Privacy Policy.

What we collect, why we collect it, how long we keep it, and the rights you have over your data — written for humans, structured for compliance.

01Who this policy applies to

This Privacy Policy ("Policy") applies to all personal data that Hey Gaargi ("Hey Gaargi", "we") processes about you when you use our mobile application, website, or any related service (collectively, the "Service"). For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary and you are the Data Principal.

This Policy supplements, and forms part of, our Terms of Service.

02Personal data we collect

We collect personal data in three ways: data you give us, data generated when you use the Service, and data we receive from third parties.

2.1 Data you give us

2.2 Data we generate when you use the Service

• Device & technical — IP address, device model, OS version, app version, crash logs, language and timezone.
• Usage — features visited, buttons tapped, time spent, in-app errors. We use a self-hosted analytics stack (PostHog on AWS Mumbai) — no third-party analytics SDKs in production builds.
• Computed astrological data — birth charts, daśā tables, transit calendars derived from your inputs.
• Diagnostics — performance metrics, anonymised model latency, error reports.

2.3 Data we receive from third parties

• Payment processors (Cashfree) confirm payment success/failure and provide tokenised payment methods for future purchases.
• Sign-in providers (Google, Apple) provide your verified email and name only if you choose to sign in with them.
• Place lookup (OpenStreetMap Nominatim, self-hosted) returns coordinates for the city you enter.

03Why we collect it (purposes)

04Legal basis under the DPDP Act

Under Section 4 of the DPDP Act, we process your personal data on one of two bases:

• Consent (Section 6) — for processing that requires you to opt in (e.g., marketing emails, optional profile fields, voice features). Consent is requested in clear, plain language and can be withdrawn at any time.
• Certain legitimate uses (Section 7) — for processing strictly necessary to provide the Service you requested, fulfil legal obligations, respond to medical emergencies, or comply with a court order or judicial decree.

05How we share data

We share personal data only with Data Processors (vendors processing on our behalf, under contract) and only as needed to operate the Service. Our active processor list:

We do not sell your personal data. We do not share it with advertisers or data brokers. We may disclose it to law-enforcement or regulatory authorities only when required by valid legal process under Indian law.

06International transfers

Your data is primarily stored in India (AWS Mumbai). Where a processor operates outside India (e.g., OpenAI, Anthropic), we transfer the minimum data necessary under standard contractual clauses and the conditions in Section 16 of the DPDP Act. As of the date of this Policy, the Central Government has not restricted transfers to any country; we will update this section if that changes.

07How long we keep it

08Security

We use industry-standard safeguards including TLS 1.3 in transit, AES-256 encryption at rest, hashed and salted passwords (Argon2id), role-based access control, mandatory two-factor authentication for all staff, quarterly third-party penetration testing, and a documented incident-response plan. Despite these measures, no internet service can be 100% secure — you accept this residual risk by using the Service.

09Your rights as a Data Principal

Under Sections 11–14 of the DPDP Act, you have the right to:

• Access — request a summary of the personal data we hold about you and how it is processed;
• Correction — request that we correct inaccurate or update incomplete data;
• Erasure — request deletion of your personal data, subject to legal retention obligations;
• Withdraw consent — withdraw consent for any consent-based processing, with effect on future processing;
• Nominate — nominate another individual to exercise your rights in the event of your death or incapacity;
• Grievance redressal — file a complaint with our Grievance Officer (see Grievance Redressal) or, if unresolved, with the Data Protection Board of India.

Most rights can be exercised directly from Settings → Privacy. You can also email privacy@heygaargi.com. We respond within 30 days as required by the DPDP Act.

10Children

Hey Gaargi is intended for users aged 18 and above. For users between 13 and 18, we require verifiable parental consent before processing personal data, in accordance with Section 9 of the DPDP Act. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. Users under 13 are not permitted on the Service.

11Cookies and trackers

Our website uses a minimal set of essential cookies and one self-hosted analytics cookie. We do not run third-party advertising trackers. Full details are at Cookie Policy.

12AI training and your data

We use third-party large language models to power Gaargi's responses. Conversations sent to these providers are processed under zero-retention agreements: providers do not store our prompts, do not train their models on them, and do not use them for any purpose other than returning a single response to us. We do not use the contents of your private conversations to train our own models without explicit opt-in. If you opt in to "Help improve Gaargi" under Settings → Privacy, anonymised, redacted excerpts may be used for evaluation; you can revoke this at any time.

13Data breach notifications

In the event of a personal data breach affecting your information, we will notify the Data Protection Board of India and affected users without undue delay, in accordance with Section 8(6) of the DPDP Act. Notifications will include the nature of the breach, the data affected, mitigation steps, and contact details for queries.

14Changes to this policy

We may update this Policy when our practice or the law changes. Material changes will be notified by email and via an in-app notice at least 30 days in advance. The "Last revised" date at the top of this document is the source of truth.

15Contact

For any privacy-related question, write to our Data Protection Officer at dpo@heygaargi.com. For formal complaints, see Grievance Redressal.