Chal Buddy

यह दस्तावेज़ अभी सिर्फ़ अंग्रेज़ी में उपलब्ध है।

Privacy Policy

Last updated: 24 October 2026 · Policy version: 2026-10-draft-1

This policy explains how [Company legal name] ("Chal Buddy", "we") collects and uses personal data when you use chalbuddy.com, app.chalbuddy.com and the Chal Buddy mobile apps. We are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it.

Contact for privacy questions: [[email protected]], [Registered address].

1. Data we collect

What When Why
Name, mobile number, email (optional), city, role, interests, language You pre-register on chalbuddy.com To tell you about the launch and invite companions to apply
Name, email, mobile (optional), message You send an enquiry To reply to you
Mobile number, name, date of birth, city, language You sign up To create your account and confirm you are 18 or older
ID check result, last 4 digits of Aadhaar only, provider reference, selfie match result, gender from the ID You verify your identity Safety: to confirm who you are
PAN and bank account (Companions) You set up payouts To pay you and meet tax rules
Bookings, venues, times, prices, payments, refunds You book or receive bookings To provide the service and keep accounts
Chat messages You use chat To deliver messages and block contact-sharing and unsafe content
Location Only during an active booking, in the mobile app Safety: SOS, safety check-ins and live status for your trusted contacts
Trusted contacts (name, phone) You add them To alert them in an emergency
Reviews, reports, safety-check answers You give them Quality and safety
Device and app information (mobile app) You sign in on the app Security, check-in and push notifications
Consent records (purpose, policy version, time) You agree to something To prove what you agreed to

We never store your full Aadhaar number. ID images are kept in private storage that only authorised staff can access, and are deleted after verification unless they are needed for an open safety case.

2. Why we may use your data (legal basis)

We use your data with your consent (for example when you pre-register or sign up) and, where the DPDP Act allows, for legitimate uses such as meeting legal obligations, responding to emergencies and preventing fraud. You can withdraw consent at any time (see section 6); this does not affect what was done before you withdrew it.

3. Who we share data with

We share only what each partner needs:

  • Supabase (database and hosting, servers in Mumbai, India);
  • Razorpay (payments, refunds and payouts);
  • our identity verification provider (DigiLocker-based ID and selfie checks) [provider name];
  • our SMS and email providers (one-time codes, receipts, reminders) [provider names];
  • Google Maps Platform (venue maps);
  • Sentry (error reports, with phone numbers, tokens and messages removed);
  • the other person in your booking (your display name, photo, verification badges, and during a meetup the check-in status);
  • your trusted contacts (only during an active booking, and only the live status page);
  • government authorities, when the law requires it (for example tax authorities, or the police in an emergency or under a lawful request).

We do not sell your data. We send personal data to an AI service (for example to help moderate chat) only if you give separate, explicit consent; this is switched off by default.

4. Where your data is stored

Our main database is in India (Mumbai). Some partners may process data outside India where the DPDP Act permits it; we choose partners with strong security and contracts that protect your data.

5. How long we keep data

Data How long
Location during a booking 30 days, unless attached to a safety incident
ID images Deleted after verification, unless needed for a safety case
Pre-registrations Until 12 months after launch in your city, or until you ask us to delete them
Account data While your account is open; deleted within 30 days of you deleting your account
Payment, invoice and tax records As long as the law requires (usually 8 years)
Safety reports and incidents As long as needed to handle them and meet legal duties

6. Your rights

Under the DPDP Act you can:

  • ask for a summary of the personal data we hold about you and how we use it;
  • ask us to correct, complete or update it;
  • ask us to erase it (we will, except records the law requires us to keep);
  • withdraw your consent;
  • nominate another person to exercise your rights if you die or become unable to;
  • complain to us, and then to the Data Protection Board of India.

You can delete your account on the website or in the app. For anything else, write to [[email protected]] or our Grievance Officer (see Grievance Redressal). We reply within the time the law requires.

7. Children

Chal Buddy is only for people aged 18 and over. We do not knowingly collect data from children; if we learn that an account belongs to someone under 18 we close it and delete the data.

8. Security

We protect data with encryption in transit and at rest, strict access rules (every database table is protected by row-level security), two-factor login for staff, and an audit log of staff actions. If a personal data breach happens, we will inform you and the Data Protection Board as the law requires.

9. Changes

We will publish any change here with a new version number and, for important changes, tell you before they apply. Where the law requires, we will ask for your consent again.