Legal
Privacy notice
Who we are
Bitsmith Technologies Private Limited ("Bitsmith", "we") operates digital platforms including Spear (law-enforcement investigation facilitation SaaS) and Spear AI.
Contact / grievance: hello@bitsmith.tech (India). Mark emails "Privacy / Grievance".
What this notice covers
- Officer / platform account data: Bitsmith acts as a Data Fiduciary under the DPDP Act 2023 for accounts we create for officers and Bitsmith staff (login identity, auth logs, usage metering related to the account).
- Tenant case / investigation data: Bitsmith acts as a Data Processor for police tenants. Tenants remain responsible for lawful basis (e.g. BNSS §94-style stored-records demands). See our subprocessor register and tenant DPA (when signed).
Data we process (summary)
| Category | Examples | Role |
|---|---|---|
| Account | Name, email, role, tenant membership, auth events | Fiduciary |
| Operational | Request metadata, SMS job status, gateway device status | Processor (tenant instructions) |
| Investigation payload | Phone/IMEI/location traces as submitted by tenant officers | Processor |
| Telemetry | App errors (Sentry, PII defaults off), infra metrics | Fiduciary / ops |
Hosting region for primary SaaS: AWS Mumbai (ap-south-1). Some tenants may use on-prem residency (BYOD) per product configuration.
Why we process
- Provide and secure the Spear service
- Authenticate users and prevent abuse
- Meet legal duties (including CERT-In operational incident reporting where applicable)
- Improve reliability (aggregated metrics)
Retention
Account and audit logs: retained per product policy (typically months to 1 year for security logs; CERT-In ICT logs ≥180 days in India). Case data retention follows tenant policy / DPA.
Your rights (officer / platform users)
Where DPDP applies to account data: access, correction, erasure (with legal limits), and grievance redressal. Case/investigation data is generally under the tenant's control and may be subject to investigation-related exemptions. Contact your tenant admin first for case data.
Grievance: email hello@bitsmith.tech with subject "Privacy grievance". We aim to acknowledge within 72 hours.
Subprocessors
See the living list at bitsmith.tech/subprocessors.
Security
We apply reasonable security practices (access control, TLS, India-region hosting, incident process). Compliance is in progress: we are actively finishing CERT-In operational readiness and DPDP privacy controls; ISO 27001 / SOC 2 are longer tracks. Product seals appear only after the matching work and evidence are complete. See also our security practices page.
Changes
We may update this notice; the "Last reviewed" date will change. Material changes affecting tenants will be communicated via product or contract channels.