Data Protection & Compliance
Last updated: February 12, 2026
DPDPA 2023
India
Compliant with the Digital Personal Data Protection Act
GDPR Aligned
European Union
Privacy practices aligned with EU data protection standards
Biometric Safeguards
Global
Enhanced protections for biometric and identity data
Gmore is committed to protecting the privacy and security of our users' data. This page outlines our compliance framework, the regulations we adhere to, and the measures we take to safeguard your personal information.
1. Our Role Under Data Protection Law
Data Fiduciary (DPDPA) / Data Controller (GDPR)
Gmore acts as the Data Fiduciary under India's Digital Personal Data Protection Act (DPDPA) 2023, and as a Data Controller under GDPR for users in the European Economic Area.
- We determine the purposes and means of processing personal data
- We are responsible for ensuring compliance with applicable data protection laws
- We are accountable for the data processing activities of our service providers (Data Processors)
2. India: Digital Personal Data Protection Act (DPDPA) 2023
As our primary jurisdiction, we fully comply with India's DPDPA 2023. Key compliance measures include:
Lawful Purpose and Consent
- We process personal data only for lawful purposes with your informed consent
- Consent is obtained at the point of data collection with clear, specific language about how data will be used
- For biometric data (face embeddings), we obtain explicit, separate consent during the identity verification process
- You may withdraw consent at any time through your account settings or by contacting us
Data Principal Rights
Under the DPDPA, you (the "Data Principal") have the right to:
- Access: Obtain confirmation of whether we process your data and a summary of such data
- Correction and Erasure: Request correction of inaccurate data or deletion of data no longer necessary for its purpose
- Nomination: Nominate another individual to exercise your rights in the event of your death or incapacity
- Grievance Redressal: File a grievance with us, and if unresolved, escalate to the Data Protection Board of India
Data Breach Notification
In the event of a personal data breach that is likely to cause harm, we will notify affected Data Principals and the Data Protection Board of India as required by the DPDPA, without unreasonable delay.
Cross-Border Data Transfers
We transfer data to jurisdictions permitted under the DPDPA. Our primary database is hosted in Singapore (Supabase), with content delivery through Cloudflare's global network. We ensure all transfers are subject to appropriate contractual safeguards.
3. European Union: GDPR Alignment
While Gmore is primarily operated from India, we align our privacy practices with the EU General Data Protection Regulation (GDPR) to provide a consistent level of data protection for all users.
Legal Bases for Processing
- Consent: For optional features like location tracking, calendar sync, and marketing communications
- Contract Performance: To provide the services you signed up for (account management, subscriptions, messaging)
- Legitimate Interest: For fraud prevention, platform security, and service improvement
- Legal Obligation: For tax records, regulatory compliance, and responding to legal requests
- Explicit Consent: For processing biometric data (face embeddings) during identity verification
GDPR-Specific Rights
In addition to the rights listed in our Privacy Policy, EU users may also:
- Right to Restrict Processing: Request that we limit processing of your data while a complaint is being resolved
- Right to Object: Object to processing based on legitimate interests, including profiling
- Right Not to Be Subject to Automated Decisions: Request human review of decisions made solely by automated processing that significantly affect you
- Lodge a Complaint: File a complaint with your local Data Protection Authority
4. Biometric Data Compliance
Enhanced Protections for Biometric Data
Gmore collects biometric data (facial geometry stored as mathematical face embeddings) during identity verification. This data receives the highest level of protection under all applicable laws.
- Purpose Limitation: Biometric data is used exclusively for identity confirmation, fraud prevention, and duplicate account detection. It is never used for surveillance, marketing, or profiling
- Explicit Consent: We obtain your explicit, informed consent before collecting biometric data. You are clearly informed of the purpose before the verification process begins
- Data Minimisation: We store mathematical representations (numerical vectors) of facial geometry, not raw photographs. Face embeddings are processed on-device before secure transmission
- Encrypted Storage: All biometric data is stored in encrypted form with access restricted to authorised verification processes
- Retention Limits: Biometric data is retained for the duration of your account plus 30 days after account deletion, then permanently and irreversibly deleted
- Withdrawal of Consent: You may withdraw consent for biometric data processing at any time by contacting info@gmore.app. Note that withdrawal may affect your verification status
5. Data Processing and Infrastructure
Service Providers (Data Processors)
All third-party service providers are bound by data processing agreements that require them to process data only for specified purposes and maintain appropriate security measures.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication | Singapore |
| Cloudflare | Video streaming, CDN, storage | Global |
| Razorpay | Payment processing (India/INR) | India |
| Stripe | Payment processing (international) | US / Global |
| Google Maps / Places | Location and mapping services | US / Global |
| Sentry | Error tracking, crash reporting | US |
| PostHog | Product analytics, feature flags | US / EU |
Security Measures
- Encryption: All data encrypted in transit (TLS 1.2+) and at rest
- Access Controls: Role-based access control (RBAC) with principle of least privilege
- Authentication: Row-level security (RLS) policies on all database tables ensure users can only access their own data
- Device Security: Native root/jailbreak detection and device attestation to protect platform integrity
- Monitoring: Real-time error monitoring and audit logging for security-sensitive operations
- Identity Verification: Multi-layered fraud detection including document quality analysis, liveness detection, and duplicate face matching
6. Data Retention Summary
| Data Type | Retention Period |
|---|---|
| Account data | Duration of active account |
| Identity documents & biometric data | Account duration + 30 days after deletion |
| User content (listings, videos, reviews) | Removed on deletion; backups purged within 90 days |
| Transaction records | 7 years (tax/financial regulations) |
| Usage and analytics logs | Up to 12 months |
| Anonymised / aggregated data | Indefinitely (cannot identify individuals) |
7. Exercising Your Rights
To exercise any of your data protection rights, you can:
- In-App: Use the privacy and data management options in your account settings
- Email: Send a request to info@gmore.app with the subject line "Data Rights Request"
We will verify your identity before processing any request and respond within 30 days. If we need additional time, we will inform you of the reason and the expected timeline.
Grievance / Complaint
If you are unsatisfied with our response, you have the right to escalate:
- India: File a complaint with the Data Protection Board of India
- EU: File a complaint with your local Data Protection Authority
- Other jurisdictions: Contact your relevant data protection regulator
8. Contact Us
For compliance-related questions, data protection inquiries, or to exercise your rights:
We aim to respond to all inquiries within 48 hours.
Related policies: Privacy Policy · Terms & Conditions · Cookie Policy
© 2026 Gmore. All rights reserved.