Privacy Policy

This Privacy Policy describes how MetaDev Innovations Private Limited (“MetaDev”, “we”, “us”) processes personal data when you visit metadev.in, use our products (MetaHealth, MetaEdu, MetaGreen, MetaFlow, MetaHire, MetaCheck, MetaAds, MetaNav, MetaLedger, MetaCard, MetaIM), contact us, or apply for a role.

We comply with the Digital Personal Data Protection Act, 2023 (India), the Information Technology Act, 2000 and its SPDI Rules, and where applicable the EU GDPR / UK GDPR. Where local law is stricter, we apply the stricter standard.

Data Fiduciary: MetaDev Innovations Private Limited, Hyderabad, Telangana, India.

Privacy / Grievance Contact: contact@metadev.in · info@metadev.in — we reply within 24 hours; grievance redressal per IT Rules within 15 days.

For product-specific processing (e.g., MetaHealth patient data, MetaCheck verification data), the relevant product terms identify whether MetaDev acts as Data Fiduciary or Data Processor.

We do not intentionally collect sensitive personal data via the marketing site. If you submit it voluntarily, we treat it as sensitive personal data and restrict access.

• Respond to enquiries and provide requested demos, trials, or support.
• Operate, secure, and improve our sites and products (analytics, debugging, abuse prevention).
• Manage accounts, authentication, and entitlements.
• Send product, security, or administrative notices — and, with consent, marketing you can opt out of.
• Recruit and evaluate candidates.
• Comply with law, enforce terms, and protect rights, safety, and property.

We use data minimisation — every collection field is reviewed for necessity.

We process data only where we have a lawful basis: consent (including deemed consent under DPDP where you voluntarily provide data for a specified purpose), legitimate use, contract (to provide a service you requested), legal obligation, or legitimate interests (e.g., securing our services) balanced against your rights. You may withdraw consent at any time without affecting prior lawful processing.

We do not sell personal data. We share it only with:

• Service providers / processors under DPAs — e.g., cloud hosting (Supabase / AWS), email, analytics, error monitoring — with least-privilege access.
• Group products where you requested a cross-product enquiry (e.g., MetaHire → MetaCheck).
• Authorities where required by Indian law, court order, or to prevent harm/fraud.
• Business transfers — with prior notice and the same protections.

A current sub-processor list is available on request from contact@metadev.in.

• Enquiries: 24 months after last interaction, then anonymised or deleted.
• Account data: for the life of the account + 12 months for audit / legal holds.
• Logs & analytics: 13 months (IP truncated where possible).
• Careers applications: 12 months unless you request earlier deletion.

Product-specific retention is defined in the relevant product DPA and takes precedence.

We apply proportionate technical and organisational measures — encryption in transit (TLS 1.2+) and at rest (AES-256), network isolation, RBAC/ABAC, MFA for staff, secrets management, audit logging, and regular external assessments. See our Security page for detail. No system is 100% secure; we maintain an incident response plan and will notify you and the Data Protection Board of India without undue delay where required.

Under the DPDP Act and where applicable GDPR, you have the right to:

• Access, correct, update, or erase your personal data;
• Withdraw consent and restrict or object to certain processing;
• Nominate another person to exercise rights on your behalf or in case of incapacity;
• Lodge a grievance with our DPO and, if unresolved, with the Data Protection Board of India or your supervisory authority.

To exercise rights, write to contact@metadev.in from your registered email with subject “Data Request — [Right]”. We verify identity and respond within 30 days (DPDP) / 1 month (GDPR), extendable by law.

Automated decisions

We do not make solely automated decisions producing legal or similarly significant effects without human review. Where a product does (e.g., risk scoring), it is disclosed in product terms with an appeal path.

We use (a) strictly necessary cookies for security and load balancing, (b) preference cookies (e.g., theme), and (c) with your consent, analytics cookies to understand feature use. You can control cookies via your browser and, where presented, our consent banner. Blocking necessary cookies may break sign-in.

Our marketing site is not directed to children under 18. We do not knowingly collect children's data without verifiable parental consent. If you believe a child has provided data, contact us for prompt deletion.

Data is primarily processed in India. Where we transfer data outside India (e.g., to a sub-processor region), we use approved safeguards — adequacy, Standard Contractual Clauses, and supplementary measures — and comply with Government-notified transfer restrictions under the DPDP Act.

We will post material changes here and update the “Last updated” date. For material changes we will provide additional notice (banner or email). Questions or grievances:

Email: info@metadev.in · contact@metadev.in · Post: MetaDev Innovations Pvt. Ltd., Hyderabad, Telangana, India.

This policy is for transparency and does not create rights beyond applicable law. Product-specific DPAs and customer contracts prevail in case of conflict.