Privacy, by design.

xBoom Drones & Robotics ("xBoom", "we", "us") respects your privacy. This policy explains what personal data we collect when you visit xboom.in, place an order, sign up for support, request a quote or interact with our services — and what we do with that data.

It applies to xboom.in and any sub-domain or service operated by xBoom from our Bengaluru and Dubai offices.

• Identity data — name, email, phone number, billing & shipping address.
• Government ID proof (Aadhaar / PAN / Passport / Voter ID) for drone purchases, where DGCA compliance requires identity verification.
• Order data — products purchased, invoice details, GST number for B2B orders.
• Payment data — handled by Razorpay / Bajaj Finserv / our payment gateway. We never store full card numbers on xboom.in.
• Usage data — pages viewed, search queries, time on page, referring URL, session events.
• Device data — browser type, OS, device type, IP address (truncated), screen size.
• Communications — emails, support tickets, chat transcripts, call recordings (where you have given consent).

• Process orders and fulfil drone, ROV, robot or service deliveries across India.
• Verify identity and meet DGCA, GST and regulatory obligations for drone sales.
• Provide warranty, repair, AMC and customer-support services.
• Send order confirmations, dispatch updates and service appointment reminders.
• Reply to enquiries, quotes, demo requests and pre-sales questions.
• Improve the website, product mix and content based on aggregate usage patterns.
• Send marketing communications only when you have opted in — you can unsubscribe anytime.

• Strictly-necessary cookies — keep you logged in, remember cart contents, secure checkout. These cannot be disabled.
• Analytics cookies — Google Analytics 4 with IP anonymisation. Loaded only after you accept the cookie banner.
• Marketing cookies — Meta Pixel, Google Ads remarketing. Loaded only with explicit consent.
• Preference cookies — language, currency, region selectors.
• You can change your preferences anytime via your browser settings or the cookie-consent control on the site.

• Payment processors — Razorpay, Bajaj Finserv, banking partners — for payments and EMI.
• Logistics partners — Blue Dart, DTDC, Shiprocket, FedEx — for shipping.
• Hosting and infrastructure — AWS / Hostinger / Cloudflare for site hosting and DDoS protection.
• OEM partners — DJI, Unitree, QYSEA, Flyability, Autel — for warranty registration and serial-number tracking.
• Government & regulators — DGCA, GST, Customs, when legally required for compliance, audits or law-enforcement requests.
• We never sell personal data to advertisers, data brokers or unrelated third parties.

We use industry-standard safeguards — TLS 1.2+ for all transmissions, AES-256 encryption for sensitive data at rest, role-based access for staff, two-factor authentication for admin accounts, regular backups and intrusion monitoring.

However, no online system is 100% secure. If you believe your account has been compromised, contact us immediately at [email protected] so we can investigate and act.

• Right to access — request a copy of personal data we hold about you.
• Right to correction — fix any inaccurate or incomplete data.
• Right to erasure — request deletion of personal data we no longer need to retain.
• Right to grievance redressal — escalate complaints to our Data Protection / Grievance Officer.
• Right to nominate — appoint someone to exercise rights on your behalf in case of incapacity.
• Right to withdraw consent — stop marketing communications or analytics tracking anytime.
• To exercise any of these rights, email [email protected]. We respond within 30 days as required by law.

• Order & invoice data — retained for 8 years per Indian GST and tax law.
• Customer-account data — retained while your account is active, deleted on request.
• Marketing data — retained until you unsubscribe.
• Server logs — retained for 90 days, then anonymised or purged.
• We do not knowingly collect data from children under 18 without verifiable parental consent. If you believe a minor has provided data, contact us and we will delete it.