Privacy & Data

1. Who we are

KaunHoTum is operated by Ankit Lokare, 904, EV Homes, Plot no 120, Sector 50E, Seawoods, Navi Mumbai, 400706, India ("we", "us"). We are the Data Fiduciary for the personal data described here.

Grievance Officer: Ankit Lokare, +91 79776 14306, grievances@sagewabbit.com, 904, EV Homes, Plot no 120, Sector 50E, Seawoods, Navi Mumbai, 400706. (IT Rules + DPDP §13 — a real, reachable contact.)

2. What personal data we collect

(Itemised — mirror the consent screen.) [AMENDED 2026-07-21 — Pehli Jhalak + voice notes + remote analytics ship; DRAFT pending tech-legal review.] Identity (name, DOB, gender); profile photos; quiz answers and personality/chemistry results; chat content (text messages and voice notes you record); Pehli Jhalak reveal data (the short text or voice note you record about a match before a mutual photo reveal, and the reveal status of that match); approximate location (if enabled); device, log and usage data (including in-app analytics events sent to our servers only after consent); payment status (via our payment processor — we do not store card details).

3. Why we process it (purposes)

(Specified purpose per DPDP §5 — no open-ended "business purposes".) To create and show your profile; confirm you are 18+; match you and generate chemistry; enable messaging; keep the platform safe (moderation, fraud/CSAM detection); process subscriptions; secure and improve the service; comply with law.

4. Our legal basis

We process on the basis of your consent (DPDP §6). A limited set of activities may rely on the narrow "legitimate uses" in DPDP §7 (e.g. complying with a legal order, responding to a safety/medical emergency). We do not rely on "contractual necessity" — it is not a lawful basis under the Act.

5. Who we share it with (processors)

We share the minimum necessary with vetted Data Processors under contract: cloud hosting and database — Supabase (your account, profile, quiz answers, chats and uploaded media are stored there); content moderation and CSAM detection — Sightengine (automated classification of uploaded images for nudity/violence, and text moderation) and Project Arachnid Shield, operated by the Canadian Centre for Child Protection (hash-matching every uploaded image against a database of known child sexual abuse material before it is stored or shown to anyone) — both receive the uploaded image data in order to run this safety check. Product analytics run on our own Supabase infrastructure; there is no third-party analytics processor. Optional identity verification — Didit (selfie/liveness check, only if you choose to verify; it receives the images you submit for that check and returns a result). Payments are handled by the app store you bought your plan from — Google Play or the Apple App Store, acting under their own terms — so we never receive your card or UPI details; we receive only a purchase token and your subscription status. We do not sell your personal data. We may disclose to law enforcement on a lawful request, and are legally required to report CSAM to NCMEC and Indian authorities.

6. How long we keep it

We keep personal data only as long as needed for the purpose, and erase it when you withdraw consent or delete your account, except where law requires retention. Security logs are retained for at least one year (DPDP Rule 8). Accounts with no sign-in for 24 months are erased.

7. Your rights

You can, at any time: access a summary of your data and who it was shared with; correct/complete/update it; erase it (delete your account); raise a grievance; nominate someone to exercise your rights on death or incapacity; and withdraw consent. Exercise these in the app under Main → "Tumhara data, tumhara haq", or via the Grievance Officer. To nominate someone, email the nominee's name and contact details to grievances@sagewabbit.com — we record the nomination manually, acknowledge it, and honour it with the same discipline and timelines as any other data request. We respond within the timelines set by the DPDP Rules, and resolve grievances within 90 days.

8. Children

KaunHoTum is strictly for users 18 and over. We do not knowingly process the data of anyone under 18. If we learn a user is a minor, we remove the account and delete the data. (DPDP §9 + POCSO — this is why the 18+ gate is enforced.)

9. How we protect your data

We use reasonable security safeguards — encryption in transit and at rest, access controls, and monitoring (DPDP §8(5)).

10. Cross-border transfer

If any processing or storage occurs outside India, we do so only to jurisdictions permitted under the DPDP Act and applicable notifications.

11. Data breaches

If a personal-data breach occurs, we will notify affected users without delay, and file the detailed report the DPDP Rules require with the Data Protection Board of India within 72 hours. The Board has not yet been constituted, so no filing channel exists today; that does not reduce the duty, and your notice does not wait for it.

12. Grievances & complaints

Contact our Grievance Officer first (grievances@sagewabbit.com) — under the DPDP Act you must give us the chance to resolve it before escalating. If it stays unresolved, the Act lets you complain to the Data Protection Board of India; the Board exists in law but has not been constituted, and there is no filing portal yet, so we will not point you at one that does not exist. We will publish its route here as soon as it opens. For content and intermediary grievances the live escalation today is the Grievance Appellate Committee (gac.gov.in) within 30 days of our decision.

13. Changes to this notice

We will notify you of material changes and, where required, seek fresh consent.

14. Contact

Ankit Lokare, 904, EV Homes, Plot no 120, Sector 50E, Seawoods, Navi Mumbai, 400706, grievances@sagewabbit.com.