Legal
Privacy Policy
Last updated: 9 August 2026
UpZi is a Family Engagement & Rewards Platform owned and operated by Orvelor Private Limited. This policy explains what personal data we collect, how it is used and shared, how long it is kept, and the rights available to you.
1. Introduction
This Privacy Policy is an electronic record in the form of an electronic contract formed under the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and the rules, regulations, guidelines, and amendments made thereunder from time to time.
This Privacy Policy is a legally binding document between You (“User”, “You”, “Your”) and Orvelor Private Limited, a company incorporated under the Companies Act, 2013, having its registered office at 1207-A, 13th Floor, Mantova Tower, Mahagun Mezzaria, Sector-78, Noida, U.P. – 201301, and the operator of the UpZi application (“Orvelor”, “UpZi”, “We”, “Us”, or “Our”).
UpZi is a Family Engagement & Rewards Platform owned and operated by Orvelor Private Limited (“Orvelor”), offering family engagement, rewards, and digital gold services, involving purchase, sale, redemption, gifting, and management of digital gold through Safegold.
By accessing, registering on, or using the UpZi mobile application, website, or any associated services (“Platform”), You consent to the collection, use, storage, processing, disclosure, and transfer of Your information in accordance with this Privacy Policy.
If You do not agree to this Privacy Policy, You must not access or use the Platform.
2. Definitions
For the purposes of this Privacy Policy:
“Personal Data”
Means any data about an individual who is identifiable by or in relation to such data.
“Sensitive Personal Data”
Includes financial information, KYC information, identity documents, biometric data (if collected), and other information categorized as sensitive under applicable laws.
“Non-Personal Information”
Means information that does not directly identify an individual.
“Partners”
Refers to banks, payment gateways, refiners, custodians, logistics providers, KYC agencies, technology providers, and other third parties engaged by Orvelor from time to time.
“Data Fiduciary”
Means the person who, alone or in conjunction with others, determines the purpose and means of processing Personal Data. For the purposes of this Privacy Policy, Orvelor may act as a Data Fiduciary in relation to Personal Data processed through the Platform.
“Data Principal”
Means the individual to whom the Personal Data relates. In case of a child, this includes the parent or lawful guardian acting on behalf of such child, and in case of a person with disability, the lawful guardian acting on their behalf, as applicable.
“Consent Manager”
Means an entity registered with the competent authority or Data Protection Board, as applicable, that enables a Data Principal to give, manage, review, or withdraw consent through an accessible, transparent, and interoperable platform.
“Verifiable Parental Consent”
Means consent obtained from a parent or lawful guardian after taking reasonable steps to verify that the person providing consent is an adult and is legally authorized to act on behalf of the child, in the manner prescribed under applicable law.
3. Information We Collect
UpZi may collect the following categories of information:
A. Personal Information
- Full name
- Mobile number
- Email address
- Residential and correspondence address
- Date of birth
- Masked PAN Number
- Masked Aadhaar Number
- UPI IDs
- Nominee details
- Customer support interactions
- Profile Picture
Nominee details comprise the nominee’s name, PAN, complete address, relationship to You, date of birth and, where provided, contact number. Where the nominee is a minor on the date the record is created, We additionally collect the name, relationship and contact number of the nominee’s guardian.
Information relating to a nominee and, where applicable, a nominee’s guardian concerns individuals who may not themselves be users of the Platform. By providing such information You represent and warrant that You are authorised to disclose it, that You have obtained any consent required under applicable law from the nominee or their guardian, and that the information is accurate and current. You agree to indemnify Us against any claim arising from the provision of such information without the necessary authority or consent. We record the version of this Privacy Policy in force, and the date and time, at which nominee information is provided.
B. Financial Information
- UPI IDs
- Payment instrument details
- Transaction history
- Purchase and sale records of digital gold
- Redemption and gifting records
- Refund information
C. KYC & Verification Data
To comply with applicable laws, UpZi may collect:
- PAN verification details
- Aadhaar-based verification details
- AML screening information
- Sanctions screening records
D. Device and Technical Information
- IP address
- Device identifier
- Mobile operating system
- Platform
- OS Version
- Browser type and version
- Device model
- App version
- Login history
- Session information
E. Location Information
With Your consent, We may collect location information to:
- Verify service eligibility
- Detect fraudulent activities
- Comply with regulatory requirements
F. Usage Information
We may collect information regarding:
- Pages visited
- Features used
- Transaction behavior
- Time spent on the Platform
- User preferences
- Engagement information generated by Platform features, including experience points, levels, activity streaks, achievements, badges, task completion history, and comparative rankings within Your family account
- Records of notifications and in-app communications sent to You, including their content, the date and time of transmission/delivery, and whether they were opened. Such content may describe the activity of members of Your family account
G. User-Generated Content and Uploaded Media
The Platform allows You and members of Your family account to upload photographs, images and files, including profile pictures, images uploaded as proof of completion of a task, and attachments submitted through customer support or grievance channels. Uploaded media is stored together with associated metadata, including file size, file type, the identity of the uploading user, and the date and time of upload.
You are solely responsible for the content You upload and represent that You hold all rights and consents necessary to upload it. Where uploaded content depicts or relates to a child, the Primary Account Holder represents that they are authorised to upload it on the child’s behalf. Media uploaded in connection with a task is visible to members of Your family account, as described in Section 8.
You must not upload identity documents, financial instruments, payment credentials, passwords, verification codes, or sensitive personal information as task proof or support attachments. UpZi does not require such information to be uploaded in this manner and accepts no liability for information uploaded contrary to this instruction.
H. Biometric Authentication
Where You enable fingerprint, facial recognition, or similar device-level authentication to unlock the application or to confirm a transaction, that authentication is performed entirely by Your device and its operating system. UpZi does not collect, receive, transmit, or store Your biometric data. We receive only a confirmation from Your device that authentication succeeded or failed.
4. How We Collect Information
We collect information through:
- Registration and onboarding processes
- KYC verification processes
- Purchase or sale transactions
- Customer support interactions
- Surveys and feedback forms
- Cookies and analytics technologies
- Partner integrations
- Third-party verification services
- Regulatory databases
We may also receive information from:
- Banks
- Payment gateways
- KYC agencies
- Identity verification service providers
- Marketing partners
- Government databases where permitted by law
- Digital gold ecosystem partners, including Safegold, its affiliates, custodians, refiners, vaulting partners, redemption partners, logistics providers, and other entities involved in purchase, sale, custody, storage, insurance, delivery, redemption, buy-back, gifting, transfer, reconciliation, or regulatory compliance relating to digital gold transactions.
5. Purpose of Collection and Processing
UpZi may collect and process Your information for the following purposes:
Account Management
- Creating and maintaining Your account
- Identity verification
- User authentication
Transaction Facilitation
- Processing purchases of digital gold
- Processing sale requests
- Processing redemption and gifting requests
- Facilitating settlements and refunds
- Establishing, executing, modifying, pausing, and cancelling systematic investment plans and recurring payment mandates
- Processing recurring installments and reconciling them with payment partners
KYC and Regulatory Compliance
- Compliance with AML and CFT regulations
- Identity verification
- Fraud prevention
- Compliance with tax laws and other legal obligations
Customer Service
- Resolving complaints
- Addressing customer inquiries
- Providing technical support
Security
- Detecting suspicious activities
- Preventing fraud
- Preventing unauthorized access
Platform Improvement
- Product development
- Service enhancement
- User experience optimization
- Data analytics
Marketing
Subject to applicable law and Your consent, We may:
- Send promotional communications
- Share product updates
- Conduct marketing campaigns
- Offer personalized products and services
Legal Compliance
- Responding to regulatory requests
- Complying with court orders
- Enforcement of contractual rights
- Investigating violations
6. Legal Basis for Processing
We process Your Personal Data based on:
- Your consent
- Performance of contractual obligations
- Compliance with legal and regulatory requirements
- Legitimate business interests
- Fraud prevention and security purposes
- Certain legitimate uses permitted under applicable law, including where processing is necessary for compliance with law, employment-related purposes, medical emergencies, disaster response, public order, or other purposes recognized under applicable law.
Where processing is based on consent, UpZi shall provide or make available a clear notice describing the Personal Data being collected, the purpose of processing, the manner in which You may exercise Your rights, and the process for grievance redressal or complaint escalation. Such notice may be provided through the Platform, onboarding flow, consent screen, pop-up, email, SMS, or any other lawful electronic mode.
You may manage, review, or withdraw consent through the Platform settings, consent dashboard, customer support channel, registered email communication, or any Consent Manager mechanism enabled by UpZi from time to time. Withdrawal of consent may affect Your ability to access or use certain services where such processing is necessary to provide the relevant service.
8. Disclosure of Information
UpZi may share Your information with:
Such disclosure shall be limited to information reasonably necessary for the relevant purpose and shall be subject to applicable contractual, confidentiality, security, and legal obligations. UpZi does not sell Your Personal Data to third parties for monetary consideration.
A. Service Providers
- Cloud hosting providers
- IT service providers
- Customer support vendors
- Analytics providers
B. Financial Institutions
- Banks
- Payment gateways
- Payment aggregators
- UPI service providers
C. Gold Ecosystem Partner
- Digital gold issuer (Safegold)
- Custodian (Safegold)
- Vault service provider (Safegold)
- Redemption partner (Safegold)
D. Regulatory Authorities
Where required under law, We may disclose information to:
- Courts
- Government authorities
- Law enforcement agencies
- Regulators
E. Business Transfers
Your information may be transferred as part of:
- Merger
- Acquisition
- Business restructuring
- Sale of business assets
Any such transferee shall be bound by obligations consistent with this Privacy Policy.
UpZi may also share information with KYC agencies, identity verification providers, fraud prevention service providers, payment processors, banks, payment gateways, payment aggregators, card networks, UPI service providers, auditors, legal advisors, consultants, insurers, and professional advisers where such sharing is necessary for onboarding, verification, transaction processing, settlement, refunds, risk management, compliance, audit, legal advice, or protection of UpZi’s rights and interests.
F. Other Members of Your Family Account
The Platform is designed for shared family use. Where You create or join a family account, certain information is made visible to other members of that family account as an inherent and necessary function of the service, including:
- Profile information, including name, profile picture, and role within the family account
- Tasks assigned, accepted, completed, submitted for approval, approved, rejected, or expired
- Images, photographs, or other media uploaded as proof of completion of a task
- Goals, savings targets, contributions, and progress towards them
- Reward amounts, balances, holdings, and transaction activity attributable to that member
- Engagement information, including experience points, levels, activity streaks, achievements, badges, and comparative rankings displayed within the family account
- Notifications describing the activity of members of the family account
Visibility within a family account is determined by role. A Primary Account Holder or parent has visibility over the profiles, activity, holdings, and uploaded media of children within their family account. A child has limited visibility, restricted to their own activity together with such comparative or shared information as the Platform makes available within that family account.
You acknowledge that this sharing is intrinsic to the Platform and cannot be disabled while remaining a member of a family account. If You do not wish information to be shared in this manner, You must not join, or must exit, the relevant family account. The Primary Account Holder is responsible for determining which individuals are added to a family account and for the consequences of such addition.
9. Data Storage and Processing
Your information may be stored electronically or physically.
UpZi may process and store information within India and, where legally permissible, through approved service providers in other jurisdictions having adequate data protection standards.
UpZi shall ensure that appropriate contractual and technical safeguards are implemented for such transfers.
Where Personal Data is processed outside India, such processing shall be subject to applicable Indian data protection laws, any restrictions notified by the Central Government, and appropriate contractual, technical, organizational, confidentiality, and security safeguards. UpZi shall take reasonable steps to ensure that overseas service providers process Personal Data only for authorized purposes and in accordance with this Privacy Policy.
10. Data Retention
UpZi shall retain Your information:
- For as long as Your account remains active;
- For fulfillment of contractual obligations;
- As required by applicable laws and regulations;
- For fraud prevention, audit, tax, and legal purposes.
Transaction-related information may be retained for periods prescribed under applicable laws, including anti-money laundering and taxation laws.
Upon expiry of the applicable retention period, information shall be deleted, anonymized, or archived in accordance with legal requirements.
Where You withdraw consent or where the purpose for which Personal Data was collected is no longer being served, UpZi shall erase or anonymize such Personal Data, unless retention is required or permitted under applicable law. Personal Data may continue to be retained after account deletion where necessary for statutory record keeping, KYC and AML compliance, tax and accounting obligations, transaction reconciliation, audit trails, prevention or investigation of fraud, enforcement of legal rights, resolution of disputes, or compliance with requests from courts, regulators, law enforcement agencies, or government authorities.
Retention periods may vary depending on the category of information, nature of transaction, legal requirement, and business necessity. After expiry of the applicable retention period, UpZi shall take reasonable steps to delete, anonymize, aggregate, or securely archive the relevant information in accordance with its internal retention schedule and applicable law.
11. Security Practices
UpZi adopts reasonable security practices and procedures to protect Personal Data against unauthorized access, disclosure, alteration, misuse, or destruction.
Security measures include:
- Data encryption
- Secure servers
- Firewalls
- Access controls
- Audit trails
- Vulnerability assessments
- Periodic security reviews
- Employee confidentiality obligations
While We strive to protect Your information, no transmission over the internet or electronic storage system can be guaranteed to be completely secure.
Personal Data Breach and Incident Notification. In the event of a Personal Data breach, security incident, unauthorized processing, accidental disclosure, loss of access, alteration, destruction, or compromise of Personal Data, UpZi shall take reasonable steps to investigate, contain, mitigate, remediate, and document the incident. Where required under applicable law, UpZi shall notify affected users, the Data Protection Board of India, CERT-In, regulators, law enforcement agencies, or other competent authorities within the prescribed timelines and in the prescribed manner. Such notice may include the nature of the incident, likely consequences, mitigation steps taken by UpZi, safety measures recommended for affected users, and appropriate contact details for support.
12. User Rights
Subject to applicable law, You may exercise the following rights in relation to Your Personal Data by using the options available on the Platform or by contacting UpZi through the contact details provided in this Privacy Policy. UpZi may verify Your identity before processing any request and may decline, defer, or limit a request where permitted or required under applicable law, including where retention is necessary for legal, regulatory, tax, audit, fraud prevention, dispute resolution, or contractual purposes.
Access
Request access to Your Personal Data.
Correction
Request correction of inaccurate or incomplete information.
Update
Update profile information through the Platform.
Erasure
Request deletion of Your Personal Data subject to legal retention requirements.
Grievance Redressal
Submit complaints regarding processing of Personal Data.
Nominate
Nominate another individual to exercise Your rights in accordance with applicable laws.
Consent Management
Review, manage, or withdraw Your consent through available Platform mechanisms, customer support, registered communication channels, or any Consent Manager mechanism enabled by UpZi from time to time.
UpZi shall endeavor to respond to valid rights requests within the timelines prescribed under applicable law. Withdrawal of consent shall not affect processing already undertaken prior to such withdrawal, and certain Platform features or services may become unavailable where such consent is necessary for providing those services.
UpZi may reject or defer rights requests where the request is incomplete, unverifiable, repetitive, technically infeasible, contrary to law, or where continued retention or processing is required for legal, regulatory, contractual, fraud prevention, audit, tax, dispute resolution, or security purposes.
13. Account Deletion and Closure
You may request deletion of Your UpZi account by contacting Us through the means specified below.
You may also request closure directly through the account settings within the UpZi application.
Conditions to be satisfied before closure
Because the Platform holds financial assets and processes payments, an account cannot be closed while value or an instruction remains outstanding. Your account cannot be closed while:
- You hold digital gold or other metal above a de minimis residual quantity. Such holdings must be sold and the proceeds withdrawn;
- You have an active, paused, or halted systematic investment plan or recurring mandate. These must be cancelled;
- You have a purchase or sale order that is still being processed;
- A payout to Your bank account has failed and remains unresolved;
- A settlement or withdrawal is pending or in progress;
- You created a family account in which other members remain. Such members must be removed, or the family account transferred, before closure.
These conditions exist so that money and metal belonging to You are returned to You before Your access ends. They are not a refusal to act on Your request. Where a condition cannot be cleared through the Platform, Our support team can assist.
Closure of a child’s account
Where the account belongs to a child, the child may raise a closure request through the Platform, but that request must be approved by a parent or lawful guardian within the same family account, authenticated by a one-time verification code. This reflects the position that consent for the processing of a child’s Personal Data is given, and withdrawn, by the parent or lawful guardian.
What happens on closure
Upon a valid request, and once the conditions above are satisfied:
- Your account is deactivated immediately and can no longer be accessed or used;
- All active sessions are terminated and device registrations are deactivated;
- Personal identifiers associated with Your account, including name, mobile number, email address, date of birth, address, profile picture, masked identity document references, and nominee and nominee guardian details, are erased or irreversibly anonymised;
- Uploaded media, including profile pictures and task proof images, is deleted from Our storage;
- Payout instrument details, including bank account and UPI details, are redacted and retained only in masked form where required to evidence a completed settlement;
- Free-text content submitted through support channels is redacted;
- Notification history is deleted;
- Your membership of any family account is removed, and tasks assigned to You that remain open are closed.
What is retained, and why
Certain records must survive closure and cannot be erased on request:
- Transaction records, KYC records, and audit trails, retained for the period prescribed under applicable law, including the Prevention of Money-Laundering Act, 2002 and the rules made thereunder, which presently require such records to be retained for five years from the end of the business relationship or the date of the transaction, as applicable;
- Records required for taxation, accounting, statutory reporting, audit, reconciliation, dispute resolution, enforcement of legal rights, or response to courts, regulators, or law enforcement agencies;
- Evidence of consent, including the version of the policies consented to and the circumstances in which consent was given, since a consent record that cannot identify whose consent it evidences serves no purpose;
- An audit record of the closure itself.
Retained records are held only to support these obligations. They are not used to contact You or to provide services to You.
Information held by third parties
Certain of Our partners maintain their own records under their own legal obligations and retention policies. In particular, where You have transacted in digital gold, an account and identity record is held by Safegold, which does not presently offer a deletion facility. Closure of Your UpZi account ends Your access but does not, and cannot, delete records held by Safegold or by payment partners, banks, or KYC agencies. We request redaction where a partner supports it. You may approach such partners directly to exercise any rights available to You against them.
Effect of closure
Deletion of Your account does not extinguish obligations, liabilities, disputes, or legal proceedings arising prior to deletion.
Where an identifier such as a mobile number or email address is released upon closure, it may subsequently be used to register a new and separate account. Registering again does not restore any previous account, holding, balance, or history.
14. Children’s Privacy and Family Member Accounts
UpZi is primarily intended for use by individuals who are competent to contract under applicable law and are at least eighteen (18) years of age.
However, UpZi may permit a registered adult user (“Primary Account Holder”) to add, manage, and maintain profiles or accounts for their minor children or other family members under a family account feature made available through the Platform.
UpZi shall not knowingly process Personal Data of a child without Verifiable Parental Consent where such consent is required under applicable law. UpZi does not knowingly undertake tracking, behavioural monitoring, profiling, or targeted advertising directed at children, and shall not process children’s Personal Data in a manner likely to cause a detrimental effect on the well-being of a child.
In such cases:
- a. Any personal information relating to a child below eighteen (18) years of age shall be provided, managed, and controlled by the Primary Account Holder who is the parent, legal guardian, or person lawfully authorized to act on behalf of such child.
- b. By adding a child as a family member on the Platform, the Primary Account Holder represents and warrants that: they are the parent or lawful guardian of the child, or otherwise have legal authority to provide such information; they have obtained all necessary permissions and consents required under applicable law; and they consent to the collection, storage, processing, use, and disclosure of such child’s personal information in accordance with this Privacy Policy.
- c. UpZi collects only such information of minors as may be necessary for providing Platform services, maintaining family profiles, facilitating investments, gifting, ownership records, beneficiary records, nominations, or such other services as may be offered through the Platform.
- d. UpZi does not knowingly permit children under the age of eighteen (18) years to independently create or operate an account, enter into transactions, or provide personal information directly without the involvement and consent of a parent or legal guardian.
- e. Any digital gold, rewards, gifts, savings, investments, or other assets associated with a minor profile shall be administered through and controlled by the Primary Account Holder until such child becomes legally eligible to independently operate the account and subject to applicable laws and Platform policies.
- f. Parents or legal guardians may request access to, correction of, or deletion of a child’s personal information by contacting UpZi through the details provided in this Privacy Policy, subject to applicable legal and regulatory retention requirements.
- g. If UpZi becomes aware that personal information of a child has been collected directly without the authorization, consent, or supervision of a parent or legal guardian, UpZi reserves the right to suspend the relevant account and delete such information, subject to applicable legal obligations.
- h. UpZi may implement reasonable safeguards and security measures to protect personal information relating to children in accordance with applicable data protection laws.
- i. UpZi may implement age-gating, parental verification, consent logs, audit trails, restricted processing controls, and other reasonable technical and organizational measures to support compliance with children’s privacy obligations.
15. Third-Party Links
The Platform may contain links to third-party websites, applications, or services.
UpZi does not control such third parties and is not responsible for:
- Their privacy practices
- Their security practices
- Their content
Users are encouraged to review the privacy policies of such third parties.
By using Digital Gold services through the Platform, You acknowledge and agree to abide by Safegold’s customer and website privacy policy, as amended from time to time:
16. Limitation of Liability
UpZi shall not be responsible for:
- Events beyond its reasonable control;
- Unauthorized access resulting from user negligence;
- Acts of third parties beyond UpZi’s control;
- Force majeure events including cyberattacks, failures of telecommunication infrastructure, acts of government, natural disasters, or other unforeseen circumstances.
17. Amendments
UpZi reserves the right to amend this Privacy Policy from time to time.
Material changes may be communicated through:
- Platform notifications
- Email communications
- Website updates
Continued use of the Platform after such modifications constitutes acceptance of the revised Privacy Policy.
18. Grievance Officer
In accordance with applicable laws, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, the Grievance Officer details are as follows:
- Name: Sarah
- Designation: Grievance Officer
- Email: info@orvelor.com
- Address: 1207-A, 13th Floor, Mantova Tower, Mahagun Mezzaria, Sector-78, Noida, U.P. – 201301
- Contact Number: +91 8800871697
The Grievance Officer shall acknowledge complaints within the timelines prescribed under applicable law and endeavor to resolve grievances in a timely manner.
19. Governing Law and Jurisdiction
This Privacy Policy shall be governed by and construed in accordance with the laws of India.
Any dispute arising out of or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts at Noida, Uttar Pradesh.
20. Contact Us
For any questions, concerns, requests, or complaints regarding this Privacy Policy or the handling of Personal Data, You may contact:
- Name of Entity: Orvelor Private Limited
- Email: info@orvelor.com
- Address: 1207-A, 13th Floor, Mantova Tower, Mahagun Mezzaria, Sector-78, Noida, U.P. – 201301
- Customer Support: info@orvelor.com
Schedule – Digital Gold Specific Disclosure
By using UpZi, You acknowledge and consent that:
- UpZi Digital gold products are offered by independent third-party providers.
- Custody, storage, insurance, purity certification, redemption, and buy-back policies are governed by Safegold or the applicable digital gold partner.
- Transaction information may be shared with Safegold or the applicable digital gold partner to facilitate purchase, sale, redemption, gifting, custody, reconciliation, settlement, audit, dispute resolution, and regulatory compliance.
- UpZi may verify user identity and conduct KYC in accordance with applicable laws before enabling digital gold transactions.
- UpZi may suspend or restrict transactions to comply with regulatory, AML, fraud prevention, or risk management requirements.
Orvelor Private Limited
1207-A, 13th Floor, Mantova Tower, Mahagun Mezzaria, Sector-78, Noida, U.P. – 201301