Privacy Policy

1. Introduction

EvaraTech is a cleantech startup building intelligent water management solutions using IoT, AI/ML, and data-driven analytics. We develop non-intrusive hardware devices and software platforms to monitor water levels, detect leakage, digitize analog meters, and provide actionable insights through AI-powered dashboards. Our mission is to enable sustainable, efficient, and scalable water resource management.

This Privacy Policy describes how EVARATECH PRIVATE LIMITED (“EvaraTech”, “we”, “us”) collects, uses, and shares information when you use the EvaraTech / EvaraOne mobile application for Android (package com.evaratech.evaratech), the related web application, and backend services that power industrial Internet of Things (IoT) monitoring and control (collectively, the “Service”).

This policy is based on the application’s implemented functionality as of the effective date.

2. Information We Collect

2.1 Account information

When you sign in, we process:

• Email address and password (authentication via Firebase Authentication)
• Display name, role, account status, and optional phone number and company association as returned by our API profile endpoint
• Session preferences stored on your device (for example, “keep me signed in” and remembered email)

Customers may create an account via the public sign-up screen. Organization administrators may also create accounts. New self-signup accounts remain pending until an administrator approves them and assigns devices.

2.2 IoT device and telemetry information

Depending on devices assigned to your account, the Service may process:

• Device identifiers such as hardware ID, device type, device name, and MAC address (when provided during provisioning)
• Connectivity and status fields (for example online/offline, firmware version, signal indicators)
• Sensor and operational telemetry such as water level, volume, temperature, distance, flow rate, session/daily/total volume, valve or motor state, and related configuration echoes
• Device event information used for alerts (for example tank threshold events or valve auto-shutoff / fail-safe events)
• Remote configuration values you or your organization send to devices (intervals, thresholds, auto-shutoff settings, network preferences)

2.3 Push notification information

• Firebase Cloud Messaging (FCM) registration tokens
• Platform type (for example Android, iOS, or web) associated with the token
• Notification content related to device alerts and presence, when your organization enables push delivery

2.4 Location information

The Android app may request approximate and precise location permission to help users pick an install location for a device on a map (Geolocator / map UI). As of the current app build reviewed for this policy, location coordinates selected in the UI are not uploaded to EvaraTech backend APIs. If that changes, we will update this policy and in-app disclosures.

2.5 Provisioning and local network data

During onboarding of hardware, the app may communicate over a local device access point (for example an ESP device network) to deliver Wi‑Fi credentials and MQTT connection settings to the hardware. Those credentials are sent to the device for configuration and are not intended to be stored as a general cloud Wi‑Fi password vault by the mobile app.

2.6 Device and technical information

• Basic app/session technical data needed to operate HTTPS APIs and Firebase services
• Local preferences such as theme mode stored on-device via SharedPreferences

The current mobile app does not integrate Firebase Analytics or Firebase Crashlytics SDKs.

3. How We Use Information

• Authenticate users and enforce role-based access (admin, engineer, customer)
• Show device dashboards, charts, logs, and alerts
• Send remote configuration and control commands to assigned IoT devices
• Deliver push notifications about device conditions when enabled by the platform
• Provision and maintain device connectivity settings
• Operate, secure, and troubleshoot the Service
• Comply with legal obligations and enforce our Terms

4. How We Store Information

• Firebase Authentication — account credentials and auth identifiers
• Cloud Firestore — certain user/profile and firmware catalog data used by the app
• EvaraTech backend API (https://api.evaratech.com) — device registry, telemetry, status, FCM token registration, and related operational data
• MQTT infrastructure — devices communicate with EvaraTech MQTT topics for telemetry, status, events, config, and commands; the mobile app primarily consumes device data through the HTTPS API
• On-device storage — preferences such as theme and remember-email flags

5. Data Security

We use industry-standard transport security (HTTPS/TLS) for API traffic and Firebase services. Device provisioning may temporarily use a constrained local network path to the hardware. No method of transmission or storage is completely secure; please use strong passwords and protect organization-issued accounts.

6. Data Sharing

We share information with:

• Service providers that power the app, including Google Firebase (Authentication, Cloud Messaging, Firestore) and hosting/infrastructure providers used to run api.evaratech.com and related services
• Your organization — administrators and assigned engineers may see devices and operational data according to role permissions
• Legal requirements — if required by law or to protect rights, safety, and security

We do not sell personal information.

7. Third-Party Services

• Google Firebase Authentication, Cloud Messaging, and Firestore
• EvaraTech REST API and MQTT platform services
• Map tile providers used by the in-app map widget (network requests for map imagery)

Third parties process data under their own terms and privacy policies in addition to this Policy, to the extent applicable.

8. Data Retention

We retain account and device-related data for as long as needed to provide the Service to your organization, comply with legal obligations, resolve disputes, and enforce agreements. Telemetry retention periods are controlled by the backend platform configuration for your deployment.

9. Account Deletion and Data Deletion Requests

You may request deletion of your account and associated personal data. Instructions are published at https://docs.evaratech.com/account-deletion.

Organization-managed accounts may also be deactivated or removed by an administrator. Deleting an account may remove or disconnect access to previously assigned devices; IoT hardware ownership and operational logs retained for safety/compliance may require separate administrator handling.

10. Children’s Privacy

The Service is intended for business and industrial users, not for children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children.

11. International Processing

Data may be processed in the regions where our cloud providers and backend infrastructure operate. By using the Service, you understand that information may be transferred to those regions.

12. Changes to This Privacy Policy

We may update this Policy from time to time. We will post the updated version at this URL and revise the effective date. Material changes may also be communicated in-app or by email where appropriate.

13. Contact

Privacy questions: contact@evaratech.com. Deletion requests: support@evaratech.com (see also account deletion).
Postal address: Flat No. 813, D Block, SMR Vinay Symphony, Gachibowli, Seri Lingampally, K.V. Rangareddy, Telangana – 500032, India.