This Privacy Policy explains how EV Infra Advisory, a sole proprietorship of Bonagiri L K Mahesh (“EV Infra Advisory”, “we”, “us” or “our”), collects and handles personal data through evinfraadvisory.in, its screening tools and its advisory services.
We act as the Data Fiduciary for personal data collected for our own purposes under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), to the extent that the Act and rules made under it apply.
1. Important notice about external data transfers
Using the Website’s tools can send information to external services. It would be incorrect to state that all tool use remains within the Website or the user’s device.
In particular:
- GeoSite sends entered coordinates to Nominatim, an OpenStreetMap geocoding service, and to Open-Elevation.
- When a paid written report is generated, the project input and the supporting evidence for that site are sent from our server to Anthropic’s API in order to produce the report. This request is made by us, using our own credentials, and the information passes through our systems rather than directly from the browser. A copy of the report and the inputs it was produced from is stored against the account.
Users should not enter confidential, personal or third-party information into these tools unless it is necessary and they have the right to provide it.
2. Personal data we may collect
- Name, email address, telephone number and organisation details;
- Site address, geographic coordinates and property or project information;
- Details about parking, access, traffic, electricity supply, proposed chargers, costs and intended business model;
- Documents, photographs, notes and other evidence submitted for analysis;
- Information shared during advisory calls or correspondence;
- Payment reference, invoice and transaction status information;
- IP address, browser type, device information, timestamps and technical logs;
- Tool inputs, calculated results and usage events;
- Support, cancellation, refund and grievance records;
- Account records, where an account is created: the email address used to sign in, sign-in timestamps, purchases, entitlements and subscription status. Sign-in is passwordless, so we do not collect, store or process a password for your account; and
- Reports generated for you, stored against your account together with the site inputs they were produced from, so that you can return to them.
We no longer ask any user for an Anthropic API key. Earlier versions of the GeoSite tool offered a “Live mode” in which the user supplied their own key; that option has been removed, and report generation now runs on our own server-side key. The browser never holds or transmits an API key.
We do not require Aadhaar numbers, PAN documents, bank statements, payment card details or unrelated sensitive documents for ordinary screening. Users should avoid uploading such information unless we have specifically requested it for a lawful and necessary purpose.
3. How we collect data
- Directly from forms, questionnaires and tools;
- During calls, emails and project communications;
- Through payments processed by Razorpay;
- Automatically through security and technical logs;
- From documents supplied by the client;
- From third-party datasets and services used to assess a location; and
- At the site itself, during a Step 4 or Step 5 visit.
What a site visit collects. A visit produces measurements, notes, photographs and short videos of the plot, its access, its boundaries and the existing electrical supply. We photograph the site, not people. Where a person, a vehicle, a number plate or a neighbouring property appears incidentally in a frame we need, we will obscure it before the image is used in a report unless the client confirms it is theirs and consents. We do not photograph the interior of any property we have not been asked to assess, and we stop if asked to by whoever controls the site.
Site-visit material is used to produce the client’s Detailed Project Report, 3D model and AR walkthrough, and is held with the rest of that project record. It is not used for marketing, published, or shown to another client without the client’s written permission.
Arranging access is the client’s responsibility. By asking us to attend, the client confirms that it is entitled to admit us to the site and to have it surveyed and photographed for this purpose.
4. Purposes of processing
- Provide site screening, written reports, feasibility work, site visits and project reports, launch support and monthly reporting;
- Generate tool outputs and reports;
- Schedule and conduct calls;
- Verify payments and issue invoices or refunds;
- Respond to support and grievance requests;
- Maintain project and business records;
- Improve the reliability, security and usability of our services;
- Prevent fraud, misuse and security incidents;
- Meet tax, accounting and other legal obligations; and
- Establish, exercise or defend legal claims.
Processing will be based on consent and other grounds permitted under the DPDP Act, including applicable legitimate uses. Where processing depends on consent, the user may withdraw that consent as described below.
5. GeoSite and external processors
The following disclosures apply specifically to GeoSite and related services.
Nominatim / OpenStreetMap geocoding
Information involved: Entered coordinates or location query; the service may also receive the user’s IP address and standard request headers. Purpose: Convert coordinates into location information or support map-based site analysis. Retention: We do not use Nominatim as our project-record storage. Its operator may retain access logs or request information under its own privacy, security and operational policies. We do not control that provider-side retention. Cross-border: Requests may be processed or logged on infrastructure outside India.
Open-Elevation
Information involved: Entered coordinates; the service may also receive the user’s IP address and standard request headers. Purpose: Obtain elevation data for the selected location. Retention: We do not use Open-Elevation as our project-record storage. Its operator may retain request or access logs under its own policies. We do not control that provider-side retention. Cross-border: Requests may be processed or logged outside India.
Anthropic API — paid written reports only
Information involved: The project input and supporting evidence for the site the report was bought for, together with our instructions to the model. When: Only when a paid report is generated. Free screening never contacts Anthropic. Purpose: Produce the written report. Retention: Anthropic handles API inputs, outputs and logs under its own API terms and retention arrangements, which may include retention for security, abuse-prevention or legal reasons. We do not control that independent retention. Cross-border: Anthropic may process or store the information outside India.
The request is made by our server using our own credentials. No user is asked for, and the Website does not handle, an API key of their own.
Supabase — accounts and purchase records
Information involved: Sign-in email address, session tokens, purchase and entitlement records, and generated reports with the inputs behind them. Purpose: Operate sign-in, remember what has been bought, and make reports available again later. Retention: For as long as the account exists, then as described in section 10. Location: The database is hosted in the Mumbai (ap-south-1) region, so account and purchase records are stored in India. Supabase, as the provider, may process limited operational and diagnostic data elsewhere.
Razorpay
Information involved: Name, contact details, payment amount, transaction identifiers, payment status and payment information entered with Razorpay. Purpose: Collect payments, confirm transactions, process refunds and prevent fraud. Retention: Razorpay and regulated payment participants retain payment records according to their policies and applicable financial, tax, security and regulatory requirements. Cross-border: Payment processing and storage are subject to applicable Indian localisation and cross-border rules and Razorpay’s infrastructure arrangements.
Other hosting, email, scheduling, document-storage, analytics and support providers may process limited information for operating the service. We require service providers engaged by us to handle information only for authorised purposes and with appropriate safeguards.
6. GeoSite choices and precautions
If a user does not want coordinates sent to Nominatim or Open-Elevation, the user should not run the GeoSite function that requests geocoding or elevation data and may contact us at support@evinfraadvisory.in to ask whether a manual alternative is available.
Buying a written report is optional, and it is the only step that sends your project input to Anthropic. The free screening — geometry, electrical sizing, transformer selection and the decision gate — runs without contacting Anthropic at all, and its result is complete on its own. A user who does not want that information sent should use the free screening and not buy a report.
Before buying a report, users should:
- Remove unnecessary personal or confidential information from the inputs;
- Avoid entering Aadhaar, PAN, bank, card or unrelated identity records; and
- Confirm that they have authority to disclose any third-party information.
7. Payment information
Payments may be processed through Razorpay. Payment card, UPI, bank or wallet credentials entered on Razorpay’s interface are handled by Razorpay and the relevant regulated payment participant.
We ordinarily receive transaction identifiers, amount, status and limited purchaser details needed to verify payment, issue invoices and process refunds. We do not intentionally store complete card numbers, CVV values, UPI PINs or internet-banking passwords.
8. Sharing of personal data
- With service providers supporting hosting, email, scheduling, payments, document delivery, security and customer support;
- With Nominatim, Open-Elevation and Anthropic when the relevant GeoSite function is used;
- With professional advisers where necessary and subject to confidentiality;
- With a vendor, operator, lender or other party when the user expressly asks us to make an introduction or share a report;
- With government bodies, courts or regulators where disclosure is required by law; or
- In connection with a lawful business reorganisation, subject to appropriate protection.
We do not sell personal data.
Receiving a referral fee does not authorise us to share a user’s contact or project information with the referral partner without an applicable lawful basis and appropriate notice or consent.
9. Cross-border processing
Nominatim, Open-Elevation, Anthropic and other technology providers may process or store personal data outside India.
Where we arrange cross-border processing, we will take reasonable steps to use providers offering appropriate contractual, technical and organisational safeguards. Transfers remain subject to any restrictions notified by the Central Government under the DPDP Act and other applicable Indian law.
A third-party service may also independently determine aspects of its processing under its own privacy terms. Users should review the relevant provider’s current privacy and retention terms before submitting confidential information.
10. Retention by EV Infra Advisory
We retain personal data only for as long as reasonably necessary for the stated purpose, including:
- Providing and supporting the requested service;
- Maintaining the project and decision record;
- Handling corrections, refunds, grievances and disputes;
- Meeting GST, accounting and other legal record-keeping requirements;
- Enforcing agreements and defending legal claims; and
- Maintaining proportionate security logs and backups; and
- Keeping account records, purchases and generated reports available to the account holder for as long as the account exists.
Generated reports. A report and the inputs it was produced from are kept against the account so that it can be opened again later. Ask us and we will delete a specific report, or all of them, without closing the account. Closing the account removes them, except where an invoice or payment record must be retained by law.
When information is no longer required, we will delete, anonymise or securely isolate it, subject to applicable law and backup cycles.
Third-party providers control their own logs and legally required records. Where a valid erasure request applies to information processed on our behalf, we will take reasonable steps to instruct the relevant provider to delete it. We cannot require deletion of records that a provider independently must retain by law or for a separate lawful purpose.
11. Security
We use reasonable administrative, technical and organisational measures appropriate to the nature of the data, including access controls, restricted internal access, secure transmission where supported, software maintenance and backup practices.
No website, browser-storage method or internet transmission is completely secure. Users remain responsible for protecting their devices, email accounts, passwords and API keys.
If we become aware of a personal-data breach, we will assess it and provide notifications to affected Data Principals and the Data Protection Board of India where required by applicable law.
12. Your rights under the DPDP Act
Subject to applicable law, a Data Principal may request:
- Information about personal data being processed and relevant sharing;
- Correction of inaccurate or misleading personal data;
- Completion or updating of incomplete or outdated personal data;
- Erasure of personal data that is no longer required for the specified purpose, unless retention is legally necessary;
- Withdrawal of consent;
- Grievance redressal; and
- Nomination of another individual to exercise rights in the event of death or incapacity, where applicable.
These rights are handled through the following operational process.
Step 1: Submit the request
Email support@evinfraadvisory.in with the subject line “DPDP request”, or contact the Grievance Officer:
Grievance Officer: Bonagiri L K Mahesh
Email: support@evinfraadvisory.in
Phone: +91 76800 78889
Postal address: Tarnaka, Hyderabad, 500017, Telangana, India
State the right being exercised, identify the relevant service or project and provide enough information to locate the record.
Step 2: Verification
We will use proportionate steps to confirm the requester’s identity. We will not request more identity information than reasonably necessary. If a request is made through an authorised person or nominee, we may ask for evidence of that authority.
Step 3: Acknowledgement and review
We will acknowledge the request within 2 working days.
We will search relevant active systems and records, assess any legal retention requirement and respond or provide a progress update within 7 working days.
Step 4: Erasure
For a valid erasure request, we will:
- Identify the personal data held in our active systems;
- Delete or anonymise data that is no longer required;
- Notify processors handling the data on our behalf where appropriate;
- Explain any information that must be retained, the legal reason and the applicable retention criteria; and
- Confirm completion when the process is finished.
Closing your account is also a way to have account records erased; see the Terms for what closure does and does not affect. Invoices and payment records that we are required to keep by law are retained as described in section 10.
Step 5: Withdrawal of consent
Consent may be withdrawn by:
- Not buying a written report, so that no project input is sent to Anthropic;
- Signing out, or asking us to close your account;
- Changing available privacy or communication settings; or
- Contacting the Grievance Officer.
After withdrawal, we will stop future processing that depends solely on that consent within 3 working days. Withdrawal does not affect processing already lawfully completed and does not require deletion of records that must be retained under law.
If the withdrawn consent is necessary to provide a requested function, that function may no longer be available. For example, a written report cannot be produced without transmitting the request to Anthropic, and an account cannot be maintained without storing the sign-in email address.
Step 6: Grievance escalation
The Grievance Officer will review complaints concerning collection, use, sharing, retention, security, rights requests or withdrawal of consent.
We will provide a reasoned response within 15 working days. If the grievance remains unresolved after this internal process, the Data Principal may approach the Data Protection Board of India in the manner available under applicable law.
13. Children’s data
The Website and advisory services are intended for persons who are at least 18 years old. We do not knowingly offer these commercial advisory services directly to children.
If a child’s personal data has been submitted without valid parental consent, the parent or lawful guardian should contact the Grievance Officer so that it can be reviewed and erased where required.
14. Cookies and technical data
The Website may use essential browser storage or cookies to operate forms, maintain sessions, remember tool settings, protect security and record consent choices.
If non-essential analytics or advertising cookies are introduced, users will be provided with an appropriate notice and choice where required. Rejecting non-essential cookies will not prevent access to basic Website information, although some optional functionality may be affected.
We do not use browser storage to retain any API key, and no longer ask users for one. Where you sign in, a session token is held in browser storage so that you stay signed in between pages; signing out removes it.
15. Changes to this Privacy Policy
We may update this policy when our services, processors, legal obligations or data practices change. The latest version will be published with its updated date.
If a change materially affects how previously collected personal data is used, we will provide additional notice or seek fresh consent where required.
16. Contact details
Data Fiduciary: EV Infra Advisory (sole proprietorship of Bonagiri L K Mahesh)
Address: Tarnaka, Hyderabad, 500017, Telangana, India
GSTIN: 36BADPB5969D1ZT
General support: support@evinfraadvisory.in / +91 76800 78889
Grievance Officer: Bonagiri L K Mahesh
Grievance contact: support@evinfraadvisory.in / +91 76800 78889