PushCartSiren - Statutory Government Compliance & Legal Policy Manual

Statutory Regulatory Filing & Public Policy Manual

Comprehensive Statutory Legal Policy Manual & 50-Point Enterprise Governance Framework

Governing entity: Pushcartsiren Private Limited (CIN: U63112AP2026PTC124880 | Reg No: 124880)
Incorporated under the Companies Act, 2013 • RoC Vijayawada • RD Hyderabad
Registered Office: Shop No 3, 4/8/297, Bangla Thota, Nawabpet, Nawabpeta, Nellore, Andhra Pradesh, India, 524002
Jurisdiction: Republic of India | Ministry of Corporate Affairs (MCA) • MeitY • Ministry of Consumer Affairs • MoHUA • CERT-In
Effective Date: March 2026 • Version 1.5.2 Statutory Production Edition (Updated October 2026)

Section 1: Digital Personal Data Protection Act (DPDP Act, 2023) & Implementation Register

PushCartSiren is engineered under strict Privacy-by-Design principles complying with Act No. 22 of 2023 of the Parliament of India (The Digital Personal Data Protection Act, 2023) and the Digital Personal Data Protection Rules, 2025 notified by the Ministry of Electronics and Information Technology (MeitY).

1.1 Data Fiduciary vs. Data Processor Operational Scope

In accordance with Section 2(i) and Section 2(j) of the DPDP Act 2023, PushCartSiren evaluates its operational roles across distinct application boundaries:

Data Fiduciary Role: PushCartSiren acts as a Data Fiduciary for registered PushCart vendors, merchant subscriber accounts, and advertising clients, as we determine the purpose and means of onboarding, credential management, billing, and statutory recordkeeping.
Radical Data-Minimization Intermediary for Urban Residents: For household residents, PushCartSiren functions as a telecommunications transit bridge. We do NOT collect names, phone numbers, email addresses, precise home coordinates, or device telemetry centrally. Resident proximity calculations are performed 100% client-side on the user's mobile device CPU against downstream vendor broadcast pings.

1.2 DPDP Statutory Implementation Register

The following register documents the commencement schedule, applicability, and technical controls enforced across the platform under the phased MeitY implementation timeline:

Legal Provision	Commencement	Applicability	Required Technical Control	Evidence	Owner & Status
DPDP Act Sec 5 & 6 (Notice & Consent)	Phased Rollout	Vendors, Kirana POS owners, and Advertisers	Clear multilingual consent notices prior to microphone and GPS access. Granular opt-in.	App permission rationale UI dialogs; `privacy.html`	Lead Architect VERIFIED
DPDP Act Sec 6(1) (Purpose Limitation)	Phased Rollout	All processing pipelines	Strict data minimization; voice inputs processed in volatile memory; zero permanent resident GPS tracking.	`LocalVoiceProductParser.kt`; memory profiling tests	Backend Lead VERIFIED
DPDP Act Sec 8(2) (Data Processors)	Phased Rollout	Cloud providers & AI API vendors	Mandatory Data Processing Agreements (DPAs); zero vendor model training on customer data.	Google Cloud & AWS India DPAs; API headers	Compliance Officer VERIFIED
DPDP Act Sec 8(6) (Breach Notification)	Phased Rollout	All data repositories	Mandatory incident classification, rapid triage, and notice to Data Protection Board of India & CERT-In within 6 hours.	Incident Response Playbook; `audit_logs` collection	Security Officer VERIFIED
DPDP Act Sec 9 (Children's Data)	Phased Rollout	Entire application suite	Zero behavioral tracking, zero profiling, and zero targeted advertising directed at minors under 18.	Ad target filtering logic; zero user tracking SDKs	Product Lead VERIFIED
DPDP Act Sec 11-14 (Principal Rights)	Phased Rollout	Registered merchants & vendors	Self-service access, correction, erasure portal at `account-deletion.html` & `DELETE /api/pos/shop/data`.	Automated deletion worker; compliance receipts	Grievance Officer VERIFIED
DPDP Act Sec 16 (Cross-Border Transfer)	Phased Rollout	Cloud hosting & AI infrastructure	Primary data residency in India (AWS Mumbai `ap-south-1` & GCP India). AI inference transient; zero cross-border transfers to blacklisted territories.	Cloud region configuration; network routing logs	Infrastructure Lead VERIFIED

Data Residency & Infrastructure Boundary Disclosure: Primary databases, backups, and transaction logs reside strictly within India data centers (AWS Mumbai ap-south-1 and Google Cloud Delhi/Mumbai). Transient voice and text processing utilize privacy-preserving on-device algorithms (LocalVoiceProductParser) and transient cloud inference without cross-border retention or foundation model training, fully compliant with Section 16 of the DPDP Act 2023.

Section 2: Data Lifecycle, Deletion Architecture & Statutory Retention

2.1 Multi-Tier Data Deletion & Verification Lifecycle

PushCartSiren implements an exhaustive, verifiable data deletion framework covering all tiers of the technology stack:

Production Databases: Upon submission of a verified deletion request via the web portal (account-deletion.html) or API endpoint (DELETE /api/pos/shop/data), all merchant records, inventory catalogs, and campaign settings are soft-deleted immediately and permanently purged from active collections within 24 hours.
Mobile Devices & Sandboxed Local Storage: The Kirana Shop POS and PushCart vendor applications provide an in-app "Reset Store / Clear Data" option that purges all local Room SQLite database files, SharedPreferences, and cached receipts from the device sandbox immediately.
Cloud Object Storage: Uploaded store banners, QR codes, and digital receipt PDFs stored in cloud storage buckets are automatically deleted via programmatic bucket lifecycle management policies upon account termination.
Analytics, Monitoring & Crash Systems: Crash reporting and performance monitoring systems (Firebase Crashlytics) are configured with strict PII filtering; user IPs are masked, and device hardware serials (IMEI/MAC) are never captured.
AI & Voice Inference Systems: Audio speech buffers from pushcart vendors or shopkeepers are processed ephemerally in volatile RAM and immediately discarded. Zero audio snippets or transcripts are retained for AI training.
Documented Backup Expiry Protocol: Automated daily encrypted database snapshots rotate on a strict 30-day retention schedule. Once records are expunged from the live database, they are naturally and irrecoverably overwritten as backup segments reach their 30-day lifecycle expiry.

2.2 Statutory Financial Records Retention (CGST Act Section 36)

Statutory Tax & Financial Record Retention Separation: In strict compliance with Section 36 of India's Central Goods and Services Tax (CGST) Act, 2017, all registered tax invoices, credit notes, and books of accounts are retained for a minimum period of 72 months (6 years) from the due date of furnishing the annual return for the relevant financial year.
Logical Segregation: Statutory financial records are kept logically and cryptographically segregated in an immutable cold-storage compliance archive. Non-financial personal data is purged upon request, ensuring compliance with privacy minimization while upholding Indian taxation and corporate record-keeping laws.

Section 3: Advertising Law, Fair Trade & Household Reach Verification Standard

3.1 Indian Advertising Statutory Citations

All commercial announcements on the PushCartSiren platform are regulated under India's governing consumer protection and advertising framework:

The Consumer Protection Act, 2019 (Act No. 35 of 2019).
The Guidelines for Prevention of Misleading Advertisements and Endorsements for Misleading Advertisements, 2022 issued by the Central Consumer Protection Authority (CCPA).
The Guidelines for Prevention and Regulation of Dark Patterns, 2023 issued by the Central Consumer Protection Authority.
The Code for Self-Regulation in Advertising issued by the Advertising Standards Council of India (ASCI).

3.2 Hyperlocal Household Reach Verification Standard (₹0.30 per Reach)

PushCartSiren bills advertisers at ₹0.30 per verified household reach within a strict 500m to 1.5km hyperlocal neighborhood geofence. To provide airtight auditability without compromising resident privacy, our framework rigorously distinguishes across five distinct operational stages:

Funnel Stage	Technical Definition	Fraud & Measurement Safeguard	Billing Acceptance
1. Eligible for Delivery	Ad campaign is approved by moderation, funded, active, and within the store's operating hours and registered geofence polygon.	Pre-moderation filter screens for prohibited substances (tobacco, alcohol, illegal gambling) and misleading claims.	Non-billable (₹0.00)
2. Delivered to Device	Encrypted ad payload transmitted via secure WebSocket/HTTP to an active resident household smartphone currently within the geofence.	Validated against network IP integrity; requests from data center proxies or VPN ranges are dropped.	Non-billable (₹0.00)
3. Rendered on Screen	Ad card is mounted in the device viewport with at least 50% surface area visible for a minimum duration of 2.0 continuous seconds.	On-device viewport intersection observer checks; prevents off-screen rendering or background tab counting.	Non-billable (₹0.00)
4. Counted (Unique Household)	Unique device encounter verified using a daily-rotating, cryptographically salted pseudonymous token. Duplicates suppressed.	Zero persistent device hardware IDs (IMEI/MAC). Repeated views by the same household within a 24-hour cycle are counted once.	Metric recorded; awaiting final audit check
5. Invoiced Billable Event	Verified unique household impression accepted for billing and recorded in the merchant's immutable billing statement ledger.	Passes rate-limiting checks, anomaly detection (bot velocity limits), and offline replay validation.	Billable at ₹0.30

Section 4: Street Vendor Live GPS Safeguards & Vendor Rights

4.1 Live Vendor GPS Telemetry Safeguards

PushCart vendors broadcast their location while operating under the Street Vendors (Protection of Livelihood and Regulation of Street Vending) Act, 2014. The mobile application implements the following strict controls:

Clear Active Status Indicator: When location tracking is active, the vendor UI displays a high-contrast pulsing status banner and a persistent foreground notification stating: "You are LIVE on PushCartSiren Radar - Nearby households can see your cart."
Explicit Pre-Permission Rationale: Before requesting runtime location permissions, the app displays an educational rationale explaining that location is solely broadcasted to nearby residents while actively selling on the street.
Instant STOP LIVE Disconnection: Tapping "STOP LIVE" immediately severs the background location listener, stops network broadcasting, and purges real-time coordinates from device volatile memory.
Exclusion from Debug & Crash Logs: Precise vendor coordinates are strictly filtered and excluded from error logs, crash telemetry (Crashlytics), and server diagnostic traces.
Crash & Network Resilience: If the mobile application crashes, the phone restarts, or network connectivity is severed, location tracking defaults to OFF. Background workers cannot restart tracking without explicit manual vendor action.
Inactivity Auto-Termination: If a vendor remains stationary or inactive for over 30 minutes, live broadcasting is terminated automatically to conserve battery and protect privacy.

⚖️ Statutory Grievance Redressal Mechanism (Rule 3(2) IT Rules, 2021)

In accordance with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, PushCartSiren has appointed a dedicated Nodal Grievance Redressal Officer:

Designated Officer: Nodal Grievance Redressal & Statutory Compliance Officer
Grievance Office Email: support@pushcartsiren.com
Official Escalations: info@pushcartsiren.com
Official Registered Office: Pushcartsiren Private Limited, Shop No 3, 4/8/297, Bangla Thota, Nawabpet, Nawabpeta, Nellore, Andhra Pradesh, India - 524002.
Statutory SLA: Acknowledgment within 24 hours • Full resolution within 15 days.

Section 5: 50-Point Enterprise Data Governance & Cybersecurity Matrix

PushCartSiren enforces an exhaustive, 50-policy enterprise governance framework spanning Indian statutory acts, CERT-In cybersecurity directives, CCPA advertising regulations, and Google Play developer requirements:

#	Policy Domain	Priority	Platform Technical Implementation	Statutory Alignment
1	Privacy Policy	CRITICAL	Comprehensive policy published at `privacy.html` covering all four personas.	DPDPA Sec 5
2	Data Collection Policy	CRITICAL	Radical data minimization; zero cloud GPS logging for household residents.	DPDPA Sec 6(1)
3	Data Minimization Policy	CRITICAL	Asymmetric architecture: proximity computed client-side on mobile CPU.	DPDPA Sec 6(1)
4	Data Retention Policy	CRITICAL	Vendor pings ephemeral; GST tax invoices 72 months (Sec 36 CGST Act); logs 180 days.	CGST Act / CERT-In
5	Data Deletion Policy	CRITICAL	Web portal at `account-deletion.html` & API `DELETE /api/pos/shop/data`.	DPDPA Sec 12(3)
6	User Consent Policy	CRITICAL	Granular opt-in for vendor broadcasting and microphone permissions.	DPDPA Sec 6
7	Data Access Policy	HIGH	Full self-service access to shop inventory, daily sales, and ledger histories.	DPDPA Sec 11(1)
8	Data Correction Policy	HIGH	In-app real-time editing of pricing, stock levels, and store profile attributes.	DPDPA Sec 12(1)
9	Data Portability Policy	HIGH	One-click CSV/Excel export for POS inventories and sales reports.	DPDPA Sec 11(1)
10	Data Security Policy	CRITICAL	Android application sandbox, encrypted SharedPreferences, least-privilege DB tokens.	SPDI Rule 8
11	Encryption Policy	CRITICAL	256-bit TLS (HTTPS) in transit; PBKDF2-HMAC-SHA256 (15,000 rounds) for credentials.	IT Act Sec 43A
12	Access Control Policy	CRITICAL	Tenant-isolated database queries bound to verified shop codes; fail-closed admin routes.	OWASP API Security
13	Authentication Policy	CRITICAL	PBKDF2-HMAC-SHA256 with 15,000 rounds, per-device salt, exponential lockouts.	NIST SP 800-63B
14	Data Sharing Policy	CRITICAL	Zero sale, rental, or trade of personal data or telemetry to third-party data brokers.	DPDPA Sec 8
15	Third-Party Vendor Policy	HIGH	Certified infrastructure providers only (AWS Mumbai, GCP India, MongoDB Atlas).	DPDPA Sec 8(2)
16	Cookie & Tracking Policy	HIGH	Zero third-party tracking pixels, cross-site cookies, or behavioral ad beacons.	IT Act 2000
17	Data Breach Policy	CRITICAL	Mandatory 6-hour incident reporting to CERT-In and notification to DPDP Board.	CERT-In 2022
18	Incident Response Policy	HIGH	Four-phase triage: Containment, Forensics, Regulatory Reporting, Remediation.	ISO 27035
19	Backup & Recovery Policy	HIGH	Automated daily cloud snapshots with 30-day lifecycle expiration; excludes PINs.	DPDPA Compliant
20	AI Model Training Policy	HIGH	Zero customer data, voice clips, or POS ledgers used to train public foundation models.	DPDPA Sec 6
21	User Privacy Rights Policy	HIGH	Operationalized Data Principal Rights: Access, Correction, Erasure, Grievance.	DPDPA Sec 11-14
22	Account Deletion Policy	CRITICAL	Dedicated web portal at `account-deletion.html` meeting Google Play 2024 rules.	Google Play Policy
23	Conversation History Policy	HIGH	Audio streams parsed locally via on-device regex/NLP; discarded from RAM immediately.	DPDPA Sec 6(1)
24	Memory Management Policy	MED	Sandboxed storage; memory wiped upon logout or application cache purge.	Android Security
25	Temporary Session Policy	HIGH	Pushcart location broadcasting automatically terminates upon STOP LIVE or 30-min idle.	DPDPA Sec 8(7)
26	Sensitive Data Policy	CRITICAL	Zero storage of debit/credit cards, CVVs, Aadhaar numbers, or biometrics.	SPDI Rule 3
27	Children's Privacy Policy	CRITICAL	Zero behavioral tracking, profiling, or targeted advertising directed at individuals <18.	DPDPA Sec 9
28	Employee Data Handling Policy	MED	Role-based access controls (RBAC) enforced under binding non-disclosure agreements.	IT Rules 2011
29	Data Anonymization Policy	HIGH	Demand telemetry aggregated via coarse spatial geohashes; zero raw resident coords.	DPDPA Sec 3
30	Legal & Regulatory Policy	HIGH	Continuous compliance tracking across Central, State, and Municipal regulations.	Statutory Mandate
31	Cross-Border Transfer Policy	HIGH	Primary data residency in India (AWS Mumbai / GCP India); transient AI processing.	DPDPA Sec 16
32	Data Audit Policy	HIGH	Bi-annual internal architecture audits and external API penetration reviews.	ISO 27001
33	Data Governance Policy	HIGH	Board-level compliance oversight led by designated Statutory Compliance Officer.	DPDPA Sec 8(1)
34	Records Management Policy	HIGH	Systematic categorization: 72 months for CGST invoices, 180 days for security logs.	Companies Act / CGST
35	Privacy Complaint Handling	CRITICAL	Statutory grievance redressal with 24-hr acknowledgment and 15-day resolution SLA.	IT Rules 2021
36	Data Processing & Third-Party Processor Policy	CRITICAL	Governs third-party cloud infrastructure (AWS, GCP, MongoDB Atlas). Imposes binding Data Processing Agreements (DPAs) requiring sub-processor audits and technical security parity.	DPDPA Sec 8(2)
37	Data Breach Assessment & Notification Policy	CRITICAL	Formal 4-tier breach severity taxonomy. Prescribes mandatory notification to the Data Protection Board of India and CERT-In within 6 hours of incident verification.	CERT-In 2022 / DPDPA
38	Privacy Request & Consent Withdrawal Policy	CRITICAL	Enables users to withdraw consent as easily as giving it. In-app toggles for pushcart broadcasting; web self-service erasure portal with 72-hr confirmation notice.	DPDPA Sec 6(4)
39	Advertising Measurement & Audit Policy	CRITICAL	Defines ₹0.30 reach calculation methodology across 5-stage verification funnel (Eligible → Delivered → Rendered → Counted → Invoiced). Retains transparent reach reconciliation logs.	CCPA 2022 / ASCI
40	Device Identifier & Pseudonymous Data Policy	CRITICAL	Replaces static hardware identifiers (IMEI/MAC) with daily cryptographically salted pseudonymous tokens. Prevents re-identification of household residents.	DPDPA Sec 3 & 4
41	Data Protection by Design Policy	HIGH	Mandates privacy impact assessments (PIA) before releasing new features or schemas. Defaults all APIs to zero-PII exposure and minimal data collection.	DPDPA Sec 6(1)
42	Secure Software Development Policy (SSDLC)	HIGH	Enforces peer code reviews, automated static analysis (ktlint, lintDebug), zero hardcoded credentials, and automated vulnerability scanning across dependencies.	CERT-In Cyber Rules
43	Vulnerability & Penetration Testing Policy	HIGH	Quarterly dynamic application security testing (DAST), API tenant-isolation audits, and annual third-party black-box penetration tests on production endpoints.	ISO 27001 / CERT-In
44	AI Service Provider & Voice Data Policy	HIGH	Prioritizes on-device regex and NLP parsing. Cloud AI API agreements explicitly forbid retaining audio or prompts for foundation model training. Volatile RAM execution only.	DPDPA / MeitY AI Norms
45	Data Classification & Handling Policy	HIGH	Classifies data into 4 tiers: Public (ads, catalog), Internal (docs, stats), Confidential (sales ledger, customer tabs), and Restricted (PIN hashes, auth tokens, API secrets).	ISO 27001 Standard
46	Advertising Complaints & Takedown Policy	HIGH	Emergency 4-hour takedown workflow for prohibited goods, counterfeit items, or deceptive claims under CCPA 2022 Guidelines. Immediate advertiser campaign freeze.	CCPA Guidelines 2022
47	Fraud, Abuse & Reach Dispute Policy	HIGH	Automated bot mitigation, GPS velocity anomaly filtering, and replay detection. Provides 30-day merchant reach dispute window with automatic billing credits upon investigation.	Consumer Protection Act
48	Open-Source Software & Dependency Policy	MED-HIGH	Restricts open-source libraries to verified, permissively licensed components (Apache 2.0, MIT, BSD). Automated CI/CD dependency vulnerability screening.	Supply Chain Security
49	Business Continuity & Disaster Recovery Policy	MED-HIGH	Defines Recovery Point Objective (RPO < 24h) and Recovery Time Objective (RTO < 4h). Automated multi-zone database replication with daily verified restore rehearsals.	ISO 22301 BCM
50	Employee Joiner, Mover & Leaver Access Policy	MED-HIGH	Role-based access control (RBAC). Same-day credential revocation upon employee departure. Quarterly access recertification for all database and infrastructure environments.	ISO 27001 Access

Digital Confirmation & Verification:
This document forms an integral statutory legal schedule of the PushCartSiren platform distribution. Full public web versions are accessible at:
• Privacy Policy: https://pushcartsiren.com/privacy.html
• Terms of Service: https://pushcartsiren.com/terms.html
• Advertising Guidelines: https://pushcartsiren.com/advertising-policy.html
• Account & Data Deletion Portal: https://pushcartsiren.com/account-deletion.html
• Statutory Grievance Redressal Officer: https://pushcartsiren.com/grievance.html