TruBond Website Privacy Notice
This notice explains exactly what the public website processes, what optional analytics measure, what is deliberately not collected, and how to exercise your choices.
1. Scope and controller
This notice applies to trubond.bharatsurakshagrid.com and the test environment trubond.gesfdev.com. TruBond is operated by Gods Eye Security Force Private Limited.
The public website does not collect case forms, complaints, target or subject details, identity documents, payments, account credentials or investigation evidence. Those functions are available only inside authenticated Bharat Suraksha Grid MyAccount under separate notices.
2. Essential technical and security data
When you request a page, hosting and security systems may process the source IP address, date and time, requested path, response status, browser user-agent, device category, referring origin, request ID, CSP violation data, and rate-limit or abuse indicators.
This data is used to deliver the website, maintain security, diagnose faults, defend against abuse and meet applicable security obligations. The application never copies raw IP addresses into marketing analytics. It uses a secret-keyed daily network hash for short-term deduplication and rate control.
For essential audience measurement, the server also keeps a daily rotating one-way visitor hash derived from network and browser signals, page code, device class, browser family, first/last access time and referring origin. It stores no raw IP address, typed content or identity, and the hash cannot follow a visitor across days. These daily records are retained for up to 90 days and support page-load, capacity and approximate unique-visitor reporting.
3. Optional first-party analytics
Optional analytics stay off until you select “Accept analytics.” When enabled, TruBond records only approved event codes: page views, section views, FAQ opens, sample-report opens, selected public service codes and the start of a MyAccount redirect.
It may also record an anonymous browser identifier, consent-receipt reference, referring origin only, device class, browser family, viewport bucket, language code and an approved campaign code supplied in the URL fragment. It does not record free text, DOM contents, full referrer paths, query strings, precise location or a cross-site advertising identifier.
Purpose: understand which information and services are useful, improve navigation and measure aggregate marketing performance. Optional raw events are retained for up to 90 days and then deleted or aggregated.
4. Consent records
When you accept, reject or withdraw optional analytics, we record an anonymous receipt ID, policy version and hash, decision, time, Global Privacy Control status, origin, daily network hash, user-agent hash and withdrawal relationship. This protects your choice and proves which notice version was shown. It is not used to identify an investigation client or create a cross-site profile.
5. Data deliberately not collected here
- Your name, date of birth, home address or government identity number.
- Information about a partner, spouse or investigation subject.
- Complaint facts, evidence, photographs, recordings or documents.
- Payment, card, UPI or banking details.
- Precise GPS location, contacts, camera, microphone or local files.
- Biometric information, advertising profiles or data-broker segments.
6. CTA redirect
When you select a service, TruBond may pass only an allowlisted public service code to MyAccount. Referrer policy is set to no-referrer. Identity, complaint and subject data are never transferred by the landing-page URL.
7. Cookies
Essential cookies support CSRF protection and remember your privacy choice. Optional analytics require prior permission. TruBond uses no advertising pixel, session replay, browser fingerprinting or social-media tracking pixel. The Cookie Notice lists exact cookie names and durations.
8. Recipients and sale
Data is available only to authorised personnel and approved hosting or security processors who need it for website delivery, security, fault resolution, aggregate analytics or legal compliance. The Company does not sell visitor personal data and does not permit analytics data to be used for advertising enrichment or vendor model training.
9. Storage and retention
| Category | Standard period | Reason |
|---|---|---|
| Web access/security logs | At least 180 days where CERT-In requirements apply | Security, investigation and legal compliance |
| Optional raw analytics | Up to 90 days | Aggregate usage and marketing measurement |
| Consent choice receipt | Up to 180 days | Honour and demonstrate the choice |
| CSP/security violations | Up to 180 days | Security diagnosis and abuse response |
| Public support enquiry | Normally 12 months after closure | Support, dispute and legal record |
Records may be kept longer when required for an active incident, legal hold, statutory duty or legal claim. Otherwise scheduled deletion applies.
10. Security
Controls include HTTPS, restrictive browser security headers, minimal cookies, same-origin APIs, CSRF protection, input allowlists, prepared database statements, rate limits, access restriction, retention jobs, logging and separation from customer and internal systems. No system can be guaranteed risk-free.
11. Your choices and rights
You can reject or withdraw optional analytics at any time through Cookie Settings. You may also ask whether the Company holds visitor or contact data reasonably linkable to you and request correction, erasure or grievance review where applicable. Identity verification will be proportionate. Data required for security, law, legal claims or an active legal hold may be retained with an explanation where permitted.
12. Children
The landing page is intended for adults. It does not knowingly profile children or collect their case data. Inadvertently received child-related data is restricted, assessed for safety or legal duties, and removed when retention is not required.
13. Lawful disclosure
Data is disclosed only when required or authorised by applicable law, valid court or statutory process, documented cyber-incident response or a documented immediate safety need. Requests are validated and recorded; information is not disclosed merely because a person claims to be an authority.
14. Contact
Privacy enquiries and data-choice requests: trubond@bharatsurakshagrid.com. Do not attach identity documents unless the privacy team provides a secure upload route.