This policy explains what personal data Diemeco ("we") collects through Diemeco, why, who sees it, and what control you have. We handle personal data in line with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.
1. What we collect
- Account: your mobile number (used to sign in with a one-time code or an early-access pass), and the email address you confirm for notices.
- Profile: name, company or workshop name, city and state, logo, description, GSTIN where you give it, machines, materials and processes, and, for Workshops, photos of the workshop and of work done, and how much free capacity you have this week.
- Requirements and files: what you post, drawings, CAD files, images and documents you upload, and a record of which Workshop opened or downloaded each file, and when.
- Messages and quotations you send or receive on the Platform, reviews, and order confirmations (the terms a Client records and a Workshop confirms). From message times we work out a Workshop's usual reply time.
- Connections and favourites: when a Client joins or connects through a Workshop's card link, or a Workshop joins through a Client's invite link, we record that link between them, and which video link, if any, someone signed up from. We also keep the workshops a Client marks as favourites and the clients a Workshop marks as favourites.
- Payments: during early access we take no payments. Once payments start, we will keep the plan you chose, the amount, date and status, and your receipt; card, UPI and bank details are handled by the payment provider, not by us. We never ask for your UPI PIN, card or bank login. Records of any earlier credit requests are kept as section 5 says.
- WhatsApp: when you ask for an early-access pass or for more free credits, or when our team tells a Workshop about a matching requirement, we contact you on WhatsApp at the number you sign in with, and keep what is needed for that.
- Usage and security: notifications, preferences, audit records of important actions (such as payments and verification decisions), and technical data such as IP address needed to keep the service secure and to limit abuse.
2. Why we use it
- To create and secure your account, and to match Clients with suitable Workshops.
- To show a Workshop the requirement details it has used credits to unlock, and to let users message, quote and confirm orders.
- To show Clients a Workshop's trust level, photos and reply time, and to show each Workshop's visiting card to people it shares the link with.
- To tell Clients who opened their files, so they can see their designs are only seen by Workshops they let in.
- Once payments start: to process payments, issue receipts and invoices, keep tax records and prevent fraud.
- To verify GST details, handle reports, and enforce our Terms.
- To send you notices about your account, messages, quotations and payments.
We do not sell your personal data.
3. Who sees what
- Other users: a Workshop's profile (name, city, machines, materials, photos, reviews, reply time, free capacity and trust level) is visible to Clients who are in touch with it. A Client's requirement is visible to matching Workshops only in the detail the Client allows; contact and file details are revealed to Workshops that unlock or are approved. A requirement sent only to one Workshop is visible to that Workshop alone. Files marked view-only are shown as watermarked images, never as the original. A Client can see which Workshop opened each of their files and when. A Workshop can see which clients joined through its card.
- Anyone with a Client's invite link: it shows the Client's company name (or name), city and state, and nothing else. The Client decides whom to send it to.
- Favourites: a Workshop's list of favourite clients is visible only to that Workshop; the Client is not told. A Workshop learns that a Client favourited it only when the Client chooses to alert its favourite workshops about a requirement.
- Anyone with a Workshop's card link: each Workshop has a visiting card page that it can share. It shows the Workshop's name, city and state, logo, description, kinds of work, machines, materials, photos, ratings and recent reviews (without reviewers' names), completed orders, reply time, free capacity and trust level. It never shows a phone number, email or GSTIN. Unless the Workshop switches it off on its profile page, the card and the Workshop's name, area, kinds of work, machines and materials also appear in Diemeco's public lists of workshops by kind of work and city, and search engines such as Google may list them.
- Service providers (data processors) who process data for us, only on our instructions and under written terms: Supabase (database, authentication and file storage, in Mumbai, India), Vercel (application hosting, in Mumbai, India), GitHub (Microsoft), which stores our private weekly backups, an SMS provider that delivers sign-in codes, WhatsApp (Meta) for payment requests and passes, an email provider that delivers our notices, and the push-notification services of your phone or browser, if you turn alerts on. Some of these providers may process data outside India. When we add a provider, such as an online payment provider, we will name it here first.
- Authorities where the law requires it, or to protect rights, safety or against fraud.
4. Cookies, counts, alerts and emails
We use only the cookies needed to keep you signed in, to remember your language and theme, and to protect the service. We do not use advertising cookies. We keep anonymous counts of visits to our public pages (which page, roughly where the visit came from, and the language), with no cookie and no personal identifier. If you arrive through one of our video links (an address ending in ?c= and a short name), a small cookie remembers that video's name for 30 days, so we can see which videos bring people who sign up; it holds nothing about you. If you turn on phone alerts, we store the address your device gives us so that we can send notifications, and you can turn them off at any time. Every email we send has a one-click link to stop emails, and you can change email settings on your Profile.
5. How long we keep it
- Account and profile data: while your account is active. When you delete your account, or one of your two profiles, it is first closed and hidden for 30 days; signing in again with the same mobile number, or opening that profile again, in that time restores it. After 30 days the profile details are removed, and the sign-in too once no profile is left, except the records listed below.
- Free starting credits: to give them only once per mobile number, we keep a one-way coded form of each number that received them (it cannot be turned back into the number), also after the account is deleted.
- Uploaded files, and the record of who opened them: deleted after the requirement is removed (with a short technical delay).
- Workshop photos: until the Workshop deletes them or its account.
- Order confirmations: as long as the requirement they belong to, because both sides may need them as a record.
- Payment screenshots and WhatsApp messages about a payment: deleted within 90 days after the payment is confirmed or the request is closed.
- Receipts and payment records: 8 years, as tax and accounting law requires.
- Backups: a full copy of the database is made every week and kept for 90 days; a copy of uploaded files is kept for 35 days. Both are private and then deleted automatically, so something you delete may remain in a backup until that backup expires. We use backups only to recover from an accident.
- Security and access logs: at least 1 year, as the Digital Personal Data Protection Rules, 2025 require, then deleted.
6. Your rights
You may ask to access, correct or delete your personal data, withdraw consent where we rely on it, and nominate someone to exercise these rights for you. Many corrections you can make yourself in your profile. Deleting data we must keep by law (such as invoices) may not be possible until the retention period ends. Write to the Grievance Officer below: we acknowledge within 24 hours and respond within the time the law prescribes. If you are not satisfied, you may complain to the Data Protection Board of India.
7. Security
Data is encrypted in transit; files are kept in private storage and released only through short-lived secure links; access to records is restricted by the database itself, not only by the application. No system is perfectly secure, so please protect your phone and do not share codes. If a breach affecting your data occurs, we will tell you without delay and report it to the Data Protection Board of India within 72 hours, as the law requires.
8. Children
The Platform is for business use by adults. We do not knowingly collect data from anyone under 18.
9. Changes
We may update this policy and will show the new date above. If a change is significant we will tell you in the Platform.
10. Consent, children and complaints
When you sign in we record which version of the Terms and Privacy Policy you accepted, and when. When you create a Workshop or Client profile we record that you accepted the Workshop Agreement or the Client Agreement. You can withdraw consent by deleting your account, though some records must be kept as section 5 explains. See our Grievance Policy for how to complain and what to expect.
11. Contact and Grievance Officer
Grievance Officer: Amish Pathan, Diemeco, Bhagwati Society-1, Dudhsagar Road, Shakti Industrial Zone, Rajkot, Gujarat, India, 360003. Email: support@diemeco.com.