Privacy Policy

Effective Date: April 15, 2026 Data Fiduciary: Diametor (A unit of Vendbout Pvt Ltd)

Diametor ("we," "us," or "the Company") is committed to protecting the privacy of our users ("Data Principals"). This policy explains how we collect, process, and safeguard your digital personal data when you use our settlement cycle inside the diametor app.

1. Identity & Contact Data: Full name, phone number, and email address collected via Google OAuth or production auth hooks.
2. Financial & Core Graph Data: Details of debt and credit obligations manually entered (creditor or debtor Tors), including names, emails, phone numbers of counterparties, and bottleneck amounts.
3. Bank KYC & Payout Data: Full bank account numbers, IFSC codes, account holder names, and associated billing details required to process endpoint or loan payouts via RazorpayX.
4. Mandate & Transaction Data: Subscription IDs, payment IDs, mandate statuses, and billing logs processed via Razorpay Subscriptions for Pay Later billing.

We process your data strictly for the following Lawful Purposes:

1. Cycle Matching: To allow our AI to identify circular debt loops between you and other users.
2. The Handshake: To notify your counterparties of a pending debt/credit entry for their verification.
3. Node Validation & Fee Collection: To process upfront Pay Now transactions (including calculating the 12% discount) or managing Pay Later recurring mandates via Razorpay.
4. Graph Discovery & Cycle Matching: To build node-disjoint directed graph networks using NetworkX, identifying closed loops and loan inter-cycles.
5. Automated Payout Execution: To seamlessly transfer funds via RazorpayX Payouts from the platform pooling account directly to chain endpoint users or bank/NBFC lenders.
6. Legal Documentation & Certification: To issue verifiable public Certificates of Payment, Discharge, or Loan Closure mapping the cleared balances under Section 62 of the Indian Contract Act, 1872.
7. Legal Compliance: To fulfill KYC (Know Your Customer) and AML (Anti-Money Laundering) obligations under the PMLA, 2002.

4. CONSENT AND WITHDRAWAL

• Specific Consent: By clicking "I Agree" and initiating a "Handshake," you provide free, informed, and unambiguous consent for us to share your identity with your specific counterparties for settlement purposes.
• Right to Withdraw: You may withdraw your consent at any time via the App Settings. However, withdrawal will not affect the legality of settlements already "Locked" or completed.

We do not sell your data. We share your data only with:

• Counterparties: Only the specific individuals you have named in a debt/credit entry, to facilitate the "Handshake."
• Service Processors: Secure cloud infrastructure (Render/Vercel) and database providers (MongoDB) that adhere to Indian data residency requirements.
• Regulators: Government authorities only when mandated by Indian law (e.g., RBI or FIU-IND).
• Payment Gateway: API pipelines to handle secure fee collections, subscription mandates, and direct bank account payouts.
• Publicly Verifiable Certificates: Upon successful execution of a novation cycle, the platform generates a Discharge or Payment Certificate. By participating, you agree that basic transaction identifiers (cleared amounts, timestamp, and a redacted ledger summary) will be accessible via a dedicated, public verification URL (/certificate/:id) to allow counterparty banks or institutions to verify the legitimacy of the discharge.

• Retention: We retain your transaction data for as long as your account is active or as required by Indian financial record-keeping laws (typically 7 years).
• Right to Erasure: You have the right to request the deletion of your personal data. We will fulfill this request within 30 days, provided there are no active, uncompleted settlement cycles linked to your account.
• Mandate Failure and Processing Bypass: If a user’s Pay Later mandate becomes pending, cancelled, or revoked, the backend graph processing engine immediately and silently isolates that data node from active discovery loops. Your data remains stored in our secure encrypted database, but is bypassed during automated processing until the mandate status is successfully re-authenticated.

We employ "Privacy by Design." Your data is protected using:

• AES-256 Encryption for data at rest.
• TLS 1.3 for data in transit.
• Anonymized Mapping: Our AI processes "debt nodes" using unique identifiers rather than raw personal names whenever possible to find cycles.

Under the DPDP Act 2023, you have the right to:

1. Access: Request a summary of the personal data we hold about you.
2. Correction: Update inaccurate or incomplete financial entries.
3. Grievance Redressal: Contact our Grievance Officer regarding any privacy concerns.
4. Nomination: Appoint an individual to exercise your rights in the event of your incapacity.

In accordance with the DPDP Act, if you have any questions or complaints, please contact our Data Protection Officer (DPO):

Email: support@diametor.com Location: Thrissur, Kerala, India.