adda365
Adda 365 — Privacy Policy
DRAFT v0.2 · 30 August 2026 · For counsel review — not yet in force. v0.2 incorporates the international annex: multi-market scope, per-regime legal bases and rights, transfers, and representatives. Drafted as the itemized, standalone, plain-language notice the DPDP Rules, 2025 require. Every claim below is mapped to what the system actually does; engineering references appear in italics and would be removed from the published version or kept — counsel's call (we recommend keeping them: verifiable claims are the brand).
Data Fiduciary / Controller: [Company name], [address] ("we"). Grievance Officer / DPO: [Name], [email] (appoint before launch; a DPO becomes mandatory on SDF designation in India and is prudent for EU/UK launches). EU representative (Art. 27): [appoint at EU launch]. UK representative: [appoint at UK launch].
1. The short version
We collect the minimum needed to run a verified, safe dating service for adults in India. We never see your Aadhaar number or date of birth. Your messages are encrypted at rest and are never sold, mined for advertising, or shared with advertisers — there are no third-party advertising or tracking SDKs in the app. Wellness activity is walled off from matching. You can see, correct, export the substance of, and erase your data.
2. What we collect, why, and for how long
Consent is requested per purpose at the point it first arises; each item below is a separate line in the consent record (DPDP §6, Rules 2025 notice requirements).
| # | Data | Purpose | Retention |
|---|---|---|---|
| 1 | Phone number — stored only as a keyed one-way hash + last 4 digits (HMAC; the number itself is never stored) | Account identity, login OTPs | Life of account |
| 2 | Age check result — a single yes/no "over 18" from DigiLocker (date of birth and document contents are discarded in the handler and never persisted or logged) | Legal 18+ gate | Life of account |
| 3 | Liveness selfie | Anti-impersonation check | Until check passes + [30] days, then deleted |
| 4 | Student proof (college email or ID image) | Optional campus verification | ID images: deleted at the moment of review decision — only the verdict remains |
| 5 | Profile (name, department, bio, interests, prompts, photos) and the optional questionnaire (lifestyle, tastes, what you're looking for; validated against a fixed catalog — no free-form keys). Faith and politics are optional, sensitive, off by default, shown only if you fill them, clearable any time, and processed under explicit matching consent | Your public profile and better match reasons | Life of account; each answer individually clearable |
| 6 | Quiz answers, importance weights, this-or-that votes | Matching (see §4) | Life of account |
| 7 | Messages and voice notes | Delivering your conversations | Until you delete them/your account; encrypted at rest (AES-256-GCM), with cryptographic integrity records (§6) |
| 8 | Wellness activity — questions asked, circles joined | Wellness features only | Pseudonymised under a separate identity; structurally severed from matching (a one-way database bridge the application role cannot reverse) |
| 9 | Device identifiers, IP logs | Security, fraud, CERT-In obligations | IP logs [180 days / 1 year — see counsel memo], then automatically purged |
| 10 | Payment events for tickets | Order fulfilment, refunds | Statutory accounting periods. Card/UPI details never touch our systems — the RBI-regulated aggregator holds them |
| 11 | Push tokens | Notifications you enable | Until you log out, disable, or the token dies |
| 12 | Intake/coach conversation text | AI-assisted onboarding and coaching | Processed by our AI processor (§7); coach context is drawn from your recent messages at request time |
| 13 | Consent records | Proof of your consents (DPDP Rules) | 7 years |
We collect no location beyond your chosen campus/city, no contacts upload, no background tracking.
3. Legal basis — by your market
- India (DPDP Act): consent (§6) for everything in §2, except statutory "legitimate uses" (§7): compliance with law, legal process, security incidents.
- EU/EEA and UK (GDPR / UK GDPR), once launched: contract performance (Art. 6(1)(b)) for delivering the service you signed up for; consent (6(1)(a)) for optional features; legitimate interests (6(1)(f)) for security, fraud prevention, and abuse defence — balanced and documented. Your match preferences (who you're seeking) and wellness activity are special-category data (Art. 9): we process them only with your explicit, purpose-specific consent, recorded per purpose in the consent ledger and withdrawable at any time.
- US states with privacy laws, once launched: we honour access, correction, deletion, and portability; we do not sell or share personal data for advertising in any market, so there is nothing to opt out of.
Withdrawing consent is as easy as giving it (Settings → Privacy) and stops the related processing prospectively; some features stop working when their data stops flowing.
4. Matching — what the algorithm sees
Matching uses your quiz answers, declared preferences, campus pool, and in-app interactions (likes, replies, game completions). It never uses wellness data (§2.8), message content, or verification documents. We show you reasons for a suggestion, never a score, and we cap how often any profile is shown to keep exposure fair. No fully automated decision produces legal or similarly significant effects; enforcement always involves a human.
5. Who receives data
We sell nothing and run no advertising. Processors, each under contract, receiving only what their function needs:
- Hosting: [Hetzner Online GmbH, Germany (staging)] → production planned on [AWS Asia-Pacific (Mumbai)]. Cross-border storage is permitted under DPDP §16 (no restricted-country notification applies); see counsel memo.
- AI processing: Anthropic (USA) — intake and coach text only, under their commercial no-training terms.
- Payments: [Razorpay] (India, RBI-regulated) — they hold instrument data, we hold order state.
- SMS/WhatsApp OTP: [vendor], via TRAI DLT-registered routes.
- Verification: DigiLocker (MeitY) for the age answer; [face-check vendor] for liveness.
- Timestamping: an RFC 3161 authority receives a 32-byte daily digest containing no personal data (§6).
Government and courts: we disclose only against valid legal process, under our published evidence procedure, and we log every production.
6. Security — what we actually do
TLS 1.3 everywhere; message bodies AES-256-GCM encrypted at rest with keys held only on production systems; phone numbers hashed; per-conversation tamper-evident hash chains anchored daily to an independent timestamping authority (so history can be proven unaltered — and any tampering, including by us, is mathematically detectable); append-only audit logs; staff access role-restricted with second-factor authentication and every action audited; no identity documents at rest. Breach response: we will notify affected users and the Data Protection Board within 72 hours of confirming a notifiable breach (DPDP Rules, 2025).
7. Your rights (DPDP §§11–14)
- Access: a summary of your personal data and processing (in-app export).
- Correction & completion: edit your profile and data in-app or via the Grievance Officer.
- Erasure: delete your account in Settings; erasure completes within [30] days (statutory outer limit 90), except records we must keep by law — which we list when you ask. Where a message must be removed but its conversation preserved for another user or a legal hold, we destroy the content while keeping only its integrity fingerprint (which does not reveal the content). We notify you at least 48 hours before deleting an account for prolonged inactivity.
- Nomination: nominate someone to exercise your rights if you die or are incapacitated.
- Grievance: Grievance Officer first (ack 24 h, resolution 15 days); then the Data Protection Board of India. EU/UK users (once launched) may additionally object to or restrict processing (Arts. 18/21) and complain to their supervisory authority or the UK ICO; US state-law users may appeal a refused request per their state's process.
8. Children
None. The Service is 18+, verified, before any social feature works.
9. Scope, markets, and international transfers
We offer the Service in the markets listed in the Terms' Schedule A. Today that is India (DPDP Act governs). At each international launch the corresponding regime applies in full to that market's users: GDPR (EU/EEA), UK GDPR + Data Protection Act 2018 (UK), and applicable state privacy laws (US).
Transfers. Your data is processed in [India / the hosting region in Schedule A] and by the processors in §5. For EU/UK users, transfers out of the EEA/UK rest on Standard Contractual Clauses (with the UK IDTA/addendum) plus transfer impact assessments; India currently has no adequacy decision. A data-processing agreement is in place with every processor, and our hosting providers are additionally bound by the data-protection law of their own jurisdictions.
10. Changes
Material changes are notified in-app before they take effect. Every version is archived with its date, and your consent record shows which version you accepted.