Legal
Privacy Policy
Last updated: October 6, 2026
1. Who We Are
EarthReheal (“EarthReheal”, “we”, “us”) builds evidence infrastructure for environmental healing. This policy covers two products: EarthReheal WasteLedger, our platform for organisations (RWAs, hotels, hospitals, municipalities, waste handlers, and others), and the EarthReheal App, our mobile app for individual citizens and students. It applies to our website, mobile apps, and related services (together, the “Service”). The Service is operated by Earthreheal Private Limited, C-1011, Ozone Evergreens, Haralur Sy No. 53 & 54, Marathahalli Colony, Bangalore North, Bengaluru, Karnataka 560037, India. If you use the EarthReheal App outside India, the separate notice in Section 11 applies to you instead of Sections 2 to 9.
2. What We Collect
We collect only what the Service needs to work:
- Account & profile information — name, phone number, email address, password (stored as a salted hash, never in plain text), and, where you provide it, your address and country.
- Location data — used to geocode your address, schedule and route pickups or drop-offs, and geotag evidence photos. Non-India users enter a simple free-text address instead of a map pin.
- Photos and camera data — evidence photos of waste, infrastructure, or recyclables you choose to capture, and QR codes you scan. You control when the camera is used; we do not access your camera roll without your action.
- On-device biometrics — if you enable Face ID or fingerprint unlock before capturing evidence, that check happens entirely on your device using your OS’s biometric APIs. We never receive, see, or store your biometric data.
- Transaction & activity data — recyclable sales you complete, Green Bank coin balances and redemptions, mission and quiz progress, and (for organisations) compliance tasks and submitted records.
- Device & technical data — app version, device type, crash and performance diagnostics, and a push-notification token so we can send you updates you’ve opted into.
- Support communications — anything you send us directly, e.g. by email or through in-app support.
3. Carbon Credit Evidence — Consent-Based and Anonymised
If you choose to contribute your verified recycling receipts toward pooled carbon-credit evidence, we ask for your explicit, separate consent first. Once given, the underlying record that enters the shared pool is stripped of your identity — it carries a one-way cryptographic hash of the evidence, not your name, account, or receipt ID. We cannot reverse that hash back to you. You can withdraw this consent at any time in the app; future receipts stop being included, though entries already anonymised into the pool cannot be individually un-pooled since they no longer identify you.
4. How We Use What We Collect
- To operate the Service — your account, evidence capture, scheduling, sales, and rewards.
- To verify evidence and calculate compliance status, environmental impact, and carbon estimates.
- To process recyclable sales and Green Bank payouts.
- To respond to support requests and communicate service-relevant updates.
- To detect fraud, abuse, or fake evidence, and to keep the platform trustworthy for everyone using it.
- To meet legal and regulatory obligations, including generating compliance reports for organisations.
6. Students and Children
Part of the EarthReheal App is designed for use in schools — missions, quizzes, and games that teach environmental habits. Where a user is a minor, we collect the minimum data needed for that experience (school affiliation and in-app progress) and do not use a minor’s data for behavioural advertising. Access to student features is intended to be arranged through a school or guardian. If you are a parent or guardian and believe your child has provided us with personal data without appropriate consent, contact us at help@earthreheal.com and we will act on it, including deletion where appropriate.
7. Security & Retention
Data is encrypted in transit (TLS) and at rest. We host on India-based cloud infrastructure to support data residency and align with the Digital Personal Data Protection Act, 2023. We retain personal data for as long as your account is active, plus any period required to meet legal, tax, or regulatory obligations, after which it is deleted or anonymised.
8. Your Rights
You can, at any time:
- Access or correct your profile information from within the app.
- Withdraw carbon-credit evidence consent (see Section 3).
- Turn off non-essential notifications in Settings.
- Request a copy of your data, or request deletion of your account, by writing to help@earthreheal.com. We will act on verified requests within a reasonable time, subject to records we must legally retain.
If you are in the European Economic Area, UK, or another jurisdiction with its own data-protection regime, you may have additional rights under that law (e.g. GDPR); we will honour applicable requests from that jurisdiction on the same basis.
9. Changes to This Policy
We may update this policy as the Service changes. Material changes will be announced in the app or on this page before they take effect. Continued use of the Service after an update means you accept the revised policy.
10. Contact Us
Questions about this policy or your data can be sent to help@earthreheal.com, or by post to Earthreheal Private Limited, C-1011, Ozone Evergreens, Haralur Sy No. 53 & 54, Marathahalli Colony, Bangalore North, Bengaluru, Karnataka 560037, India. See also our Terms of Service.
11. Using the EarthReheal App Outside India
Notice version 2026-10
Who we are
EarthReheal is operated by Earthreheal Private Limited, C-1011, Ozone Evergreens, Haralur Sy No. 53 & 54, Marathahalli Colony, Bangalore North, Bengaluru, Karnataka 560037, India. Contact us about privacy at help@earthreheal.com.
The short version
Outside India, the EarthReheal app runs on your phone. Your footprint, actions, challenges, events, game progress and anything else you enter are saved only on your device. We cannot see them.
To let you sign in, we keep your email address, a hashed (scrambled) password and your country. That is all.
What we hold, and why
| Data | Why | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Email address | To sign you in and send your temporary password or a password reset | Performance of a contract (Art. 6(1)(b)) |
| Password, stored only as a one-way hash | To sign you in | Performance of a contract |
| Country | To show you the version of the app for where you live | Performance of a contract |
| That you confirmed you are 16 or older, and when | To make sure the service is used by people old enough to agree to it | Legal obligation / legitimate interest (Art. 6(1)(c)/(f)) |
| Which privacy notice you accepted, and when | To show you agreed to this notice | Legitimate interest (Art. 6(1)(f)) |
| Technical records of each request to our server: the time, the part of the service called, the app version, any error, and an approximate city and country worked out from your IP address. The IP address itself is not stored. | Security and keeping the service running. Kept for up to 90 days | Legitimate interest (Art. 6(1)(f)) |
We do not collect your name, phone number, date of birth, address, location, photos or contacts. We use no advertising, analytics or tracking SDKs, and we do not sell or share your personal information.
When you share a challenge or a cleanup drive
When you share a challenge or a cleanup drive, the app puts its details (the name, dates, and the place you typed for a drive) into the link itself. Your friend’s app reads the link and keeps its own copy. We do not receive or store it.
If your friend opens the link in a web browser, our page at earthreheal.com/join shows the details. They are read from the part of the link after the #, which browsers do not send to any server, so they do not reach us or our logs. Only the people you send the link to can see what is in it.
Where it is stored and who processes it
Your account is stored on Microsoft Azure servers in India (Central India region). Microsoft hosts the service, keeps the technical records above, and sends our account emails (Azure Communication Services) as our processor, under its standard data processing terms. Nobody else receives your data.
If you are in the EU, the UK or another country with transfer rules: you send your email to us directly when you sign up, and we hold it in India to provide the service you asked for.
How long we keep it
Until you delete your account. Deleting it erases your account record and disables your login. Technical records are kept for up to 90 days.
Your rights
- See and download your data: in the app, go to Me → Download my data. You get a file with everything our server holds about you and everything the app holds on your phone.
- Delete your account: go to Me → Delete my account. This erases your account from our server and the app data from your phone.
- Correct your email, object, or ask anything else: email help@earthreheal.com. We answer within one month.
- Complain: you can contact your local data protection authority. In the EU, that is the authority in your country. In the UK, it is the ICO.
California residents: we do not sell or share personal information, and we use none for targeted advertising. You may ask to know, delete or correct the information described above using the in-app options or by emailing us. We will not treat you differently for doing so.
Children
You must be 16 or older to create an account outside India.
Changes
If we change this notice, the app will ask you to read and accept the new version.