1. Introduction
Laabam One Business Solutions OPC Pvt Ltd ("Company", "we", "our", or "us") operates the Cyber Rakshak antivirus for Windows, the Cyber Rakshak mobile application, and this website (collectively, the "Service"). This Privacy Policy explains what personal data we collect, why, how long we keep it, and what choices you have.
Where the product is today. The Windows antivirus is built but is not yet available to download. The account, threat-signature and evidence services behind it are running. The mobile app has not been released and is not listed on any app store; the web & server product has not been built. This policy describes the data the Service handles today — where a feature is not released, the data it would involve is not being collected.
2. Data We Collect
2.1 Information You Provide
- Your name and email address when you register. If you sign in with Google, Facebook or Microsoft, we receive the name and email address that provider releases to us
- Your mobile number, if you register or sign in with a one-time passcode sent to it
- One-time passcodes used to verify it is you, and a PIN if you set one
- Emergency and trusted contacts you add
- Child profile information you enter as a parent or guardian
- Evidence files you choose to capture, and the notes you attach to them
- Incident reports you create
- Links and messages you submit to be checked
- Anything you send us through the contact form or by email
2.2 Automatically Collected Data
- From the Windows antivirus: file hashes only. When the app checks a file against our threat feed it sends the file's hash — a short fingerprint — and receives back whether we know it. The file itself never leaves your machine
- Device and licence information — a device identifier and name, the operating system and the application version — so that your trial or subscription is applied to the right device
- Security records: every consent you grant or withdraw is recorded with a timestamp, the IP address the request came from and the identifying string your browser or app sends with it. Sign-in records are kept in the same way
3. Consent-Based Data Collection
Cyber Rakshak operates on a consent-first model, and it is enforced in the software rather than promised in prose: the evidence endpoints sit behind a consent check, and a request that arrives without the matching consent on record is refused. Every grant and every withdrawal is written to a consent log with a timestamp, the IP address it came from and the device that sent it.
Coming at launch: a Consent Management screen in the mobile app where you can see and change every consent yourself. It is not built yet. Until it ships, email us at support@cyberrakshak.ai to withdraw a consent and we will record the change.
4. How We Use Your Data
- To provide and maintain the Service, and to support you when you ask
- To check the hashes your antivirus submits against our threat feed, and to check links and messages you submit against known scam patterns
- To store the evidence records and incident reports you create
- To take payment, apply your trial or subscription, and issue refunds where they are due
5. Data Security
What is in place today:
- Evidence records are immutable. Once a record is written, the server refuses to change the file, its hash, when it was captured or where, and refuses to delete it at all. Only the verification flag and the record's metadata can be changed afterwards
- Requests that reach your account data, your evidence or your incidents require a signed-in session; evidence requests additionally require your consent on record. A few endpoints are open by necessity — the contact form, the payment provider's callback, and the antivirus's hash lookup and update check, which both run before anyone signs in
- Traffic between your device and our servers is encrypted in transit over HTTPS/TLS
- Consent changes and evidence exports are written to an audit log
- Threat signatures are cryptographically verified against a pinned publisher root before we ingest them, so a tampered feed is rejected rather than distributed
What we do not claim
- We encrypt evidence files ourselves before storing them, but we do not offer end-to-end encryption: we hold the keys, so we could in principle read a file, and a lawful order could require us to
- No external security audit or penetration test has been commissioned. When one is, we will name the auditor and the date here
- An independent review of how we encrypt and store evidence has not been commissioned. Our own tests are not the same as someone else checking
6. Data Sharing
We do NOT sell, trade, or share your personal data with third parties for marketing purposes. We share data only in these limited cases:
- With law enforcement, when you choose to file a report and export evidence to them, or where Indian law requires it of us
- Inside the Company: staff who run the Service can see evidence records, and the account they belong to, in our internal administration tools
- If you send us a threat report, it is stored for review. It is not published to other users
- With the service providers who run the Service for us — hosting and storage, and Razorpay for payments. Card numbers, UPI PINs and bank credentials go directly to Razorpay; we never receive or store them. We keep only a payment reference, so a payment can be matched to your account and refunded under our Refund & Cancellation Policy
7. Data Retention and Deletion
- Account and profile data is kept for as long as your account exists
- Evidence records are kept indefinitely and cannot be deleted — not by you, not by us, and not after a waiting period. The same rule that stops an exhibit being altered also stops it being removed. Please take that into account before you capture something
- Consent and audit logs are kept as the record of what you agreed to and when
There is no self-service account deletion today, and no automatic purge job. If you want your account closed, email us and we will close it and stop any billing; evidence records that already exist will remain, for the reason above. An erasure route that satisfies the DPDP Act, and how it is to be squared with evidence immutability, is unfinished work — we would rather say so than publish a retention promise the software does not keep.
8. Your Rights
Available today:
- Access the personal data held on your profile
- Correct inaccurate data
- Withdraw a consent you have given (see §3)
- Export an individual evidence record
- Raise a complaint with our Grievance Officer (§9), and with the Data Protection Board of India
Not available yet, and we will not pretend otherwise:
- A single portable export of your whole account
- An incident report as a PDF
- Self-service erasure — see §7
9. Grievance Officer
Complaints about how your personal data is handled can be addressed to the Grievance Officer, Laabam One Business Solutions OPC Pvt Ltd, by email at support@cyberrakshak.ai.
10. Children's Privacy
Under the Digital Personal Data Protection Act, 2023, anyone under 18 is a child. We do not knowingly process a child's personal data without verifiable consent from a parent or guardian. Child profiles exist only inside a parent or guardian's account and are created and managed by that account holder. The children safety features ship with the mobile app, which has not been released.
11. The Law This Policy Is Written To
This policy is written to the requirements of the Information Technology Act, 2000 and the rules made under it — including the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 — and to the Digital Personal Data Protection Act, 2023.
We hold no compliance certification and have not been audited against either statute, so we do not claim to be certified. Obligations we have not yet implemented in full — erasure and portability in particular — are named in §7 and §8 rather than covered over. The apps are not distributed through any app store today, so no store's distribution policies apply to us yet.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date above. Continued use of the Service after changes constitutes acceptance of the updated policy.
13. Contact Us
If you have questions about this Privacy Policy, please contact us:
- Email: support@cyberrakshak.ai
- Company: Laabam One Business Solutions OPC Pvt Ltd
- Registered office: 285 A, Anna Nagar East Cross Street, Sathamangalam, Madurai, Tamil Nadu 625020, India