Privacy Policy

• Account: name, email, phone, campus, year of study, profile photo.
• Listings: photos, titles, descriptions, prices, and chat messages tied to a listing.
• Transactions: escrow records, payout bank/UPI handle (not full account number), Razorpay payment IDs.
• Verification: a single image of your college ID card plus campus-issued email. See section 3.
• Device & usage: IP, browser, OS, pages visited — used only for security and product analytics.

We do not collect your Aadhaar, PAN, CGPA, attendance, location history, contacts list, or biometric data. We do not buy data from third parties. We do not have any access to your camera roll, SMS, or call logs.

To list or buy on UltraOver you submit one photo of a valid student ID card and verify a campus-issued email (e.g. @iitb.ac.in). Here's exactly what happens to that data:

• At upload: the image is transmitted over TLS 1.3 and written to a private, RLS-protected storage bucket. Only your account can read it back.
• At rest: stored encrypted with AES-256 server-side. The bucket is not public. URLs are short-lived signed URLs only generated for our trust & safety reviewers.
• Who sees it: a small, audited trust & safety team during the initial verification check and any subsequent fraud investigation. Sellers, buyers, and other students never see your ID — they see your verified badge, name, and campus only.
• Auto-deletion: the raw ID image is deleted within 30 days of successful verification. We keep only a SHA-256 hash and verification timestamp so we can prove the check happened without storing the document.
• On failure or rejection: the image is deleted within 7 days regardless of outcome.
• On account closure: any remaining ID data, profile photo, and chats are purged within 14 days, except minimal records we are legally required to retain (e.g. tax records for completed transactions).

• Run the marketplace — show listings, route escrow, send notifications.
• Verify you're a real student on a real campus.
• Detect and stop fraud, scams, or harassment.
• Improve the product with aggregated analytics. We never sell your personal data.

Only the processors required to run UltraOver: Lovable Cloud (database, auth, storage), Razorpay (payments & payouts), and our transactional email provider. Each has its own security review and is contractually bound to handle your data only on our instructions. We disclose data to law enforcement only when compelled by a valid Indian legal request.

You can view and edit your profile from /profile. You can request a full data export or permanent deletion of your account by emailing privacy@ultraover.com from your registered email. We respond within 7 working days.

We use first-party cookies for session login and CSRF protection only. No third-party advertising cookies, no cross-site trackers, no Facebook Pixel.

UltraOver is for students aged 18 and above. We do not knowingly collect data from anyone under 18.

Material changes to this policy get an in-app notice 14 days before taking effect.

Privacy questions: privacy@ultraover.com · Data Protection Officer: Aarav Mehta.