Privacy Policy

1. Scope & Legal Framework

Rhizent Technologies ("Rhizent", "we", "us", or "our") is an independent software initiative founded by Harsha Vardhan in Vijayawada, Andhra Pradesh, India.

This Privacy Policy describes how we process digital personal data in connection with our website (rhizent.space), our mobile applications (PlantSpace on Android and iOS), and forthcoming tools such as CropPulse. This policy is formulated in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") of India and the Information Technology Act, 2000 and associated rules.

2. Personal Data We Collect

We adhere to strict data minimization. We collect only what is strictly necessary:

• Account Identifiers: Your phone number or email address, used solely to authenticate your account and prevent spam.
• Public Profile Information: Your chosen username/handle, display bio, and your Dynamic Profile growth stage (Seed, Bud, Leaf, Bloom).
• User-Published Public Content: Botanical photographs, posts (Sprouts), threaded comments (Vines), and discussions you choose to upload publicly or share in open Community groups.
• Technical & Crash Diagnostics: Minimal non-identifiable telemetry required to identify bugs (operating system version on Android or iOS, device model, and anonymized stack traces).

What We Never Collect: We do not collect GPS location data, contact address books, biometric records, or third-party advertising identifiers. We do not use third-party tracking pixels.

3. End-to-End Encrypted Whisperings

Private 1:1 messaging in PlantSpace ("Whisperings") is built with end-to-end encryption.

We cannot read your messages: The cryptographic keys required to decrypt private messages exist only on your device and your recipient's device. Message payloads traverse our relay servers in ciphertext form. Neither Rhizent, nor server administrators, nor third-party cloud hosts can inspect, read, or reconstruct your private conversations or attached private media.

4. Purpose of Processing & Lawful Grounds

Under Section 4 and Section 6 of the DPDP Act, 2023, we process personal data based on:

• Explicit Consent: Provided by you upon registration for account creation and publishing public content. You may withdraw consent at any time by deleting your account.
• Legitimate Uses: Operating security safeguards, enforcing Terms, and preventing fraud or abuse on public forums.

5. Data Retention & Purging

We retain your personal data only for as long as your account remains active.

When you initiate account deletion (via in-app settings or via email request to support@rhizent.space), your profile data and published public content are permanently erased from our active production systems. Minimal transaction and authentication logs may be retained temporarily solely to comply with statutory legal mandates under the Information Technology Rules, 2021 before being automatically purged.

6. Cloud Processors & Infrastructure Partners

To provide dependable cloud syncing and media delivery, Rhizent utilizes industry-standard infrastructure providers ("Data Processors"):

• Google Cloud Platform / Firebase: Secure cloud database storage and authentication services hosted in certified data center regions.

Our processors operate under contractual data protection obligations that prohibit them from using your personal data for their own independent marketing or profiling purposes.

7. Security Safeguards

We implement reasonable security practices and procedures pursuant to Section 8(5) of the DPDP Act, 2023:

• All data in transit is encrypted using modern TLS 1.3 cryptographic protocols.
• Database stores are protected with encryption at rest (AES-256).
• Private communications (Whisperings) are end-to-end encrypted.
• Access to cloud backend environments is restricted through multi-factor authentication and least-privilege administrative keys.

8. Children's Data Protection

In strict compliance with Section 9 of the DPDP Act, 2023:

• We do not undertake any tracking, behavioral monitoring, or targeted advertising directed at children under 18 years of age.
• We do not process personal data of children in any manner that is likely to cause detrimental effects on their well-being.
• Accounts for individuals under 18 require verifiable parental or guardian consent.

9. Data Principal Rights under DPDP Act, 2023

As a Data Principal under Indian law, you have the following statutory rights:

1. Right to Access: You may request a summary of the personal data processed by Rhizent and the identities of data processors with whom it has been shared.
2. Right to Correction & Erasure: You may correct inaccurate data in your profile settings or request complete erasure of your personal data.
3. Right of Grievance Redressal: You may file a grievance with our Grievance Officer regarding any data processing concern.
4. Right to Nominate: You have the right to nominate an individual who will exercise your rights in the event of death or incapacity, by submitting a formal nomination to our grievance desk.

10. Cross-Border Data Transfers

Personal data processed by Rhizent may be stored or processed on cloud infrastructure located in India or in foreign jurisdictions that are not restricted by the Central Government of India under Section 16 of the DPDP Act, 2023.

11. Personal Data Breach Notification

In the unlikely event of a personal data breach affecting our systems, Rhizent will notify the Data Protection Board of India and affected Data Principals in such form and manner as prescribed under Section 8(6) of the DPDP Act, 2023.

12. Data Protection Point of Contact

If you have questions, data access requests, or wish to exercise your statutory rights under the DPDP Act, contact our Data Protection desk: