Privacy Policy

This Privacy Policy ("Policy") describes how SIMAYU SOLUTIONS PRIVATE LIMITED, an Indian private limited company having its registered office in India and operating under the brand name "Zantras" ("Zantras", "we", "us", "our"), collects, processes, retains, discloses, and protects personal data through the websites zantras.com, api.zantras.com, app.zantras.com, enterprise.zantras.com, and hub.zantras.com and the application-programming interfaces, software development kits, and hosted user-flows made available thereunder (collectively, the "Platform").

Zantras provides business-to-business identity-verification services to enterprise customers — including banks, non-banking financial companies, insurers, payment service providers, and telecommunications operators (each, a "Merchant"). The Merchant's end-customers ("Data Principals") interact with Zantras only through hosted flows invoked by the Merchant.

This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDPA"), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules 2021").

Our obligations under the DPDPA depend on the context in which we handle your personal data:

• Data Processor — When we process personal data of a Merchant's end-customer (a Data Principal) on behalf of and under the documented instructions of that Merchant, the Merchant is the Data Fiduciary and Zantras is the Data Processor. The Merchant is responsible for the lawful basis (notice and consent) on which that data is collected. Our processing terms are governed by the Data Processing Agreement.
• Data Fiduciary — When we process personal data of Merchant employees, prospective Merchants, website visitors, job applicants, or other individuals interacting directly with us, Zantras is the Data Fiduciary and this Policy describes the lawful basis, purposes, and retention applicable to that processing.

The categories of personal data we collect depend on how you interact with the Platform.

By default, all Aadhaar numbers returned by the OCR endpoint are masked as XXXX XXXX 1234. Unmasked Aadhaar numbers may be returned only to Merchants that have a documented lawful basis under the Aadhaar Act and have explicitly opted in under their service agreement.

We process personal data only for the following purposes:

• Identity verification & liveness detection — performing the verification requested by the Merchant.
• KYC document OCR — extracting fields from identity documents uploaded by the Merchant.
• Fraud prevention — detecting replay attacks, deep-fakes, and stolen-credential reuse.
• API metering & billing — calculating Merchant usage and issuing invoices.
• Security monitoring & audit — investigating incidents and maintaining audit trails required by law.
• Service operation — running and improving the Platform, including capacity planning and reliability engineering.
• Legal compliance — responding to lawful requests from regulators, courts, or law-enforcement agencies.

We do not sell personal data, do not use identity data for advertising, and do not share identity data with any third party other than the sub-processors listed in Section 9.

Our lawful basis for processing depends on the data category:

• For Data Principal identity data — processing on behalf of the Merchant under Section 7(b) of the DPDPA, on the consent obtained by the Merchant under Section 6.
• For Merchant account & billing data — contract performance with the Merchant and legal obligation (tax, accounting).
• For website analytics & non-essential cookies — consent obtained via our cookie banner.
• For security logs — legitimate uses under Section 7(f) of the DPDPA.

Zantras processes and stores personal data entirely within India:

• All compute (AWS Lambda) runs in the ap-south-1 (Mumbai) region.
• All object storage (Amazon S3) buckets used for identity documents are pinned to ap-south-1; cross-region replication is disabled.
• Session metadata (Amazon DynamoDB) is stored in ap-south-1.
• Access logs (Amazon CloudWatch) are retained in ap-south-1.

We retain personal data only for as long as necessary for the purpose for which it was collected, then we delete or anonymise it. The table below sets out the standard retention schedule.

We engage the sub-processors listed below to deliver the Platform. The current authoritative list is published at zantras.com/legal/sub-processors.

We notify Merchants of any addition or replacement of a sub-processor at least 30 days in advance. Merchants may object to a change as set out in the Data Processing Agreement.

Under Sections 11 to 14 of the DPDPA, every Data Principal has the rights set out below. Where Zantras processes your data on behalf of a Merchant, please address your request to that Merchant first; we will assist them in responding.

The liveness score and face-match score returned by the Platform are produced by AWS Rekognition machine-learning models. Zantras does not make the final business decision to accept or reject any end-customer; the Merchant alone decides how to act on the score, in line with the Merchant's own underwriting or compliance policy.

Zantras does not knowingly direct the Platform at individuals under the age of 18. Where a Merchant submits a minor's identity document or facial image, the Merchant warrants that it has obtained Verifiable Parental Consent under Section 9 of the DPDPA. We do not perform behavioural tracking, targeted advertising, or profiling on data relating to children.

We protect personal data using a defence-in-depth program aligned with SPDI Rule 8 and ISO/IEC 27001 control objectives:

• TLS 1.2 or higher for data in transit; AES-256 (S3 SSE-KMS) for data at rest.
• AWS IAM least-privilege roles, MFA enforced on all administrative access, quarterly access review.
• Annual third-party penetration test (VAPT); continuous vulnerability scanning.
• NTP synchronisation to NIC / NPL India time sources (CERT-In Directions, Section III).
• 180-day retention of ICT system logs within India (CERT-In Directions, Section IV).
• Incident-response plan with 6-hour CERT-In reporting and 24-hour Merchant notification.

For any privacy question or to exercise any right described in Section 10, please contact our Grievance Officer:

• Email: grievance@zantras.com
• Postal address: SIMAYU SOLUTIONS PRIVATE LIMITED, India (full address published at zantras.com/legal/grievance-redressal)

For data-protection matters that require escalation beyond our Grievance Officer, you may contact our Data Protection Officer at dpo@zantras.com or file a complaint directly with the Data Protection Board of India.

We may update this Policy from time to time. Material changes — changes that affect your rights or the scope of processing — will be notified by email to registered Merchants and by an in-product banner at least 30 days before they take effect. Editorial changes (typography, links) are recorded in the changelog below without prior notice.

• v1.0 — 5 June 2026. Initial publication.