Privacy notice

This notice explains how RecoverWise (“we”, “us”), operating recoverwise.org from India, collects and uses your personal data. We act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) and follow the Information Technology Act, 2000 and the rules made under it.

What we collect

• Account data: your name, email address, password (stored only as a salted scrypt hash), and optionally your country and phone number.
• Case data: what you tell us about the fraud — amounts, dates, payment methods, UTR / transaction references, the scammer’s numbers, IDs and accounts, and your state.
• Evidence files: documents, screenshots and other files you upload, with a SHA-256 fingerprint of each.
• Billing data: if you choose a paid service, the plan selected and the status of your invoice. We do not take card or UPI payments on this website and never store card details.
• Technical data: IP address, browser type and security logs, used to protect accounts and prevent abuse.

Why we use it — and on what basis

• To provide the support you ask for: reviewing your case, preparing evidence reports and reporting plans. We rely on the consent you give when you create an account and submit a case.
• To send service emails — account confirmation, password resets and case updates.
• To keep the service secure and prevent fraud and misuse, and to comply with legal obligations.

We do not sell your data, do not use it for advertising, and do not share it with anyone — including police, banks or platforms — without your explicit permission, unless Indian law requires us to.

AI assistance

Our case team may use AI models running on Amazon Bedrock in the AWS Mumbai region to summarise a case or draft a reply. A team member always reviews the output; AI never makes decisions about you. Your data is not used to train these models.

Where it is stored

Your data is stored on Amazon Web Services, encrypted at rest (AES-256) and in transit (TLS). Our application servers are currently hosted in the AWS London region, and service emails are sent through Amazon SES. These transfers are permitted under the DPDP Act and protected by the same encryption and access controls. Our website is delivered through Cloudflare, which processes connection data to protect the site from attacks.

How long we keep it

We keep your account and cases until you delete them or no longer need our service. Closed cases are retained for up to 24 months so you can refer back to them, after which we may delete them. When you delete your account, your cases and files are permanently erased; encrypted backups expire within 30 days.

Your rights

Under the DPDP Act you may: access a summary of your data; correct, complete or update it; erase it; withdraw consent at any time (as easily as you gave it); nominate another person to exercise your rights in the event of death or incapacity; and seek grievance redressal. You can delete your account yourself from Account settings. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, you can contact our Grievance Officer at [email protected]. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

Cookies

We use a single strictly-necessary cookie to keep you signed in. We do not use advertising or tracking cookies.

Contact

Questions about privacy: [email protected].