Last updated: Launch
Data Fiduciary: Indoria Technologies Pvt. Ltd. (“Humsafar”, “we”, “us”)
This Policy explains what personal data Humsafar collects, why, and the rights you have over it under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the DPDP Rules, 2025. Under the Act, Humsafar is a “Data Fiduciary” and you are the “Data Principal.”
| Data | Why we collect it |
|---|---|
| Phone number | Account identity, OTP login |
| Verified name, DOB, gender | Identity verification, age gating, matching |
| One-way hash of name + DOB | Ban-evasion detection only (Section 3) |
| Profile (name, city, intent, bio, prompts, interests, photos) | Shown to other users to decide whether to connect |
| Messages | Delivering conversations; automated scam/abuse screening before delivery |
| Likes, matches, blocks, reports | Discovery/matching; your safety controls; moderation |
| Meetup Safety Check-in details | Your opt-in safety feature; only used if a check-in is missed |
| Subscription/payment records (plan, order status, amount) | Granting paid features; accounting. We never receive your card/UPI/bank credentials — those go directly to our payment gateway. |
| Device/usage data (IP, timestamps, rate-limit counters) | Abuse prevention, security |
We never store your Aadhaar number, and we never collect caste, religion, or sexual orientation as structured profile fields.
Before you provide personal data to create an account, we give you notice, in plain language, of what we collect and why — the short notice at signup satisfies this independently of this longer Policy. Submitting your phone number and completing onboarding is how you give consent; you can withdraw it any time by deleting your account (Section 6), as easily as you gave it. Narrower consent (e.g., sharing your check-in's trusted-contact details only if missed) is collected at the point you use that feature.
When your identity is verified, we compute a SHA-256 hash of your normalized name and date of birth. If an account is later banned, that hash is listed; any future verification is checked against it. The hash is one-way — we cannot reconstruct your name or date of birth from it, and it is used for no other purpose.
We keep your data while your account is active, plus a limited period after for legal, security (re-ban detection), and accounting reasons — notably the ban-evasion hash and billing records required for tax/dispute purposes. Everything else — profile, photos, messages, check-ins — is deleted on request.
To exercise any of these, email [privacy email] or use the in-app request where available.
Humsafar is not for anyone under 18. We don't knowingly collect data from minors, and identity verification exists partly to catch misrepresented age. Report a suspected minor account to [privacy email].
[Name], Indoria Technologies Pvt. Ltd.
Email: [privacy/grievance officer email] · Address: [registered office address]
Encrypted connections, hashed/salted credentials where applicable, rate limiting, and access controls on admin tools, with every admin moderation action logged for accountability. If we experience a breach affecting your personal data, we will notify you and the Data Protection Board as the DPDP Rules require.
Our infrastructure may process data outside India for hosting purposes, consistent with the DPDP Act's rules on cross-border transfer at the time of transfer.
We'll give you notice in-app before a material change takes effect.
Grounded in the DPDP Act, 2023, the DPDP Rules, 2025 (notified 14 November 2025), and the IT Rules, 2021. Review by a lawyer qualified in Indian data-protection law is recommended before public launch, including an assessment of Significant Data Fiduciary obligations as the user base grows.