Privacy aur Data

1. Who we are

KaunHoTum is operated by SageWabbit LLP, [registered address], India ("we", "us"). We are the Data Fiduciary for the personal data described here.

Grievance Officer (interim): Ankit Lokare, +91 86523 71818, [grievance@domain], [postal address]. (IT Rules + DPDP §13 — must be a real, reachable contact.)

2. What personal data we collect

(Itemised — mirror the consent screen.) [AMENDED 2026-07-21 — Pehli Jhalak + voice notes + remote analytics ship; DRAFT pending tech-legal review.] Identity (name, DOB, gender); profile photos; quiz answers and personality/chemistry results; chat content (text messages and voice notes you record); Pehli Jhalak reveal data (the short text or voice note you record about a match before a mutual photo reveal, and the reveal status of that match); approximate location (if enabled); device, log and usage data (including in-app analytics events sent to our servers only after consent); payment status (via our payment processor — we do not store card details).

3. Why we process it (purposes)

(Specified purpose per DPDP §5 — no open-ended "business purposes".) To create and show your profile; confirm you are 18+; match you and generate chemistry; enable messaging; keep the platform safe (moderation, fraud/CSAM detection); process subscriptions; secure and improve the service; comply with law.

4. Our legal basis

We process on the basis of your consent (DPDP §6). A limited set of activities may rely on the narrow "legitimate uses" in DPDP §7 (e.g. complying with a legal order, responding to a safety/medical emergency). We do not rely on "contractual necessity" — it is not a lawful basis under the Act.

5. Who we share it with (processors)

We share the minimum necessary with vetted Data Processors under contract: identity-verification provider [name]; content-moderation / CSAM-detection provider(s) [names]; cloud hosting [name]; analytics [name]; payment gateway [Razorpay]. We do not sell your personal data. We may disclose to law enforcement on a lawful request, and are legally required to report CSAM to NCMEC and Indian authorities.

6. How long we keep it

We keep personal data only as long as needed for the purpose, and erase it when you withdraw consent or delete your account, except where law requires retention. Security logs are retained for at least one year (DPDP Rule 8). Inactive accounts are erased after [period].

7. Your rights

You can, at any time: access a summary of your data and who it was shared with; correct/complete/update it; erase it (delete your account); raise a grievance; nominate someone to exercise your rights on death/incapacity; and withdraw consent. Exercise these in [Settings › Your Data] or via the Grievance Officer. We respond within the timelines set by the DPDP Rules, and resolve grievances within 90 days.

8. Children

KaunHoTum is strictly for users 18 and over. We do not knowingly process the data of anyone under 18. If we learn a user is a minor, we remove the account and delete the data. (DPDP §9 + POCSO — this is why the 18+ gate is enforced.)

9. How we protect your data

We use reasonable security safeguards — encryption in transit and at rest, access controls, and monitoring (DPDP §8(5)).

10. Cross-border transfer

If any processing or storage occurs outside India, we do so only to jurisdictions permitted under the DPDP Act and applicable notifications.

11. Data breaches

If a personal-data breach occurs, we will notify the Data Protection Board of India and affected users as required, with a detailed report to the Board within 72 hours (DPDP Rules).

12. Grievances & complaints

Contact our Grievance Officer first ([grievance@domain]). If unresolved, you may complain to the Data Protection Board of India ([how/where]).

13. Changes to this notice

We will notify you of material changes and, where required, seek fresh consent.

14. Contact

SageWabbit LLP, [address], [email].