Privacy Policy
Last updated · Draft · 18 July 2026
This is a working draft for product purposes. Before launch, have it reviewed and finalised by qualified Indian legal counsel.
How we collect, use and protect your data — including the government ID and biometric data we need to verify that every member is a real, identifiable person.
What we collect
Account details (name, email, phone, city); identity data (a government-issued photo ID); biometric data (a face photo and a short liveness video); booking and payment records; in-app messages (for moderation); device and log data; and — only during an active meet, with your consent — location data.
Government ID and biometric data
To verify identity we collect a government-issued ID document and biometric data: a face photo and a few seconds of recorded video used to confirm a live person is present and that their face matches the ID. This is special-category / sensitive personal data. We collect it for one purpose only — confirming you are a real, uniquely identifiable person so that everyone you meet has been verified the same way.
Your explicit consent
We ask for your specific, informed consent before you submit any ID or biometric data, and we record when you gave it and which version of this notice you agreed to. Consent is voluntary: you may decline, though identity verification is required to book or to list as a companion. You can withdraw consent at any time from Account & privacy, which triggers deletion of the stored ID and biometric artefacts.
How it is stored and protected
ID documents and liveness videos are stored in private encrypted object storage, encrypted in transit (TLS) and at rest. They are never public, never attached to your profile, and never shown to other members. They are not indexed, and no plain URL to them exists — reviewers open them through short-lived links that expire within minutes.
Who can access it
Only trained members of our safety and trust team, acting on a specific review, and only for as long as that review takes. Every access and every approve/reject decision is written to an append-only audit log with the reviewer's identity. We do not sell this data, do not use it for advertising or profiling, and do not use it to train models.
Automated decisions
Verification decisions are made by a human reviewer. We do not currently use automated decision-making or AI to approve or reject your identity. If that changes we will update this notice, and you will retain the right to a human review of any automated decision.
How long we keep it
ID documents and biometric artefacts are retained while your account is active and for 90 days after it closes, then permanently deleted. Rejected submissions are deleted 30 days after the decision. Where a law, tax rule, or an active safety or fraud investigation requires longer retention, we keep only what that obligation requires and delete the rest. Financial records are retained separately for the statutory period.
Location data
Live location is shared only during an active meet and only with your consent. It is anonymised or deleted after the retention window unless required for an active safety investigation or lawful request.
Sharing
We share data with payment, infrastructure, storage and communication providers under written contracts that restrict them to processing on our instructions. We disclose data to law enforcement only on a valid legal basis. We do not sell personal data.
Your rights
Subject to legal retention limits you may: access a copy of your data; correct inaccuracies; delete your account and data; withdraw consent; object to or restrict certain processing; export your data in a portable format; and complain to your data-protection authority. Requests are answered within the period your law requires (30 days under India's DPDP Act, one month under GDPR, 45 days under CCPA/CPRA).
Legal bases and jurisdictions
Where GDPR applies we rely on explicit consent (Art. 9(2)(a)) for biometric and ID data, contract performance for bookings, and legitimate interests for platform safety and fraud prevention. Where India's DPDP Act 2023 applies we process as a Data Fiduciary on your consent. Residents of California (CCPA/CPRA) and of US states with biometric-privacy statutes (including Illinois' BIPA) have the additional rights those laws grant, including notice, consent, and defined retention and destruction schedules.
Contact
For any privacy request or question, including withdrawing consent or erasure, contact our privacy team through the in-app support channel. If we ever suffer a breach affecting your identity or biometric data, we will notify you and the relevant regulator within the statutory deadline.