Privacy Policy

1. Our role under the DPDP Act, 2023

For the personal data you give us to run your account (name, email, mobile, address), Perk Annex Enterprises Private Limited, operating as "Bylox", is a Data Fiduciary. Where we digitize or scan documents on your instruction, we act as a Data Processor of that content, processing only on your documented instructions.

2. What we collect

• Account data: name, email, verified mobile number
• Pickup/delivery addresses, and your live location while a pickup or delivery job is active (to coordinate the visit and power the tracking link we may share with you)
• Booking, item, inventory, retrieval, and billing records
• Identity documents and reference photos we collect to verify you at return/handover visits (pickups are verified by OTP and body-worn camera)
• Photos, videos, and notes you or our staff add to an item's activity log or your order's photo gallery
• Security question answers, set by you and stored hashed, used only to reset your MPIN
• Device/usage data needed to operate the service securely

3. How we use it

• To provide pickup, storage, inventory, and retrieval
• To verify your identity (Google sign-in, mobile OTP, a body-worn camera at pickup, and in-person government-ID checks at return/handover)
• To coordinate and track an active pickup or delivery, including any temporary tracking link we share with you
• To process a service request you raise: retrieval, digitization, destruction, courier, or a custom request
• To send service updates and item-status notifications
• To bill you and issue GST-compliant invoices

4. Consent, security & your rights

We process your data with your consent for the purposes above. We apply reasonable security safeguards (access controls, logging, and encryption for digital records) and require equivalent safeguards from any sub-processor.

You may access, correct, or request erasure of your personal data, nominate a contact, and raise a grievance with our Grievance Officer, Koteswara Rao R, reachable at hello@bylox.in or +91 89777 28759. On account closure we return or securely delete your data, subject to lawful retention needs.

5. Digitization, destruction & consent

Opening a sealed wallet to digitize it, or destroying any stored item, requires your explicit two-factor consent: the MPIN you set on your account, plus a one-time passcode we send to your registered email at the time of the request. If you forget your MPIN, you can reset it by answering the security questions you set when creating it; we store both your MPIN and your security-question answers in hashed form, never as plain text. We keep a record of every consent given, and the request it was tied to.

Sending an item by courier, or raising a custom request, does not use this consent flow, since nothing is opened or destroyed.

6. Where your data lives

Digitized documents are stored in encrypted cloud storage hosted on servers located in Hyderabad, India. Bylox does not access or use the content of your stored data beyond operating the service and fulfilling your instructions.

A pickup/delivery tracking link we share with you or a nominated recipient works without login, and stops working automatically once the job it was created for is no longer active — we don't keep it valid indefinitely.

7. What we don't do

• We do not open sealed Vault items. Vault is never digitized or opened by Bylox under any circumstances
• We do not expose digitized documents by public or shareable link; access is only through short-lived, authenticated links
• We do not keep a tracking link active once the pickup/delivery job it was created for has ended
• We do not sell your personal data
• We do not disclose your identity or stored items without consent, except as required by law