Privacy Policy

When you register and use Rista, we collect:

• Account details you provide — name, phone number, email, and business/shop details.
• Login and session data — your Firebase authentication identity and a signed session cookie used to keep you logged in. If you sign in with Google, see "Signing in with Google" below for what that specifically involves.
• Wallet and transaction records — top-up requests, UPI transaction references you submit for review, and the resulting ledger of credits and debits against your account.
• Files you upload for printing jobs — photos and layouts used by PVC Print, Passport Studio, and Bulk Design.
• Card lookup inputs and results — for registered retailers using the Cards feature, the ration card number, Aadhaar number, EPIC (Voter ID) number, or PAN reference you submit, and the government-verified record returned for it.
• OTP-based Aadhaar verification data — for ABHA, AP Rice Card, TG New Ration Card, and PAN Mobile & Email Link, the Aadhaar number you submit and the resulting government-verified record. See "OTP-based Aadhaar verification" below for exactly what that record can contain.

The Ration Card, Aadhaar-to-PAN, Voter ID, AP Rice Card, and TG New Ration Card lookup services each query a real, government-linked data source, not test or sample data. A lookup returns another person's real identity record — for Voter ID specifically, this includes the elector's name, relation name, age, gender, address, and assembly constituency details from the electoral roll. These features are restricted to registered retailer accounts and exist to support legitimate service-counter use — looking up a card or number on someone else's behalf without their authorization is a misuse of this feature, not an intended use, and may be logged and reviewed.

Four services — ABHA (Aadhaar-based health ID), AP Rice Card, TG New Ration Card (when address is fetched via Aadhaar rather than entered manually), and PAN Mobile & Email Link (via NSDL) — verify identity using a one-time password sent by the government's own system to the Aadhaar-linked mobile number, not by Rista. The OTP itself is used only to complete that one verification call and is not stored afterward. Depending on the service, the government-verified record returned can include the person's name, date of birth, gender, father's name, address, and a photograph. For ABHA specifically, a successful verification also returns an ABHA number and status, and results in a government-issued ABHA card. For PAN Mobile & Email Link, a second, separate OTP is sent to the mobile number and/or email address being linked to the PAN, distinct from the Aadhaar OTP used to verify identity.

If you choose to sign in or register using "Continue with Google" instead of a password, Google shares your name, email address, and profile photo with us as part of that sign-in. We store your name and email address as part of your Rista account profile, the same as if you'd typed them in directly — we do not store or otherwise use your Google profile photo, and we do not request or access any other Google account data (your Gmail, contacts, calendar, files, or anything else in your Google account).

All application data (accounts, wallet records, lookup history, job data) is stored in a Firestore database located in Mumbai, India (asia-south1). Uploaded files (photos, print jobs, QR images) are stored in Firebase Cloud Storage, also in Mumbai, India (asia-south1). We do not maintain a separate copy of your data outside this region.

Rista does not process card or bank payments directly. Top-ups are done by paying an admin-configured UPI ID and submitting the resulting UPI transaction reference for manual review — we do not receive or store your card, bank account, or UPI PIN details at any point; UPI transfers happen entirely within your own UPI app. Your wallet balance and full transaction ledger (top-ups, lookup charges, refunds, admin adjustments) are visible to you in your account and are retained for as long as your account is active, for billing accuracy and dispute resolution.

Your account data is visible to you and to Rista administrators who operate the platform (for support, billing review, and fraud/misuse prevention). We do not sell your data. Card lookup results are returned only to the retailer who requested them and are retained temporarily as lookup history, per this policy's retention terms above.

You can request a copy of your account data, ask us to correct inaccurate account details, or ask us to close your account, by contacting us using the details below. Some records (such as wallet transaction history) may be retained after account closure where needed for financial record-keeping.

For privacy questions, data requests, or grievances, contact us at support@ristaone.in.