Privacy Policy

InsuBox  |  Effective: 1 May 2026

This Privacy Policy explains how InsuBox (“we”, “our”, or “us”) collects, uses, stores, and protects information when you use the InsuBox mobile application and web portal (collectively, the “Services”). This policy is informed by the principles of the Digital Personal Data Protection Act, 2023 (India) and other applicable Indian data protection laws.

Each sign-in screen of the Services displays a notice stating that, by tapping “Send OTP”, you confirm that you are 18 years of age or older and that you agree to our Terms of Service and to this Privacy Policy. Requesting an OTP is treated as your affirmative consent to the data practices described in this policy. You can withdraw your consent at any time by following the account deletion process, by revoking individual device permissions (camera, location, notifications) in your device or browser settings, or by uninstalling the mobile app.

1. Who We Are

InsuBox is a platform that enables authorised insurance agents and surveyors to capture, organise, and submit vehicle pre-inspection photographs, walk-around video, and documents to insurance companies for policy underwriting and record-keeping purposes. The Services consist of:

• InsuBox mobile app (Android) — used by agents and surveyors to create inspections, capture photographs, upload documents, manage subscriptions, and share completed reports.
• InsuBox web portal (insubox.in) — used by customers invited via a delegation link to upload inspection photos, and by recipients with whom an inspection report has been shared.

2. Information We Collect

• Account & Identity
  Your mobile phone number (used as your account identifier and for OTP-based login). Your first name and last name (required on first sign-in). Your email address and date of birth (optional). For agents, an agent ID and department (optional).
• Inspection Data
  Vehicle details you enter as part of a pre-inspection, including: vehicle registration number, make and model, year, engine number, chassis number, vehicle category, and the inspection type. The app does not currently support post-loss claim inspections, so claim-related fields (claim number, date of loss, damage description, insured name, policy number) are not collected.
• Photos, Video & Documents
  Vehicle inspection photographs you capture through the app or web portal, an optional walk-around video of the vehicle, and supporting documents (such as RC copy, driving licence copy, policy documents) uploaded as PDF, JPG, or PNG files up to 10 MB each. Before each photograph is uploaded, it is processed on your device to embed a visible overlay containing the vehicle registration number, photo label (e.g. “Front View”), capture timestamp, and address derived from GPS. This overlay is rendered locally on your device before the file leaves it. The walk-around video is recorded with audio using your device’s microphone and stored as-is (MP4) with its GPS coordinates and capture timestamp recorded alongside it. Audio is embedded in the video file and is not stored or processed separately.
• Location Data
  GPS coordinates (latitude and longitude) and the address derived from them — including city, state, country, and (where available) postal code and street address — captured at the moment each inspection photograph or walk-around video is taken. Location permission is required to capture inspection photographs; if it is not granted, the camera capture screen will not proceed.
  
  To convert raw GPS coordinates into a readable address, your device or your browser communicates with the following third-party services. Only the resulting address fields and the original coordinates are stored on InsuBox servers:
  • Google Play Services— used on the mobile app to convert coordinates into city, state, and country. This lookup is performed by the device's operating-system location framework.
  • OpenStreetMap Nominatim (nominatim.openstreetmap.org) — used by the mobile app to look up the ISO state code corresponding to the captured coordinates, and used by the customer web upload portal to look up the full street-level address.
• Device & Session Information
  The platform (Android) of the device that captured each photograph or video is recorded alongside it. A session identifier — a random string assigned at app launch — is recorded with each agent-captured photograph and video to group media taken during the same capture session for audit purposes. Photographs submitted through the customer web portal record the upload source.
• Delegated Customer Submissions
  When an agent uses the Delegate feature to invite a vehicle owner or authorised representative (“customer”) to submit inspection photographs via the InsuBox web portal, the following data is collected from that person:
  • Mobile phone number — used to send the delegation link via SMS and to verify identity via OTP before any photograph upload is permitted.
  • A user account is created on our servers linked to that phone number. The account persists after the delegation session ends.
  • First name and last name (required when the customer first signs in to the web portal). Email address and date of birth (optional).
  • All photographs submitted by the customer, including GPS coordinates, capture timestamp, device platform, and the embedded photo overlay described above.
  • Login activity — the dates and times at which the customer first accessed and most recently accessed the web portal.
• Report Recipients
  When an agent shares a completed inspection report with another person by entering their mobile phone number, the following data is collected from that recipient:
  • Mobile phone number — stored to control access to the shared report and to send the report link via SMS, and verified via OTP at the time of access.
  • Email address (optional) — if the agent also provides an email address for the recipient, it is used solely to additionally send the report link by email. Access to the report still requires OTP verification of the recipient's phone number; the email is a delivery channel only.
  • A user account is created on our servers linked to that phone number.
  • Report viewing activity — the date and time the recipient accessed the report are recorded against their account.
  • The same recipient account may subsequently be used to view a list of all inspection reports that have been shared with that phone number (the “Reports Shared With You” history feature).
• Activity & Login Timestamps
  For every user account — agents, delegated customers, and report recipients — we record the date and time of account creation, first sign-in, and most recent sign-in.
• Notifications
  For agents, an Expo push notification token is collected if you grant the notifications permission. This token is used exclusively to send you alerts related to your inspections (e.g. when a delegated customer has completed uploading photographs, when the review window is closing, when a delegation link has expired without a customer upload, or when an inspection is automatically closed after the review window expires). The token is delivered to your device by the Expo push delivery service over Firebase Cloud Messaging.
• Subscription & Billing
  If you purchase a paid subscription, all payments are processed by Google Play Billing. We receive only the subscription status, transaction identifier, and purchase token from RevenueCat (our subscription-management partner) for the purpose of unlocking the corresponding entitlements. We do not store payment card details or banking credentials on our servers.
• Diagnostic Data
  Crash reports and unhandled-error logs from the mobile app are collected automatically when the app encounters a fault. These reports may include your user account identifier so that we can reproduce and resolve the issue. The mobile app sends these reports only in production builds, not during development. No inspection content, photograph data, or payment details are included in diagnostic reports. Crash reporting on the mobile app uses GlitchTip (a Sentry-compatible error-tracking service).

3. How We Use Your Information

• Authentication: Your mobile number is used to send a one-time password (OTP) via SMS and to verify your identity at sign-in. This applies to agents on the mobile app, customers on the web portal, and recipients accessing shared reports.
• Inspection Processing:Vehicle details, photographs, walk-around video, location data, and uploaded documents are transmitted to InsuBox's servers to create, store, and manage vehicle pre-inspection records on your behalf.
• Audit Trail: GPS coordinates, capture timestamps, device platform, and user account identifiers are recorded against each photograph and video to support the integrity of inspection records.
• Customer Delegation:The mobile number you provide when delegating photo capture is used to send a secure link via SMS, verify the customer's identity via OTP, create a linked customer account, and associate submitted photographs with that account.
• Report Sharing & Recipient History:Phone numbers of recipients are used to send report access links via SMS, verify identity via OTP, control access to specific inspection reports, record viewing activity, and surface the “Reports Shared With You” list when the recipient signs in. If an email address is also provided for a recipient, it is used to additionally send the same report link by email.
• Notifications: Your push notification token is used solely to alert you to events relating to your inspections.
• Subscription Management: Subscription status, transaction and purchase identifiers are used to verify your active plan, enforce the free-tier monthly inspection allowance, and unlock paid entitlements.
• Support: Your name and contact details may be used to respond to support enquiries you initiate.
• App Improvement: Diagnostic data, including your user account identifier, is used to identify and fix technical issues within the Services.

4. Third-Party Service Providers

We work with the following service providers to deliver core features of the Services. Each provider is bound by data-processing terms and is permitted to process your data only as needed to deliver the service to us.

• SMS Delivery: Your mobile phone number is shared with our SMS delivery partner (Twilio or MSG91) to send OTP messages, delegation links to customers, and report access links to recipients.
• Email Delivery:If a report recipient's email address is provided, it is shared with our email delivery partner (ZeptoMail) solely to send that recipient a copy of the report access link.
• Cloud Storage: Inspection photographs, walk-around video, and uploaded documents are stored in Microsoft Azure Blob Storage in the India region. Files are accessible only through authenticated, time-limited access links generated by our servers.
• Push Notifications: The Expo push notification service is used to deliver alerts to the mobile app; on Android this delivery uses Firebase Cloud Messaging (FCM). Only the push token and the notification title and body are transmitted to these services.
• Subscription & Payment Processing: In-app subscription purchases are handled by Google Play Billing in conjunction with RevenueCat (our subscription-management partner). RevenueCat informs InsuBox of changes to your subscription status via a server-to-server webhook. No card or banking details are shared with InsuBox.
• Crash Diagnostics: Crash reports from the mobile app, including your user account identifier, are forwarded to GlitchTip (Sentry-compatible) to help us detect and resolve app crashes. No inspection content or payment details are included.
• Location-to-Address Lookup (Reverse Geocoding): To convert GPS coordinates captured with each inspection photograph into a human-readable address, your device or browser communicates directly with one or more of the following parties: Google Play Services (used by the mobile app to look up city, state, country, postal code, and street) and OpenStreetMap Nominatim (used by the mobile app to look up the ISO state code, and by the customer web upload portal to look up the full street-level address). Only the resulting address strings are returned to InsuBox; the lookup itself does not pass through our servers. See the Location Data entry in section 2 for details.
• Mobile App Updates:The mobile app uses the Expo Updates service to deliver in-app code updates. Only your device's update channel and the current runtime version are sent to that service.

5. Data Storage & Security

All data transmitted between the Services and our servers is encrypted using HTTPS (TLS). Inspection photographs, video, and documents are stored in private Azure Blob Storage containers in the India region and are accessible only through time-limited shared-access signatures generated by our servers on demand.

Authentication tokens on the mobile app are stored using the device's secure keystore (Expo SecureStore). Authentication tokens on the web portal are held only in browser sessionStorage for the duration of the browser tab; they are not written to cookies, localStorage, or any persistent browser store.

Screen capture protection: The mobile app blocks screenshots and screen recording while the camera capture screen and the post-capture preview are active. This safeguard helps prevent inspection imagery and its embedded overlay (vehicle number, timestamp, GPS) from being exfiltrated by on-device screen capture.

Session lifetimes:Agent and recipient sign-in tokens issued after OTP verification expire after a limited period (currently 8 hours), after which you will be asked to verify your phone number again. A customer's upload session, opened after OTP verification on a delegation link, has a shorter lifetime (currently 30 minutes by default).

We retain inspection records in accordance with applicable insurance regulatory and record-keeping requirements, typically for a minimum of 3 years after the inspection record is closed. User accounts — including those created for delegated customers and report recipients — are retained for as long as the associated inspection records exist. You may request deletion of your account data at any time by contacting us at support@insubox.in.

6. Data Sharing

• InsuBox is a platform for capturing, organising, and storing vehicle inspection photographs and documents. We do not perform claim assessments or claim audits.
• Sharing by You:The app allows you to share an inspection report with a limited number of recipients (currently up to 3) by entering each recipient's mobile phone number and, optionally, their email address. Each recipient receives a secure link by SMS — and by email if an address was provided — and must verify their identity via OTP before they can view the report. You are responsible for deciding who you share inspection records with.
• We do not sell, rent, or share your personal data with any third parties for marketing or advertising purposes.
• Data may be disclosed if required by Indian law, a valid court order, or an applicable regulatory authority.

7. Your Rights

Subject to applicable law, including the principles of the Digital Personal Data Protection Act, 2023 (India), you have the following rights regarding your personal data:

• Access: You can view your profile and your full inspection history within the app at any time. Recipients can view the inspection reports that have been shared with them through the web portal.
• Correction: You can update your profile information using the Edit Profile screen in the app or by signing in to the web portal.
• Deletion: You can request deletion of your account and all associated personal data by emailing support@insubox.in. Inspection records that are required for regulatory compliance may be retained for the legally mandated period. See our account deletion page for details.
• Withdraw Consent — Location: You can revoke location permission at any time in your device or browser settings. Note that location data is required to capture inspection photographs; revoking this permission will prevent photo capture within the Services.
• Withdraw Consent — Camera & Microphone: You can revoke camera or microphone permission in your device or browser settings. Revoking camera permission will prevent you from taking photographs and recording video within the Services. Revoking microphone permission will prevent audio from being captured in walk-around videos.
• Withdraw Consent — Notifications: You can disable push notifications at any time in your device settings or within the mobile app. This does not affect your ability to use any other feature of the Services.

8. Children's Privacy

The Services are intended for use by authorised insurance surveyors and agents, and by adults (18 years of age or older) invited as customers or recipients. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us at support@insubox.in and we will promptly delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our features or legal obligations. When we do, we will update the “Last updated” date at the top of this page. For material changes, we will notify you through the app. Continued use of the Services after changes are posted constitutes your acceptance of the updated policy.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how your personal data is handled, please contact:

InsuBox
Email: support@insubox.in

We aim to respond to all privacy-related requests within 30 days.