01 — Who we are
BOQ+ by Verkzo, operated by Akshay Pratap Singh Jamwal (“we”, “us”). For the DPDP Act, we are the Data Fiduciary for the personal data described here and you are the Data Principal. For anything in this policy, including grievances, write to akshay@boq.co.in.
02 — What we collect, and why
| Data | Where it comes from | Why |
|---|---|---|
| Account details — email address, name (if your Apple or Google account shares it), sign-in identifier, or a guest ID if you don't sign in | You, at sign-in; the app, for guests | Creating and securing your account, restoring purchases, support |
| Firm profile — your state, city (if you add it), and the departments and work types you follow | You, in the app | Showing relevant tenders and alerts, and sensible defaults |
| Firm name (optional) | You, in the app | Printing it on BOQs you export. If you add it, we also look for your firm's bids in public tender results to build your private track record (win rate, margin vs L1). Only you see this. Remove the firm name to stop it. |
| BOQ files and comparative statements you upload | You | We read the file to extract its items, then delete the file right after reading. We keep the extracted items, the file name and a fingerprint so you can keep working on it. |
| Rates you enter, scenarios, exports, and feedback you send | You | Providing the service and answering you |
| Purchase data — plan, product, purchase and expiry dates, store transaction ID | Apple App Store / Google Play | Activating your plan or credits, refunds and disputes. We never see card or bank details. |
| App usage events — e.g. app opened, BOQ uploaded, report viewed, plans screen viewed, purchase made | The app, automatically | Understanding what works and fixing what doesn't |
| Device identifiers — an install ID, a push-notification token, and — only if you allow ad measurement — your device's advertising identifier | The app | Sending notifications, analytics, and (with your permission) ad measurement |
| Device checks — on iPhone, an Apple DeviceCheck token; on Android, the Android ID and a Google Play Integrity check | The app, when you upload or export a BOQ | Preventing abuse of the free tier |
| Text you type into tender, city or price search | You, in the app | Showing matching tenders, cities and prices |
| Crash reports — device model, OS and app version, and technical error details. No screenshots and no BOQ content. | The app, when it crashes | Fixing bugs |
| How you found BOQ+ — on iPhone, Apple's ad attribution token; on Android, the Google Play install referrer | The app, on first launch | Knowing which campaign or link led to the install |
We do not collect your contacts, SMS, call logs, photos or precise location. We never sell your data. We never send your BOQs, rates, firm name or email to advertising companies.
A note on comparative statements
Comparative statements are documents published by government departments after a tender opens. They contain firm names and bid amounts of the bidders — information the department has already made public through the procurement process. Each time you upload one, the app asks whether to share it. Only if you choose “Yes, use this chart to improve rates for everyone” do we add those already-published figures to our market index, which every user (including you) sees as rate bands and competition data. If you choose “No, use it only for my BidIQ”, the figures are used only for your own BidIQ and track record and are not shared with other users. Other users can see the market data, never who uploaded it. Your BOQ files, the rates you enter, and your track record are never added to the market index or shown to other users.
03 — Ad measurement
We advertise BOQ+ on Meta (Facebook and Instagram) and may advertise on Apple and Google. To know which ads bring people to BOQ+, and only if you allow it, the app sends Meta and Google a few events — install/app open, BOQ uploaded, plans screen viewed, and purchases (with the amount) — together with your device's advertising identifier.
- iPhone: you choose in Apple's “Allow tracking” prompt, and can change it any time in iOS Settings → Privacy & Security → Tracking.
- Android: you choose in our “Allow ad measurement” prompt, which stays off until you answer, and can change it any time in BOQ+ Settings.
No advertising ID is sent to Meta unless you allow tracking. If you don't allow it, the iPhone app may still tell Meta that a BOQ was exported or an account was created, without your advertising ID or any BOQ details; from version 3.0.1 nothing is sent to Meta unless you allow tracking. Android sends nothing to Meta unless you allow ad measurement. If you say no, Google gets no advertising ID or ad measurement data either, and BOQ+ works exactly the same. Separately, Apple's ad attribution (iPhone) and the Google Play install referrer (Android) tell us which campaign led to an install. They don't follow you across other apps.
04 — Consent and legal basis
We process your personal data on the consent you give when you start using BOQ+ and accept this policy, for the purposes above and no others. Ad measurement has its own separate permission (Section 03). Where the DPDP Act allows processing for legitimate uses (Section 7), such as data you provide voluntarily for a specific purpose or compliance with law, we rely on that. You can withdraw consent any time by switching off ad measurement or deleting your account (Section 07); withdrawal doesn't affect processing already done, and some records (e.g. purchase records) may be kept where law requires.
05 — Who we share data with
These companies process data for us, only for the purposes listed:
- Meta Platforms (Facebook SDK) — app events (and your advertising identifier only with your permission) — ad measurement.
- OneSignal — your BOQ+ user ID, push token and plan type — sending tender alerts and deadline reminders.
- Sentry — crash reports — fixing crashes.
- Google — Firebase / Google Analytics (usage analytics; your advertising identifier and ad measurement only with your permission), Google Sign-In, Google Play billing and install referrer.
- Apple — Sign in with Apple, App Store purchases, ad attribution.
- Anthropic — when our parser can't read a BOQ layout on its own, the column headers and a few sample rows are sent to Anthropic's AI model to identify the columns. Anthropic does not use this data to train its models.
- Railway (servers and database) and Cloudflare (storage for PDF reports you generate).
- Authorities — where Indian law, a court order or a lawful government request requires it.
Some of these companies process data outside India, under contract, as the DPDP Act permits. We never share your BOQs, rates or track record with other users or with anyone for their own use.
06 — Storage, security and retention
Data is encrypted in transit, and encrypted at rest on our servers, with access controls and logging. We maintain reasonable security safeguards as Section 8 of the DPDP Act requires, and will notify the Data Protection Board of India and affected users of a personal data breach as the Act and its rules require.
Uploaded BOQ files and comparative statements are deleted right after they are read. Crash reports are kept for up to 90 days. We keep the rest while your account is active. After account deletion, personal data is erased or anonymised within 90 days, except records we must keep under law (e.g. tax and purchase records). Market-index data from government-published comparative statements you chose to share is kept in de-identified form and is not linked to your account.
07 — Your rights under the DPDP Act
- Access: ask for a summary of the personal data we hold about you and how it is processed.
- Correction and erasure: correct inaccurate data or ask us to delete it. You can edit your firm profile in-app and delete any uploaded BOQ yourself.
- Account deletion: delete your account from the app's settings or by emailing us; this removes your BOQs, rates, preferences, and profile as described in Section 06.
- Ad measurement: switch it off any time — see Section 03.
- Grievance redressal: write to akshay@boq.co.in; we aim to respond within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.
- Nomination: you may nominate a person to exercise these rights on your behalf in case of death or incapacity.
08 — Children
BOQ+ is a business tool for contractors and is not directed at children. We do not knowingly process the data of anyone under 18.
09 — Changes to this policy
If we materially change this policy, we will notify you in the app before the change takes effect and update the date above. Continued use after notice means acceptance; if you disagree, you can delete your account.
Questions? Write to akshay@boq.co.in.