Privacy Policy

Introduction

PRAMAAN is a hardware diagnostics and device health testing software developed and operated by Gadget Guruz Technologies Pvt Ltd ("Company", "we", "our", "us"). PRAMAAN is designed to evaluate the performance, stability, and lifecycle health of electronic devices — including laptops, desktops, and other hardware — and to generate verified device health reports and QC certificates.

This Privacy Policy explains how we collect, use, store, disclose, and protect information when you install, access, or use:

• The PRAMAAN desktop application
• The PRAMAAN website at pramaan.gadgetguruz.com
• The PRAMAAN enterprise dashboard and reporting portal
• Any PRAMAAN APIs, integrations, or related services (collectively, the "Service")

This Policy applies to all categories of users:

• Individual users running diagnostics on their own devices
• Technicians using PRAMAAN for device testing before and after repair
• Enterprises and IT administrators using PRAMAAN for asset health monitoring
• Refurbishers and recyclers using PRAMAAN for device certification before resale or disposal
• Insurance providers using PRAMAAN health scores for device risk classification
• Visitors to the PRAMAAN website or dashboard portals

Data Fiduciary Details

As per Section 2(i) of the DPDP Act, 2023, Gadget Guruz Technologies Pvt Ltd is the Data Fiduciary for all personal and diagnostic data processed through PRAMAAN.

What PRAMAAN Does — Design Principles

PRAMAAN is built on a principle of minimal data collection. It is a hardware diagnostic tool — not a surveillance tool, monitoring tool, or data harvesting platform. Its sole function is to assess the physical health of a device's hardware components and generate a standardised, verifiable health report.

Every permission that PRAMAAN requests from your operating system is used exclusively for hardware diagnostics. See Section 9 for a full list of permissions and the specific reason each is required.

Information We Collect

4.1 Account & Registration Data

When you create a PRAMAAN account or purchase a license, we collect:

4.2 Device Diagnostic Data

When PRAMAAN runs a diagnostic scan, it collects the following hardware-level data:

4.3 Usage & Performance Data

• Test timestamps and diagnostic session durations
• Feature usage statistics (e.g. which diagnostic modules were run)
• Crash reports and error logs, including software version and failure nature
• Diagnostic model performance metrics

This data is collected in aggregated or pseudonymised form where possible and used solely for improving PRAMAAN's diagnostic accuracy and software stability. It is never used for advertising or sold to third parties.

4.4 Enterprise Asset Data

For enterprise deployments, PRAMAAN may collect and maintain: device inventory, diagnostic history per device, component change logs, repair history records, and lifecycle analytics. This data is visible only to authorised administrators within the customer organisation.

4.5 Certification & Report Data

Each completed diagnostic generates a permanent, verifiable record: a device health score, a detailed QC report, a unique Certificate ID, a verification QR code, and the test timestamp and PRAMAAN version used.

What PRAMAAN Does Not Collect

How We Use the Information — Purpose Limitation

In accordance with Section 4 of the DPDP Act, 2023, all data collected by PRAMAAN is used only for the specific purposes stated below.

Consent (Section 6, DPDP Act 2023)

We process your data only on the basis of free, specific, informed, unconditional, and unambiguous consent, as required by Section 6 of the DPDP Act, 2023.

7.1 How Consent Is Obtained

• A dedicated consent screen is displayed during PRAMAAN installation, before any diagnostic data is collected or transmitted
• At first launch, you are presented with a clear notice of what data will be collected and for what purpose, and asked to provide explicit consent before proceeding
• Consent is not bundled with general terms and conditions — each distinct processing purpose is presented separately
• For enterprise deployments, the enterprise administrator is responsible for ensuring device users are informed of and have consented to the use of PRAMAAN diagnostics

7.2 Withdrawing Consent

You may withdraw consent at any time without affecting the lawfulness of prior processing. To withdraw consent:

• Uninstall PRAMAAN from your device (this terminates all future data collection from that device)
• Submit a data deletion request to [email protected]
• Enterprise administrators may contact their PRAMAAN account manager or email [email protected]

Notice to Data Principals (Section 5, DPDP Act 2023)

Before or at the time of collecting your data, PRAMAAN provides a clear Notice that includes:

• The categories of data being collected
• The specific purpose for which each category is collected
• The identity and contact details of the Data Fiduciary and Grievance Officer
• Any third parties with whom data may be shared
• Your rights as a Data Principal and how to exercise them
• The data retention period applicable to your data

This Notice is presented as a mandatory consent screen at installation and at first launch, and is also incorporated into the PRAMAAN EULA, available at pramaan.gadgetguruz.com/eula.php.

Software Permissions

To perform hardware diagnostics, PRAMAAN requires certain system-level permissions. Below is a complete, transparent list of every permission required and the specific reason it is needed.

Data Storage and Security (Section 8, DPDP Act 2023)

We implement appropriate technical, administrative, and organisational safeguards to protect your data. Our security measures include:

• TLS/HTTPS encryption for all data transmitted between PRAMAAN and our servers
• Encryption of stored data at rest using industry-standard algorithms
• Passwords stored as one-way cryptographic hashes — never in recoverable plain text
• Role-based access controls ensuring only authorised personnel can access data
• Multi-factor authentication for enterprise dashboard access
• Secure server infrastructure on enterprise-grade cloud providers
• Regular security audits, vulnerability assessments, and penetration testing
• Contractual data protection obligations imposed on all third-party sub-processors

In the event of a personal data breach likely to result in a risk to your rights and interests, we will notify the Data Protection Board of India and affected Data Principals within the timelines prescribed under the DPDP Act, 2023.

Sharing of Data

We do not sell, rent, or trade your personal or diagnostic data. Data is shared only in the following specific and limited circumstances:

11.1 Enterprise Administrators

For enterprise deployments, device diagnostic data is shared with authorised enterprise administrators as contracted, governed by the PRAMAAN Enterprise License Agreement and a Data Processing Addendum (DPA).

11.2 Service Providers & Sub-Processors

We engage trusted third-party vendors for cloud infrastructure, software hosting, customer support tools, and analytics. All sub-processors are bound by Data Processing Agreements requiring DPDP-equivalent data protection standards.

11.3 Certificate Verification

PRAMAAN-generated certificates include a Certificate ID and QR code for independent third-party verification. When scanned, the verifier receives a read-only summary of the device health report. No personal data about the device owner is included in the publicly verifiable certificate summary.

11.4 Legal Requirements

We may disclose data when required by applicable law, court order, or regulatory directive, including to the Data Protection Board of India. We will, where legally permissible, notify affected users before such disclosure.

11.5 Business Transfers

In the event of a merger, acquisition, restructuring, or asset sale, PRAMAAN data may be transferred as part of the transaction. We will notify affected Data Principals prior to such a transfer and ensure the receiving entity is bound by equivalent privacy obligations.

11.6 Cross-Border Transfers

If processing involves transferring personal data outside India, such transfers are conducted only to countries notified as permissible by the Central Government under the DPDP Act, or where adequate contractual safeguards are in place. Enterprise customers requiring data residency within India may request this — contact [email protected].

Data Retention & Deletion

We retain data only for as long as necessary to fulfil the stated purpose or to comply with legal obligations. On expiry, data is securely deleted or irreversibly anonymised.

Rights of Data Principals (Sections 11–14, DPDP Act 2023)

As a Data Principal, you have the following statutory rights under the DPDP Act, 2023:

All rights requests will be acknowledged within 48 hours and resolved within 30 days. If a request is denied, we will provide written reasons and inform you of your right to escalate to the Data Protection Board of India.

Children's Privacy (Section 9, DPDP Act 2023)

PRAMAAN is intended for professional and enterprise use and is not directed at individuals under the age of 18. We do not knowingly collect data from minors.

As required by Section 9 of the DPDP Act, if a user is or may be under 18, verifiable consent from a parent or lawful guardian must be obtained before any data is collected or processed.

Third-Party Services and Integrations

We impose contractual data protection obligations on all third-party processors. However, Gadget Guruz is not responsible for the independent data practices of third-party services beyond what is governed by our agreements with them.

Applicable Laws and Compliance

PRAMAAN's data practices comply with the following applicable laws and standards:

• Digital Personal Data Protection (DPDP) Act, 2023 — India's primary data protection legislation governing personal data processing
• Information Technology Act, 2000 (and IT Amendment Act, 2008) — Governing electronic records, cybersecurity, and data security obligations
• IT (Reasonable Security Practices) Rules, 2011 — Security standards for sensitive personal data
• Applicable enterprise data security standards relevant to enterprise PRAMAAN deployments (e.g. ISO 27001-equivalent controls)

Grievance Redressal (Section 13, DPDP Act 2023)

If you have any complaint, concern, or grievance regarding the collection, use, storage, or disclosure of your data by PRAMAAN, please contact our Grievance Officer:

If you are not satisfied with the resolution provided by our Grievance Officer, you have the right to escalate your complaint to the Data Protection Board of India under Section 18 of the DPDP Act, 2023.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Post the updated Policy on pramaan.gadgetguruz.com with a revised Effective Date and version number
• Display an in-app notification in PRAMAAN and/or send an email notification to registered users for significant changes
• Seek fresh and explicit consent where new or expanded processing activities require it under the DPDP Act

Continued use of PRAMAAN after the Effective Date of any revision constitutes your acceptance of the updated Policy.

Contact Us

For any questions, requests, or concerns about this Privacy Policy or PRAMAAN's data practices: