organisation names a client linked to a client Organisation, that client Organisation is told, once for that project, the Organisation's legal name and its label for the project, and no person of the Organisation is named; amends the version of 26 September 2026.
Amendment: 27 September 2026 — Section 10.2 is restated: where another Organisation's records still name a person whose account is erased, the person's identifying details, credentials, sessions and preferences are removed and the record keeps a "Deleted user" placeholder; amends the version of 26 September 2026.
Amendment: 27 September 2026 — Section 1.2 is restated to clarify zero-EXIF media sanitization for profile pictures and logos alongside the deliberate capture coordinate extraction for project photographs; and Section 8 is restated to add a data-residency statement that a future data plane in another region would be governed by its own schedule and would amend this Policy first; amends the version of 26 September 2026.
Amendment: 27 September 2026 — Section 6 is restated: when an Organisation invites a person at its client by email and the address is already a verified GISweaver account, the invitation is also shown in that person's notifications with the inviting Organisation's legal name and its label for the project, and the inviting Organisation is not told whether the address holds an account; amends the version of 27 September 2026.
Amendment: 28 September 2026 — Sections 8.1, 9.2 and 13 are restated: backups of the database and of stored files are copied to a second Indian region, AWS Hyderabad (ap-south-2), so that they survive the loss of the Mumbai region, and no backup leaves India; amends the version of 27 September 2026.
Amendment: 29 September 2026 — Sections 3.3 and 4.1 are restated: project videos (MP4, MOV) are kept with a project as uploaded, without conversion or removal of their embedded metadata, and are served as uploaded to the members of the Organisation who can open the project; amends the version of 28 September 2026.
Amendment: 3 October 2026 — Section 3.3 is restated: an Organisation's data includes direct messages between two of its members, read by those two alone, never carried by an export, search, audit entry, notification or telemetry, not end-to-end encrypted, disclosed by Alonstech only under Section 5.3 as a recorded manual act, and erased with the Organisation's whole account, and members of an Organisation can see each other's names and pictures in order to send them; amends the version of 29 September 2026.
Amendment: 4 October 2026 — Section 3.3 is restated: an Organisation's data also includes private groups of its members and replies in threads, read by the group's current members alone (a member added later reads the earlier messages), with who belongs to each group and when each joined or left, never carried by an export, search, notification text or telemetry, recorded in the audit trail only as to creation, additions, removals, departures, renaming, archiving and reopening and never by name or word, and erased with the Organisation's whole account; amends the version of 3 October 2026.
Amendment: 4 October 2026 — Section 3.1 is restated: a person may add a job title and a telephone number to their own profile, both optional and set only by them; the job title is shown to the other members of each Organisation they belong to, and the telephone number only to the members who may already see their email address and to them, never to a client's reviewers, another Organisation or Alonstech's staff; neither is recorded in an audit trail, and both are removed when the account is erased; amends the version of 4 October 2026.
Amendment: 6 October 2026 — Sections 1 (summary), 3.3, 4.2, 6, 8.2, 9.1, 9.3, 10.2, 10.5, 11.2, 13.1, 13.2 and 16.2 are restated: a delivery receipt names no person, while the delivering or sharing Organisation's record of each file taken, and of each look at a shared release, tells the other Organisation's people apart by an alias and shows their names only where that Organisation switches on "Show our people's names to senders"; operational telemetry carries pseudonymous identifiers of accounts, staff accounts and Organisations and nothing that names a person; an Alonstech operator assumes an Organisation only with a stated reason and can then read the records listed in Section 8.2; Sections 9.1 and 9.3 state what a lapsed, frozen, suspended or closed Organisation can still read, download and export, that an individual's own account is erased on a written request handled by a person, and that removing a person from an Organisation does not erase their account; Sections 10.5 and 11.2 state what is self-service and what is done by hand; and Sections 13.1 and 16.2 state that while the Platform is in beta this Policy may be corrected at any time to state what the Platform does, the published version with its date being the notice; amends the version of 4 October 2026.
Amendment: 7 October 2026 — Sections 3.1 and 14.2 are restated: a person's own display choices, including whether a sound plays when a notification arrives, are kept with their account, set only by them and shown to no one else, and the browser keeps a copy of the sound choice under gisweaver.notificationSound; amends the version of 6 October 2026.
Amendment: 7 October 2026 — Sections 3.3 and 4.1 are restated: a project may have a picture, set by a member who may edit the project's details, sanitized and re-encoded like a profile picture, shown only to the members of the Organisation who can open the project, recorded in the audit trail only as the fact that it changed, and deleted with the project's permanent deletion or the Organisation's erasure; and every profile picture, logo and project picture is cropped in the browser so that only the crop is sent; amends the version of 6 October 2026.
Amendment: 8 October 2026 — Section 3.3 is restated: the Organisation's search finds a direct or group message by its words only for the people who can read that conversation, its two participants or the group's current members (a member added later included), and never for an Owner, Administrator, auditor or Alonstech's staff who is not a participant; the Organisation's audit trail records no search that found only private messages, and never a count of them; no export, notification text or telemetry carries their words; amends the version of 7 October 2026.
Amendment: 13 October 2026 — Section 3.1 is restated: a profile picture can be seen by any signed-in GISweaver user who has its link or id, whether or not they share an Organisation with you; amends the version of 8 October 2026.
Operating Entity: Alons Advanced Technologies Private Limited ("Alonstech", "Company", "we", "us", or "our")
Product: GISweaver Platform (gisweaver.com, app.in.gisweaver.com, admin.gisweaver.com)
Applicable Legal Framework: Information Technology Act, 2000 (IT Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), which are the presently operative data protection framework; the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (as amended); the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025, which are being brought into force in stages and whose substantive provisions are not yet commenced (see Section 2.3); and the Guidelines for Acquiring and Producing Geospatial Data and Geospatial Data Services (DST, 2021).

1. Commitment to Privacy & Sovereign Data Protection

1.1. Introduction. Alons Advanced Technologies Private Limited ("Alonstech", "we", "our", or "us") operates the GISweaver platform. We are dedicated to maintaining the highest standards of confidentiality, data integrity, and privacy for every surveyor, engineering professional, corporate organisation, and client utilizing our survey delivery workspace.

1.2. Privacy by Design. Privacy on GISweaver is not an afterthought or an administrative policy — it is built into how the software, the database, the network and the monitoring are designed. Our platform enforces:

• Tenant isolation applied by the database itself, on every query, so that one Organisation's records are never served to another.

• A sovereign data plane inside the Republic of India (the in-mumbai-1 cell in AWS Mumbai).

• Zero-EXIF media sanitization for profile pictures and logos, stripping all embedded metadata and GPS coordinates; and for project photographs, purposeful extraction of capture coordinates and timestamps to support verifiable spatial auditability while stripping all extraneous device metadata before the file is stored (Section 4.1).

• Operational telemetry that is designed to carry no survey data and nothing that names a person, and that carries pseudonymous identifiers (Section 4.2).

1.3. Scope of this Policy. This Privacy Policy explains how Alonstech collects, processes, stores, protects, and discloses personal data and workspace data when you access or interact with the GISweaver website, the authenticated workspace, and its APIs, in a browser.

2. Regulatory Status: Data Fiduciary & Data Processor Roles

Under the Digital Personal Data Protection Act, 2023 (DPDPA 2023), Alonstech operates in two distinct legal capacities depending on the context of processing:

2.1. Alonstech as a Data Fiduciary.
Alonstech acts as a Data Fiduciary with respect to the personal data of registered individual users, organisation account holders, billing administrators, and website visitors. In this capacity, we determine the purpose and means of processing personal data for account creation, identity authentication, subscription billing, statutory GST tax compliance, and direct customer support.

2.2. Alonstech as a Data Processor.
When a Customer Organisation (a survey firm, engineering consultant, or enterprise) uploads spatial datasets, files kept with a project, employee roster lists, cadastral parcel attributes, or downstream client email addresses for survey delivery and acceptance, the Customer Organisation is the Data Fiduciary, and Alonstech acts strictly as a Data Processor. We process such workspace data solely on behalf of, and under the documented instructions of, the Customer Organisation in accordance with the Master Terms of Service.

2.3. Commencement Status of the DPDP Act, and What Presently Binds Us.
The DPDP Act, 2023 is being brought into force in stages by notification G.S.R. 843(E) dated 13 November 2025. Section 2 (definitions) and the provisions establishing the Data Protection Board are in force. Sections 3 to 17 — which contain the notice and consent requirements, the obligations of a Data Fiduciary, the rights of a Data Principal, and the cross-border transfer provision — are not yet in force, and are expected to commence approximately eighteen months from the publication of that notification. Section 6(9) and Section 27(1)(d) commence approximately one year from that publication. The Digital Personal Data Protection Rules, 2025 follow the same phasing: most of the substantive Rules, including those on breach notification, are likewise not yet in force.

• Because Section 44(2) of the Act — which repeals Section 43A of the IT Act — is itself in the eighteen-month tranche, the SPDI Rules, 2011 remain the operative statutory security framework today, and Alonstech complies with them.

• Where this Policy describes a DPDP Act right or obligation, it does so as a description of the scheme Alonstech has chosen to honour voluntarily and ahead of commencement, and to which it will be bound when the relevant provision commences. Nothing in this Policy asserts that a provision is in force before it is.

3. Categories of Personal & Workspace Data Collected

We collect and process only the minimum necessary data required to deliver a professional geospatial workspace:

3.1. Account & Identity Data (Data Fiduciary context):

• The name you choose to be shown by (your display name).

• Verified email address.

• Optionally, a job title and a telephone number that you add to your own profile. Only you can set, change or remove them. Your job title is shown beside your name to the other members of each Organisation you belong to. Your telephone number is shown only to the members of an Organisation who may already see your email address there — its Owner and Administrators, the lead of a project or the manager of a branch you are on, and every member on a plan without role hierarchy — and to you; it is not shown to a client's reviewers, to the members of another Organisation, or to Alonstech's staff, including while an operator has assumed the Organisation. Neither is recorded in an audit trail. Both are removed when your account is erased (Section 10.2).

• Passwords, stored only as a salted hash computed with the memory-hard Argon2id function using a cryptographically random per-password salt. Passwords are never encrypted and cannot be recovered or read by anyone, including Alonstech.

• Multi-Factor Authentication (MFA): the authenticator (TOTP) secret, stored encrypted, and single-use recovery codes, stored only as SHA-256 hashes so that they cannot be read back.

• Profile picture / avatar (sanitized and re-encoded from raw pixels; no EXIF preserved). Any signed-in GISweaver user who has its link or id can see it, whether or not they share an Organisation with you.

• Your own display choices: the units for areas and lengths, how coordinates are shown, and whether a sound plays when a notification arrives (on until you turn it off). Only you can set them, and they are shown to no one else; they are kept with your account so they follow you to every device you sign in on.

• Federated identity claims where you sign in with Google or Microsoft Entra ID (your verified email address, the provider's issuer and a unique subject identifier). Microsoft sign-in accepts work or school accounts only.

3.2. Organisation & Billing Data (Data Fiduciary context):

• Legal entity name and billing address.

• Goods and Services Tax Identification Number (GSTIN) and State Code.

• The Organisation's contact person's name, email address and telephone number, its authorised billing email address, and transaction histories; the legal name, GSTIN, address, state and billing email are copied onto each payment and invoice record as they stood at the time.

• Payment identifiers, and the payment provider's notifications about each payment as it sent them, which include the payer's email address and telephone number and are emptied ninety (90) days after the payment settles. Full card numbers and banking credentials are never processed or stored on GISweaver servers; you enter them directly into Razorpay's checkout.

3.3. Survey & Workspace Project Data (Data Processor context):

• Survey deliverables in the formats the Platform accepts — uncompressed LiDAR point clouds (LAS), ZIP archives, PDF, GeoJSON, ASCII DXF, and TIFF rasters including GeoTIFF — together with the spatial features derived from them, photographs (PNG, JPEG, WebP, HEIC or HEIF) kept with a project, together with the position and time of capture read from a photograph (see Section 4.1), and videos (MP4, MOV) kept with a project as uploaded, with whatever position and time the recording carries. The accepted and refused formats are listed in Section 3.1 of the Terms of Service.

• Native Spatial Reference Identifiers (SRID / EPSG coordinate codes).

• Project documentation, control point benchmarks, and tender reference files kept with a project.

• Work-layer objects — measurements, annotations, markers, profiles, volumes and design objects — drawn by members of the Organisation, and their revision history.

• Optionally, a picture for a project, set by a member who may edit the project's details. It is sanitized and re-encoded like a profile picture (Section 4.1), shown only to the members of the Organisation who can open the project, recorded in the audit trail only as the fact that it changed, and deleted when the project is permanently deleted or the Organisation's account is erased.

• Direct messages between two members of an Organisation, and messages in private groups of its members, with the replies written in threads under them: their words, who wrote each and when, whether it was corrected or withdrawn, for a group its name, who belongs to it and when each member joined, was added by whom, left or was removed, and whether it is archived, and how far each participant has read. A direct conversation is read by its two participants alone, and a private group by its current members alone; a member added to a group can read its earlier messages and threads. Neither is read by the Organisation's Owner, Administrators or auditor who is not a participant, and not by Alonstech's staff, including while an operator has assumed the Organisation. No export, notification text or telemetry carries their words. The Organisation's search finds a message by its words only for the people who can read that conversation — its two participants, or the group's current members, including a member added later — and never for an Owner, Administrator, auditor or Alonstech's staff who is not a participant; the Organisation's audit trail records no search that found only private messages, and never a count of them. The Organisation's audit trail records only that a direct conversation was started, by whom and with whom, and that a group was created, who was added or removed or left, and that it was renamed, archived or reopened, never a name or a word. A notification to a member names who mentioned them or replied and in which group, and carries no words. They are not end-to-end encrypted, and are disclosed by Alonstech only as Section 5.3 describes, as a manual act authorised by a director of Alonstech and recorded in its staff audit trail. They are erased with the Organisation's whole account. Members of an Organisation can see each other's names and pictures in order to write to each other.

• Invitations issued to prospective members of the Organisation, and the audit record of their acceptance.

• Delivery records and receipts under Section 3.5 of the Terms of Service: which Organisation delivered which survey release to which other Organisation, for what period, and — once every file has been downloaded — a signed receipt stating when, by which route, and the SHA-256 checksum of each file. A receipt names the two Organisations and no person. The receiving Organisation's own audit trail records which of its people downloaded each file taken on its own, and who started each archive download. Where a share of the same release to the receiving Organisation is in the Platform's access record, a file taken on its own is also recorded for the delivering Organisation against an alias the Platform assigns to the person, not their name, unless the receiving Organisation switches on "Show our people's names to senders", in which case their display name is shown there. The delivering Organisation's own audit trail records each file taken on its own naming the receiving Organisation and no person, and records the delivery as taken when its receipt is made; an archive download is written to the receiving Organisation's trail only, not to the delivering Organisation's trail or access record.

3.4. Technical & Operational Telemetry:

• Internet Protocol (IP) addresses. They are used for rate limiting and lockout protection; recorded with each session, sign-in link, pending second-factor challenge and sign-up step; recorded with your acceptance of the Terms of Service as evidence of it; and, for a session, resolved on our own servers to a country, region and city so that the Security screen can show you where each of your sessions was opened. Each entry in an Organisation's audit trail also records the address reduced to its network (for an IPv4 address, with its final part removed), together with the browser family. The Security screen shows the address partly masked. No address is sent to anyone to work out a location.

• Browser user-agent and device characteristics.

• Opaque session tokens (stored only as SHA-256 hashes).

• Reports the application sends from your browser about itself: unhandled errors and page-load performance timings. These carry the page path and the error text, with any query string removed before they leave the browser and again on receipt; they never carry survey data, form input, or the contents of a request or response.

4. Deep Privacy Engineering: Media Sanitization & Operational Telemetry

4.1. Zero-EXIF Media Sanitization.
Field survey teams frequently take profile pictures and capture company logos on-site using mobile devices. Mobile phones automatically embed exact GPS latitude/longitude coordinates, altitude, lens profiles, and exact timestamps into the image's EXIF metadata.

• What we do: When an avatar, corporate logo or project picture is uploaded to GISweaver, the image is first cropped in your browser to the part you place inside its frame, and only that crop is sent. It is then identified by its content, decoded to its pixels alone, scaled down where it is larger to fit within 512 pixels (an avatar or a project picture) or 1024 pixels (a logo) with its proportions kept, and re-encoded afresh as a clean JPEG or PNG. Only that re-encoded image is stored.

• Result: No EXIF segment, camera model, or on-site GPS location survives processing. The file as uploaded is never stored anywhere.

• Project photographs are different, and we say how. A photograph added to a project is kept at the size the Organisation's photo setting chooses, and its embedded metadata — camera make and model, serial numbers, lens, software, altitude, direction and embedded thumbnails — is removed before anybody can download it. Two facts are read from it first and kept with the photograph: the position it was taken at and the time of capture, where the camera recorded them. They are shown openly beside the photograph to the members of the Organisation who can open the project, rather than travelling hidden inside the file. The file as uploaded is kept with the Organisation's other uploads and is not served. A project video is different again: it is kept exactly as uploaded, without conversion, and its embedded metadata, including any position and time the recording carries, is not removed; it is served as uploaded to the members of the Organisation who can open the project.

4.2. Operational Telemetry.
Operational telemetry — system metrics, error reports and performance measurements about the Platform itself — is collected and used to keep the Service reliable, to diagnose and fix faults, and to improve performance. It is designed so that it carries no survey data and nothing that names a person: the attribute names under which a name, an email address, a coordinate, a file name, a token or a tax identifier would be recorded are refused before it leaves the Platform. Free text it carries, such as an error message or the path of a page in the browser, is not screened word by word. It does carry the random identifiers the Platform assigns to accounts, to staff accounts and to Organisations, so that a fault can be traced to the request that caused it; these are pseudonymous identifiers, which Alonstech can link to a person through its own records, so they are personal data. If we ever find telemetry carrying survey data or information that names a person, we treat it as an incident, remove it and close the cause.

5. Lawful Grounds for Processing

The DPDP Act, 2023 admits two grounds for processing personal data, and no others: the consent of the Data Principal under Section 6, and the enumerated "certain legitimate uses" under Section 7. The Act contains no equivalent of a "contractual necessity" or "legitimate interests" ground of the kind found in European law, and Alonstech does not rely on any such ground. Sections 4 to 7 are not yet in force; the scheme below is what Alonstech applies today and what it will be bound by on commencement.

5.1. Consent (Section 6).
We obtain free, specific, informed, unconditional and unambiguous consent by clear affirmative action when you register an account, upload a profile photograph, or subscribe to service updates. Consent may be withdrawn at any time, with the same ease with which it was given; withdrawal does not affect the lawfulness of processing carried out before it, nor Alonstech's retention of records it is required by law to keep.

5.2. Voluntarily Provided for a Specified Purpose (Section 7(a)).
Where you provide personal data to Alonstech for a specified purpose and have not indicated that you object to its use for that purpose, we process it for that purpose. This covers the operation of the workspace you have asked us to provide: authenticating sessions, scheduling ingestion work, rendering maps, resolving project permissions, and answering your support requests.

5.3. Compliance with Law and Judicial Process (Section 7(b), 7(f) and 7(g)).
We process personal data where necessary to comply with any law in force in India, to comply with a judgment, decree or order, and for the performance of a legal obligation to disclose information to the State — including issuing GST tax invoices bearing a consecutive serial number under the Central Goods and Services Tax Act, 2017, maintaining books of account under the Companies Act, 2013, and responding to court orders, regulatory directives and lawful requests from law enforcement under the Information Technology Act, 2000.

5.4. Workspace Data.
Where Alonstech acts as a Data Processor (Section 2.2), the lawful ground for processing personal data contained in a Customer Organisation's workspace is a matter for that Organisation as Data Fiduciary. Alonstech processes such data only on that Organisation's instructions.

6. Specific Purposes of Processing

Alonstech processes personal and workspace data exclusively for explicit, specified purposes:

1. Workspace Delivery & Operations: Provisioning tenant organisations, branches, projects, and managing user roles and delegated permissions.

2. Geospatial Processing: Verifying, structurally validating, converting, reprojecting and rendering survey deliverables.

3. Delivery & Release Records: Enabling an Organisation to publish immutable survey releases within its own membership chain, and maintaining the record of what was published, when, and under which checksum. An Organisation may additionally grant another Organisation with its own GISweaver account read access to one published release, restricted to the layers it names and expiring on a day it sets (Terms of Service, Section 3.4). That grant is made, changed and withdrawn by the sharing Organisation alone; the recipient's people read it inside their own signed-in session, and become members of nothing. What crosses between the two Organisations is the survey content of the named layers, the sharing Organisation's legal name, its own label for the project, and the display name of the person who made the grant — no address, and no roster of either Organisation. Where the sharing Organisation additionally permits it, the recipient may download the release archive; that download is recorded in the sharing Organisation's own trail, naming the recipient Organisation and the grant and no individual of the recipient; once the share is in the Platform's access record, the sharing Organisation's record of looks at the release (at most one for each person in any fifteen minutes) and of each file taken tells the recipient's people apart by an alias the Platform assigns, not by name, unless the recipient Organisation switches on "Show our people's names to senders", in which case their display names are shown there. Where an Organisation asks, with a client's organisation code, to connect its record of that client to the client's own Organisation (Terms of Service, Section 3.4), the client Organisation is shown the requesting Organisation's legal name and when it asked, and the requesting Organisation is shown the client Organisation's legal name and whether the request was accepted; no person of either Organisation is named to the other. Where the client Organisation chooses to share its contact card, its GSTIN or its billing address with an Organisation connected to it, the fields it shares, which may include its contact person's name, email and telephone, are copied into that Organisation's record of it, where they are held as that Organisation's own record of its client and are not updated from the client Organisation afterwards. Where an Organisation names members of its own as contact persons for the Organisations connected to it, it discloses, as the Data Fiduciary for its own people, their name, email address and whether each is named for review or for deliveries to each connected Organisation while the link stands, and nothing else; each person named is notified, may remove themselves at any time, and is no longer shown once removed or once the link ends. Where a project of an Organisation names a client linked to a client Organisation, that client Organisation's owners, administrators and contact persons marked for review are told, once for that project, the Organisation's legal name and its label for the project, and no person of the Organisation is named. Where an Organisation invites a person at its client by email and that address is already a verified GISweaver account, the invitation is also shown in that person's notifications, in each Organisation they belong to, with the inviting Organisation's legal name and its label for the project; the inviting Organisation is not told whether the address holds an account, and the email is sent in every case.

4. Billing & Tax Compliance: Processing customer-initiated renewals, managing payment grace periods, computing CGST/SGST/IGST splits, and generating statutory tax invoices.

5. Security & Abuse Prevention: Enforcing per-IP and per-account lockout protections, defending against brute-force attacks, and quarantining uploads that fail verification or validation (Section 7.3).

6. Customer Communications: Delivering transactional verification emails, invitation links, password reset links, and security notices. (We do not send unsolicited commercial spam or third-party marketing).

7. Technical & Operational Security Measures

Alonstech implements industry-leading organizational and technical safeguards:

7.1. Cryptographic Controls:

• Passwords are salted and hashed with the memory-hard Argon2id key derivation function, using a cryptographically random per-password salt. They are not encrypted, and no process, key or person can reverse them.

• Session tokens are stored solely as SHA-256 cryptographic hashes.

• Sensitive application secrets and database credentials are encrypted at rest using dedicated Key Management Services (AWS KMS / Envelope Encryption).

• All browser and API communications are encrypted in transit with TLS 1.2 or later, preferring TLS 1.3. Browsers are instructed to connect only over HTTPS, to run scripts only from our own origin and from the sign-in challenge and payment providers named in Section 13, and never to guess a file's type; and our cookies are not sent on requests made from other sites (Section 14).

7.2. Tenant Isolation in the Database:

• Every record that belongs to an Organisation is protected by rules the database itself applies to every query, whichever part of the Platform issues it; no account the running Platform uses can switch those rules off.

• Before any Organisation's data is touched, the Platform first establishes which Organisation the signed-in user is acting within, and the database then serves only that Organisation's records.

• A request for a record that is absent, malformed, or belongs to another Organisation is answered in exactly the same way, so that neither the record nor its existence is disclosed.

7.3. Upload Validation & Quarantine:

• Every upload is verified against a SHA-256 checksum computed in your browser before transfer, is identified by its content rather than by its filename, and is structurally validated where a validator exists for its format. Archives are metered against entry-count and expansion limits, and nested archives and path traversal are refused.

• Quarantine on GISweaver is a recorded verdict, not a separate storage system. A file that fails these checks is marked quarantined, is not promoted into an authoritative release, and its sender is notified. Validation is performed by the Platform itself, inside the India cell; there is no separate scanning sandbox, and we do not describe one.

• No antivirus scanner is installed, and malware scanning is presently suspended. The basis, the conditions on which it will be reinstated, and the notice shown to every uploader before a file is chosen are set out in Section 3.1 of the Terms of Service.

8. Sovereign Data Localization & Cross-Border Transfer Boundary

8.1. India Sovereign Cell (in-mumbai-1).

• In strict alignment with the National Geospatial Policy 2022 and 2021 DST Geospatial Guidelines, all Fine-accuracy geospatial data, cadastral parcels, point clouds, user credentials, and tenant metadata generated within India are stored and processed exclusively in AWS Mumbai (in-mumbai-1) within sovereign Indian jurisdiction. Backups of the database and of stored files are copied to AWS Hyderabad (ap-south-2), in India, so that they survive the loss of the Mumbai region, and no backup leaves India; one encryption secret — the key that seals the authenticator secrets of two-factor sign-in — is replicated there in the same way.

8.2. Browser Origins & the Edge Boundary.

• A single origin for the workspace. Your browser loads the authenticated workspace from one host, app.in.gisweaver.com. Everything — pages, data and uploads — travels to that host, which resolves directly to the India cell and is not proxied by anyone. The only other hosts it addresses are the Turnstile challenge, when a form is protected by it, and Razorpay's checkout, while you pay.

• The staff console. Alonstech's staff use admin.gisweaver.com, which is reached through Cloudflare's access gate and proxy before it reaches the India cell. It carries account, billing, membership and support records, and no survey geometry. An operator may assume an Organisation only with a stated reason, recorded in both audit trails; while assuming, the operator can read its members, branches, projects, deliveries, audit trail, client invitations (including the invited person's email address), the record of who outside it has looked at or taken its files, and its invoices, credit notes, payment receipts and billing ledger. Without assuming any Organisation, staff can read support tickets and their attachments, trials that were never paid for and the person who started each, each Organisation's summary page, which shows its Owner's email address and its contact card, the results of the staff search, and usage figures.

• Edge limitations: Cloudflare's services are confined to those listed for it in Section 13: authoritative DNS, the Turnstile challenge, the dispatch of email, the hosting of our public documentation, and the access gate and proxy in front of the staff console. Survey data finer than the threshold value does not transit foreign proxy workers, overseas caches, international queues, or non-Indian storage systems.

8.3. Cross-Border Transfers.

• Alonstech stores and processes personal data and workspace data within India, and does not transfer either outside India for the provision of the Service.

• Section 16 of the DPDP Act (not yet in force) operates permissively rather than prohibitively: it empowers the Central Government to restrict, by notification, the transfer of personal data to a country or territory so notified. Alonstech will observe any such restriction. Where any provision of any other law affords a higher degree of protection to a transfer, that provision prevails.

• Three operational exceptions are disclosed for completeness, none of which carries survey data or spatial coordinates: outbound email is dispatched through Cloudflare's email service; the staff console is reached through Cloudflare's access gate and proxy, so the account, billing, membership and support records Alonstech's staff read there pass through Cloudflare's network; and inbound correspondence to our published mailboxes is received through Google Workspace. All three are described in Section 13.

8.4. Data Residency.
GISweaver operates one data plane today: the India cell (in-mumbai-1 in AWS Mumbai), described in Section 1.2 and Section 8.1 above. If Alonstech later operates a data plane in another region, workspaces created there will be governed by a schedule for that region, and this Policy will be amended before that happens.

9. Data Retention & Permanent Sovereign Access Policy

9.1. The Retention Invariant.

• Payment state never deletes survey data. A company that transitions from a paid tier to the Free tier, or experiences a billing lapse, keeps permanent access to read and view everything it uploaded and published, and to download every file, release and survey file export it holds; its Owner can export its records as a whole.

• We do not run automated sweeps that delete or degrade published survey releases upon subscription expiration. Data uploaded during a free trial that was never paid for and never returned to may be deleted under Terms Section 4.7 — only after at least six months of complete silence and at least four notices, and any sign-in, export or payment ends the process immediately.

• A dormant account — one whose subscription has lapsed and whose workspace has been frozen under Section 4.6 of the Terms of Service — retains all of the above for the entire dormant period, however long it lasts; while frozen it cannot issue a new survey file export (Terms of Service, Sections 3.2 and 4.6). A suspended or a closed Organisation can likewise still read and download everything it holds, and its Owner can still export its records as a whole. Dormancy changes what may be added, never what is kept.

9.2. Statutory & Audit Retention:

• Tax invoices, payment and subscription records: Retained for seventy-two (72) months from the due date of furnishing the annual return for the year to which they pertain, as required by Section 36 of the Central Goods and Services Tax Act, 2017, and where an appeal, revision or investigation is pending, until one year after its final disposal, whichever is later.

• Books of account: Retained for not less than eight (8) financial years immediately preceding the relevant financial year, as required by Section 128(5) of the Companies Act, 2013.

• Where these periods differ for a given record, Alonstech retains it for the longer applicable statutory period.

• Security & access audit trails: Append-only audit records documenting project access, release publishing, membership changes and staff actions are maintained for legal, regulatory and evidentiary integrity. They are append-only by enforcement inside the database itself, not by convention, and they become pseudonymous once the accounts they name have been erased.

• Backups age out on their own schedule; an erasure does not reach into a backup, and Alonstech does not represent that it does. Backups are copied to a second Indian region, AWS Hyderabad (ap-south-2), on the same schedule of ageing out, and never leave India.

• Delivery receipts: Retained for as long as Alonstech operates the Platform, because each is the record of a hand-over that two Organisations may each need to prove to a third party. A receipt names the two Organisations and no person; once an account it names is erased, it names the Organisation alone.

9.3. User-Initiated Deletion & Erasure:

• When an Organisation Owner requests the permanent erasure of the Organisation, personal account profiles and the data covered by the request are permanently erased by an Alonstech operator, by hand, with an aim of thirty (30) days from the confirmation, subject to the statutory retention set out above and to the categories the requester is required to acknowledge before confirming. The erasure procedure, its two modes, and what survives each of them are set out in Section 5.3 of the Terms of Service.

• An individual's own account. The Platform has no control by which a person erases or deactivates their own account. An Owner or Administrator can remove a person from an Organisation, which ends their access to it and does not erase their account. A person who wants their own account erased writes to support@gisweaver.com or to the Grievance Officer at grievance@alonstech.com (Section 15), and the request is handled by hand; where the account is still named by an Organisation's records, those records keep a "Deleted user" placeholder as Section 10.2 states.

• Erasure cannot be triggered by any request the Platform can receive. It requires a recorded intent, an explicit confirmation naming each surviving category, and re-authentication; the destruction itself is carried out by an Alonstech operator using an authority the running Platform does not hold.

10. Rights of Data Principals

Chapter III of the DPDP Act, 2023 confers the rights set out below. Sections 11 to 14 are not yet in force (Section 2.3). Alonstech honours these rights voluntarily and in full from today, and will be bound by them on commencement. Nothing in this Section is to be read as a statement that they are presently enforceable against Alonstech as a matter of statute.

10.1. Right to Access Information (Section 11):
You have the right to obtain a summary of personal data being processed by Alonstech, the identities of all Data Fiduciaries and Data Processors with whom the data has been shared, and any other information prescribed by the DPDP Rules.

10.2. Right to Correction & Erasure (Section 12):
You have the right to request the correction of inaccurate or misleading personal data, the completion of incomplete data, and the updating or erasure of personal data that is no longer necessary for the purpose for which it was collected. A delivery receipt names two Organisations and no person, so an erasure leaves it as it is; it is kept under Section 9.2 because it is the other Organisation's record as much as your Organisation's. Where another Organisation's records still name you — a conversation, a work object, a file, a delivery or an invitation from the time you worked there — that Organisation's record is kept, your identifying details, credentials, sessions and preferences are removed from the account, and the record keeps a "Deleted user" placeholder in your place.

10.3. Right of Grievance Redressal (Section 13):
You have the right to have your grievances redressed by Alonstech through our designated Grievance Officer within the timeframes stated in Section 15. Section 13(3) requires that this redressal be exhausted before a complaint is made to the Data Protection Board of India; if you remain dissatisfied with our response, you may then complain to the Board.

10.4. Right to Nominate (Section 14):
You have the right to nominate an individual who, in the event of your death or incapacity, shall exercise your rights as a Data Principal under the Act.

10.5. Exercising Your Rights:
In your own account settings on app.in.gisweaver.com you may correct the name shown on your account, set or remove your picture, set, change or remove your job title and telephone number (Section 3.1), end any of your sessions, and unlink a sign-in provider. For anything else, erasure of your own account included, send a request to our Privacy Contact and Grievance Officer at grievance@alonstech.com; it is handled by hand. We respond to verified requests within the timeframes stated in Section 15, without undue delay.

11. Children's Personal Data & Age Policy

11.1. Strict 18+ Business Restriction.
GISweaver is exclusively designed as a professional B2B engineering and surveying SaaS workspace. We do not knowingly solicit, collect, or process personal data from individuals under the age of eighteen (18) years ("children").

11.2. Prohibition of Tracking or Targeted Advertising.
Section 9 of the DPDP Act, 2023 prohibits processing likely to cause a detrimental effect on the well-being of a child (Section 9(2)) and, as a composite prohibition, the tracking or behavioural monitoring of children and targeted advertising directed at them (Section 9(3)). That Section is not yet in force (Section 2.3); Alonstech observes it in full today regardless. We engage in no behavioural tracking, no targeted advertising, and no harmful processing, whether directed at minors or at anyone else. If we discover that a user account has been registered by a minor without verifiable parental or guardian consent, the account is removed and its personal data erased by hand, the Platform having no automated means of doing so.

12. Personal Data Breach Protocol & Notification

12.1. Breach Response Framework.
Alonstech maintains an active Security Incident Response Plan designed to detect, contain, mitigate, and remediate any unauthorized access, accidental loss, disclosure, or alteration of personal data.

12.2. Breach Notification.
Section 8(6) of the DPDP Act, 2023 and Rule 7 of the DPDP Rules, 2025 prescribe the breach notification regime. Neither is yet in force (Section 2.3). Alonstech undertakes to follow that regime from today, and in the event of a confirmed personal data breach shall:

• Notify each affected Data Principal and each affected Customer Organisation without delay, describing the nature and extent of the breach, the categories of data affected, its likely consequences, the measures taken to mitigate it, and how the Data Principal may protect their interests.

• Notify the Data Protection Board of India without delay with an initial description of the breach, and provide the Board with detailed information — the events and circumstances leading to it, the measures taken, the findings as to the person who caused it, and the remedial measures implemented — within seventy-two (72) hours, or such longer period as the Board may allow on written request.

13. Sub-processors & Infrastructure Partners

To deliver the high-performance GISweaver platform, we engage trusted infrastructure partners under strict data processing agreements:

Alonstech employs no behavioural advertising tracker, no session-replay or surveillance script, no cross-site data aggregator, and no third-party analytics service. No content delivery network stands in front of the customer workspace; the staff console is reached through Cloudflare, as row (d) above states.

13.1. Notice of Change. Alonstech will publish an updated version of this table before engaging any new sub-processor that processes personal data, and will notify Organisation Owners by email or a prominent workspace announcement not fewer than thirty (30) days before that engagement takes effect, save where a sub-processor must be replaced urgently to maintain the security or availability of the Service, in which case notice will be given as soon as practicable. While the Platform is in beta (Terms of Service, Section 1.6), the updated table on this page, with its date, is that notice, and the thirty days' notice by email or announcement applies from the day Alonstech declares GISweaver generally available; a new sub-processor must still meet Section 8.3.

13.2. Operational Telemetry. Operational telemetry is designed to carry no survey data and nothing that names a person, carries pseudonymous identifiers, and is described in Section 4.2.

14. Cookie & Local Storage Policy

14.1. Strictly Necessary Operational Cookies.
GISweaver sets only strictly necessary cookies. This is the complete list; there are no others. None carries a Domain attribute, so each is scoped to the exact host that set it.

The session and CSRF cookies in the first four rows below, and the sign-in cookie in the seventh, are additionally written with the browser-enforced __Host- prefix — the cookie your browser stores for gisweaver_session is named __Host-gisweaver_session, and so on for the other three. A browser refuses to store a cookie so named if it carries a Domain or is set over an insecure connection, which means no other host can write or overwrite it in your browser. The names are given below without the prefix because that is what identifies each cookie's purpose; the prefix is a security attribute, not a different cookie.

Alonstech's staff reach the staff console at admin.gisweaver.com through Cloudflare's access gate (Section 13), which may set its own cookies, such as CF_Authorization, for that host in the browser of anyone who opens that page. The page is for Alonstech staff; a Customer has no reason to open it.

14.2. Browser Local Storage.
The application stores the following in your browser's local storage. It never leaves your browser, and we cannot read it.

The application's session storage, which your browser clears when the tab is closed, holds gisweaver_signup_ref, a referral code carried from a sign-up link to the sign-up form, and gisweaver.tabOrganization, the identifier of your account and of the organisation that tab is working in, so a refresh keeps the tab in that organisation. It is removed when you sign out.

14.3. No Third-Party or Advertising Storage.
We set no third-party analytics cookie, no advertising cookie, and no cross-site tracking identifier of any kind. You may configure your browser to reject cookies; disabling gisweaver_session will prevent sign-in to the authenticated workspace, and disabling local storage will cause an interrupted upload to restart rather than resume.

15. Privacy Contact & Grievance Redressal Mechanism

15.1. Privacy Contact and Grievance Officer.
Alonstech has designated a single officer who is both the Grievance Officer required of every intermediary by Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the person able to answer on Alonstech's behalf about the processing of personal data.

• Officer: [name published on the GISweaver website and in the application footer]

• Designation: Privacy Contact and Grievance Officer

• Company Legal Name: Alons Advanced Technologies Private Limited

• Corporate Headquarters: Kerala, India

• Grievance Email: grievance@alonstech.com

• Support Email: support@gisweaver.com

Alonstech is not a Significant Data Fiduciary and has not been notified as one. The obligation to appoint a Data Protection Officer under Section 10(2)(a) of the DPDP Act, 2023 applies to Significant Data Fiduciaries; Alonstech has not appointed one, and does not describe the officer above as a Data Protection Officer. Should Alonstech be notified as a Significant Data Fiduciary, it will appoint a Data Protection Officer based in India and publish that officer's business contact information here.

15.2. Grievance Redressal Timelines.

• Acknowledgement: Receipt of any privacy grievance, consent withdrawal, or data enquiry will be formally acknowledged within twenty-four (24) hours.

• Disposal: The grievance will be investigated, redressed and disposed of within seven (7) days from the date of its receipt, in accordance with Rule 3(2)(a) as amended by G.S.R. 120(E) dated 10 February 2026.

• This mechanism is available to any user of the Platform and to any victim, whether or not that person is a user or a Customer.

15.3. What the DPDP Act Will Require, and When.
Sections 6(3), 8(9), 8(10) and 13 of the DPDP Act, 2023 — which require, respectively, contact details within a consent request, the publication of the business contact information of a Data Protection Officer or of a person able to answer on the Data Fiduciary's behalf, an effective grievance redressal mechanism, and the Data Principal's right to it — are not yet in force (Section 2.3). Alonstech has put all four in place voluntarily, ahead of commencement, and will comply with each as a statutory obligation when it commences.

15.4. Escalation to the Data Protection Board of India.
Section 13(3) of the DPDP Act requires a Data Principal to exhaust the Data Fiduciary's own grievance redressal before approaching the Board. If you are not satisfied with our response, you may lodge a complaint before the Data Protection Board of India in accordance with the Act, on and from the commencement of the relevant provisions.

16. Policy Updates & Material Modifications

16.1. Periodic Review. We review and update this Privacy Policy periodically to reflect technological enhancements, operational changes, and updates to Indian data protection rules or geospatial regulations.

16.2. Notice of Changes. When material changes occur, we will post the updated policy with a revised "Last Updated" date and notify registered Organisation Owners via email or prominent workspace announcements at least thirty (30) days prior to the effective date. Your continued access to or use of the Platform after the effective date signifies your acknowledgment and acceptance of the updated terms. While the Platform is in beta (Terms of Service, Section 1.6), Alonstech may change this Policy at any time; the version published on this page, with its date, is the one in force, and the notice period in this Section applies from the day Alonstech declares GISweaver generally available. Such a change does not loosen where personal data and survey data are kept and processed (Section 8) or the security measures of Section 7.