Privacy policy

At a glance

• We collect what we need to place a verified helper with your household: your name, phone, email, the city and locality you choose, your requirements, and payment references. We never see your card number, and we do not track your device's location.
• We share your name, contact number and requirements with a Helper only when you decide to interview or engage them. We share payment data with PayU, and we use Supabase, Vercel, Resend, Google, Chatwoot and OpenRouter to run the service. We do not sell personal data and we run no advertising.
• Our support chat is answered first by an automated assistant and then, when you need one, by a person. We keep a record of every support conversation, on chat, WhatsApp, phone and email, and we analyse those records in aggregate to improve the service. We do not build advertising profiles from them.
• Helpers are people too. We collect their identity, reference, assessment and police-verification data, share a dossier with you before placement, and expect you to protect it.
• You can see, correct and delete your data. Delete My Account in the app erases your profile, bookings, plans and support conversations at once, except for records the law requires us to keep — chiefly financial and tax records, which are moved to a restricted archive.
• Complaints go to our Grievance Officer first, then to the Data Protection Board of India. If you are in the EU, UK or California, and those laws reach the processing, the extra rights in Section 14 apply to you.

1Who we are and what this policy covers

1.1The Data Fiduciary. MyBuddyMaid Private Limited, a private limited company registered in India (CIN U96908DC2026PTC474931), having its registered office at C/o Kanchan Bhatiya, 2-A/3 SF, Front Side, Asif Ali Road, Darya Ganj, New Delhi, Central Delhi 110002, Delhi, India, operating as "MyBuddyMaid" ("we", "us", "our"), is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") for the personal data described in this policy. The DPDP Act is the law that governs our processing.

Where, and only to the extent that, the General Data Protection Regulation (EU) 2016/679 or the UK GDPR applies to a particular processing activity under its own territorial-scope rules, we act as the data controller for that activity; and where, and only to the extent that, we meet the thresholds to be a "business" under the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA"), we act as such. Section 14 sets out the additional rights that apply in those cases. Nothing in this paragraph extends a foreign law to processing it does not reach.

1.2What this policy covers. This policy applies to personal data we process through the website at mybuddymaid.in, the booking application at mybuddymaid.in/app, our WhatsApp, telephone and email channels, and our onboarding and verification of Helpers. It applies to:

• (a) Clients who create an account, submit a request or purchase a plan, and adult members of their household who interact with us;
• (b) visitors to the website;
• (c) Helpers whom we verify and introduce, and the previous households who act as their references; and
• (d) household members about whom a Client gives us information, such as children or elderly relatives who will receive care.

1.3Two fiduciaries for Helper data. When we share a Helper's verification dossier with a Client, the Client becomes separately responsible under the DPDP Act for the Helper's personal data in the Client's hands, and must handle it as described in Section 5.3 of our Terms of Service. This policy describes our own processing only.

1.4Definitions. "Personal data" means any data about an individual who is identifiable by or in relation to that data. "Processing" means any operation performed on personal data, including collection, storage, use, sharing and erasure. "Data Principal" means the individual the personal data is about, and includes, for a child, the parent or lawful guardian. Capitalised terms not defined here have the meaning given in the Terms of Service.

2The personal data we collect

2.1We collect the following categories of personal data. The table states the category, the data within it, and where we obtain it.

2.2Support conversations, and the notice we show before you type. Our support chat is answered first by an automated assistant. Before your first message, the chat window shows this notice, and you can read this policy from it:

If you use the chat without signing in, the reference we store identifies the conversation, not you, and we do not combine it with our website analytics. If you sign in or create an account in the same browsing session, we link that conversation to your account so that our team can see what you have already told us; from that point the conversation is part of your account data and is deleted with it.

2.3Data we do not collect. We do not collect government identity numbers from Clients, precise geolocation, biometric data, or data from your contacts, camera, microphone or files. The application requests no device permissions beyond those needed to display it.

2.4Data you give us about others. If you give us personal data about another person, such as a family member who will be cared for or another adult in the household, you confirm that you are entitled to do so and that they, or their guardian, know their data will be used as this policy describes.

3Why we process your data and the legal basis

3.1Under the DPDP Act there are two ways we may lawfully process your personal data, and they are alternatives rather than a pair:

• Consent under Sections 6 and 6(1), given by a clear affirmative action for a purpose we have told you about in the notice described in Section 3.2; or
• a legitimate use listed in Section 7 of the Act. The one that matters most here is Section 7(a) — personal data you have voluntarily given us for a specified purpose, where you have not told us you object to its use for that purpose. Section 7(d) covers an obligation under Indian law to disclose information to the State, and Section 7(e) covers compliance with a judgment, decree or order.

Where we rely on Section 7(a) we do not also claim consent for the same processing, and vice versa: each row below states the one basis we rely on. Separately, Section 8(7) of the Act permits us to keep personal data after its purpose ends where another law requires the retention — that is what Section 6 of this policy describes, and it is a retention rule, not a basis for new processing.

For individuals in the EU, the UK or California, Section 14 of this policy (not of the Act) sets out the corresponding lawful bases and additional rights. The table below states each purpose, the data used and the basis.

3.2The notice we give you (Section 5). Section 5 of the DPDP Act requires that a request for consent be accompanied or preceded by a notice telling you what personal data we will process and for what purpose, how you may exercise your rights under Sections 6(4) and 13, and how you may complain to the Data Protection Board of India. We give that notice in three places, and each links to this policy:

• (a) at account creation, above the button that creates the account;
• (b) in the chat window, before your first message, in the words set out in Section 2.2; and
• (c) at any other point where we ask for consent for a new purpose.

In every case the notice states the data and the purpose in plain language; tells you that you may withdraw consent at any time, as easily as you gave it, by the routes in Section 8.2; tells you that you may raise a grievance with our Grievance Officer under Section 8.5; and tells you that you may complain to the Data Protection Board of India if we do not resolve it. This policy, in English, is available from every notice, and we will provide it on request in Hindi or any other language listed in the Eighth Schedule to the Constitution, as Section 5(3) of the Act provides.

3.3Consent. Where we rely on consent, it is requested in clear language, for a stated purpose, by an affirmative action such as submitting a form, ticking a box or tapping a button. You may withdraw consent at any time as described in Section 8, and withdrawal is as easy as giving it. Withdrawal does not affect processing already carried out, and where the withdrawn consent was necessary to provide a service, we may no longer be able to provide it.

3.4Sensitive information in your notes. If your requirements include information about a health condition, disability, religion, caste, diet or a child, we process it only to match you with a suitable Helper and to brief that Helper, and only because you chose to provide it. Please keep such details to what the Helper genuinely needs.

3.5No automated decisions. We do not make decisions about you by solely automated means that have a legal or similarly significant effect. Matching is carried out by our team against the requirements you stated. The automated assistant in our support chat answers questions and, where you ask for one, records your details for our team; it does not decide whether you are accepted as a customer, what you are charged, or whether a refund or replacement is granted. Those are decided by a person.

3.6How the automated assistant works. The assistant does not invent answers. It looks up the answer in our own published information — our list of served areas, our service descriptions, our plans and prices, and our policies — and a language model then puts that answer into a sentence. Prices and policy terms are inserted exactly as published and are never generated by the model. When the assistant cannot find an answer it says so and offers to pass you to a person.

What we send to the language-model provider is your message and the information we looked up. We do not send your name, contact number, address, booking history or payment details from your account. Because you may type such details into the chat yourself, we automatically remove telephone numbers, email addresses and card-like numbers from your message on our own servers before it is sent to any provider, and the chat window asks you not to send personal details the assistant does not need. The removal is automatic and we cannot promise it catches every possible form, which is why we ask as well.

We use only providers whose terms state that they do not use what we send them to train their models; the providers we currently use are listed in Section 4.2. We do not use your conversations to train any model of our own.

4Who we share personal data with

4.1Helpers. When you decide to interview a Helper we give the Helper your first name, your locality and the working hours and duties you have described. When you decide to proceed to a trial or an Engagement we give the Helper your full name, contact number and the address of the premises. We do not share your details with a Helper before you have chosen to meet them.

4.2Service providers (Data Processors). We use the following providers to run the Platform. Each processes personal data only on our instructions under a written contract, and only for the purpose stated.

4.2.1The assistant's language-model providers. The three rows above marked as generating the assistant's wording are the providers we use today, in that order of preference; the second and third are used only when the one before it is unavailable. We use only providers whose published terms state that they do not use what we send them to train their models. If we add, remove or reorder a provider we will update this policy, and where the change is material we will give notice under Section 15.

4.3Police authorities. Every plan includes police verification. Before a Helper is introduced, we submit the Helper's identity and address details to the relevant police authority for verification, and receive the authority's report.

4.4Professional advisers and authorities. We may disclose personal data to our auditors, lawyers, insurers and bankers under a duty of confidence; to courts, tribunals, arbitrators, the police, tax authorities and regulators where required by law, by a lawful order, or to establish, exercise or defend a legal claim; and to the Data Protection Board of India in connection with a grievance.

4.5Business transfers. If we merge with, are acquired by, or transfer our business or assets to another entity, personal data may be transferred to that entity as part of the transaction, on terms no less protective than this policy, and we will notify you before your personal data becomes subject to a different privacy policy.

4.6What we do not do. We do not sell, rent or trade personal data. We do not share personal data with advertising networks or data brokers, and we do not use it for cross-context behavioural advertising. No advertising script runs on the website or in the app. We do not profile individuals from their support conversations: the analysis described in Section 3 produces counts and categories used to decide what to fix and where to expand, and it is not used to target you.

5Where your data is stored and cross-border transfers

5.1Payment data. In accordance with the Reserve Bank of India's directions on storage of payment system data, all payment data is collected, processed and stored in India by PayU. We hold only the references described in Section 2.1.

5.2Our own systems. The booking application's database and authentication service are hosted by Supabase in Sydney, Australia (AWS region `ap-southeast-2`). The website and app are served from Vercel's global edge network, and request logs are stored in the United States. Transactional email is sent through Resend in the United States.

5.3Transfers outside India. Section 16 of the DPDP Act permits the transfer of personal data outside India except to a country or territory restricted by notification of the Central Government. We transfer personal data only to the providers listed in Section 4.2, under written contracts that require them to protect it, to use it only on our instructions, and to notify us of any breach, and we apply encryption in transit and at rest and least-privilege access controls. We will not transfer personal data to any restricted country or territory.

5.4Logs retained in India. Where the directions of the Indian Computer Emergency Response Team require us to keep system logs within Indian jurisdiction for a stated period, we do so.

5.5Transfers from the EU and UK. Where personal data of Data Principals in the European Economic Area or the United Kingdom is transferred to India or the United States, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision where one applies, together with the safeguards in Section 5.3.

6How long we keep personal data

6.1We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires, whichever is longer, and then erase or anonymise it. Under Section 8(7) of the DPDP Act we erase personal data when you withdraw consent or when the specified purpose is no longer being served, unless retention is required by law.

6.2After deletion. When you delete your account, or when a retention period ends, we erase the data or convert it into a form that no longer identifies you. Data that must be kept under the row for financial records is retained in a restricted archive, separated from your account, and used only for the purpose that requires its retention.

7How we protect personal data

7.1Measures. We apply security safeguards appropriate to the data we hold, as Section 8(5) of the DPDP Act requires, including:

• (a) encryption of data in transit using TLS, and at rest by our hosting providers;
• (b) row-level access rules in our database, so that a signed-in user can read and write only their own profile, requests and plan records;
• (c) server-side processing of payments and of all operations that require elevated privileges, with keys that are never present in the browser;
• (d) restriction of administrative access to named members of our team, with individual credentials;
• (e) authentication provided by a dedicated identity service, with password hashing and optional sign-in through Google; and
• (f) selection of providers that hold recognised security certifications, and written data-processing contracts with each of them.

7.2What you can do. Keep your login private, use a strong password or Google sign-in, and tell us at once if you believe your account has been accessed without authority.

7.3Personal data breaches. If a personal data breach affects you, we will notify you without undue delay, in plain language, describing what happened, what data was affected, the likely consequences, what we are doing about it, and what you can do, and we will notify the Data Protection Board of India in the form and within the period prescribed under the DPDP Act and its rules. For Data Principals in the EU or the UK, we will also notify the competent supervisory authority within seventy-two (72) hours of becoming aware of a breach that is likely to result in a risk to your rights.

8Your rights and how to exercise them

8.1Your rights under the DPDP Act. As a Data Principal you have the right:

• (a) to access a summary of the personal data we process about you, the processing activities, and the identities of every Data Fiduciary and Data Processor with whom we have shared it (Section 11);
• (b) to correction, completion and updating of inaccurate, incomplete or out-of-date personal data (Section 12);
• (c) to erasure of personal data that is no longer needed for the purpose it was collected for, unless retention is required by law (Section 12), sometimes called the right to be forgotten;
• (d) to withdraw consent at any time (Section 6);
• (e) to grievance redressal through the readily available means described below (Section 13); and
• (f) to nominate another individual to exercise your rights in the event of your death or incapacity (Section 14).

8.2How to exercise each right.

• Access. Email governance@mybuddymaid.in from the email address registered to your account, with the subject "Access request". We will send a summary of your data and the list of recipients within thirty (30) days.
• Correction. Open the app, go to Account, and edit your name, phone number or city. For anything else, email governance@mybuddymaid.in with the subject "Correction request", stating what is wrong and what it should be.
• Erasure. Open the app, go to Account, choose Delete My Account, type DELETE to confirm, and confirm. This immediately and permanently deletes your profile, your requests and bookings, your plan records, your email logs, your support conversations on every channel, and your login. Financial records are retained as described in Section 6.2, and the counts and categories described in Section 6 remain because they no longer identify you. You may also email governance@mybuddymaid.in with the subject "Deletion request"; we will confirm your identity and complete the deletion within thirty (30) days.
• Withdrawing consent. For analytics cookies, use the Cookie preferences link in the footer of every page. For promotional messages, use the unsubscribe link in any email, reply STOP to any SMS or WhatsApp message, or email governance@mybuddymaid.in. For any other consent, email governance@mybuddymaid.in with the subject "Withdraw consent", stating which processing you are withdrawing from.
• Nomination. Email governance@mybuddymaid.in with the subject "Nomination", giving the name and contact details of the person you nominate.
• Grievances. See Section 8.5.

8.3Verifying your identity. To protect your data, we act on a request only when it comes from the email address or phone number registered to the account, or when we have otherwise verified that the requester is the Data Principal, their nominee, or a lawful guardian. We may ask for reasonable additional information to confirm this. We do not charge a fee for a request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline it, with reasons.

8.4Timelines. We acknowledge a rights request within forty-eight (48) hours and respond in full within thirty (30) days, or explain why we need longer.

8.5Grievance redressal and the Data Protection Board. If you have a complaint about how we handle your personal data, contact our Grievance Officer using the details in Section 16. We acknowledge every grievance within forty-eight (48) hours and aim to resolve it within thirty (30) days. If you are not satisfied with our response, or you receive none within that period, you may complain to the Data Protection Board of India in the manner prescribed under the DPDP Act and its rules. We will give you the Board's current contact details on request.

8.6Your duties as a Data Principal. Section 15 of the DPDP Act asks Data Principals not to impersonate another person, not to suppress material information when providing personal data for a document or identity, not to register a false or frivolous grievance, and to give only verifiably authentic information when exercising the rights of correction or erasure.

9Cookies, analytics and consent

9.1What we use. The website and app use cookies and similar browser storage as set out below.

9.2Consent for analytics cookies. Google Analytics is loaded only after you accept analytics cookies in the cookie notice shown on your first visit, and we signal your choice to Google through its consent settings so that no analytics or advertising storage is used before you accept. Declining does not affect your use of the website or app. Cookieless measurement, which does not identify you, runs without consent.

9.3Changing your mind. You can change or withdraw your consent at any time through the Cookie preferences link in the footer, and by clearing cookies in your browser. Your browser also lets you block cookies entirely; essential storage is required for the booking app to work.

9.4Global Privacy Control and Do Not Track. We treat a Global Privacy Control signal sent by your browser as a valid request to opt out of identifier-based analytics and of any sale or sharing of personal data.

10Children

10.1The Platform is intended for use by adults, and we do not knowingly create accounts for or collect personal data from anyone under eighteen (18) years of age. If we learn that we have collected personal data from a child without the verifiable consent of a parent or lawful guardian, we will delete it.

10.2A Client who tells us about a child who will be cared for, for example when requesting a nanny, does so as the child's parent or lawful guardian and thereby gives the consent that Section 9 of the DPDP Act requires. We use the information only to identify and brief a suitable Helper, and we do not carry out tracking or behavioural monitoring of children, or direct advertising at them.

10.3A parent or guardian may ask us to review, correct or delete a child's personal data by contacting governance@mybuddymaid.in.

11Helpers' personal data

11.1What we collect from Helpers. When a Helper applies to join our verified pool we collect, with their written consent: name, photograph, date of birth, gender, contact details, current and permanent address; identity and address documents, including a validation of the Helper's Aadhaar identity, of which we retain the verification result and a masked reference only; work history, skills, languages, service categories and locality preferences; the names and contact details of previous households who act as references, and what those references tell us; the notes of our in-person behavioural assessment; and the police-verification report obtained through the relevant police authority, which every plan includes.

11.2Why. To verify identity and suitability, as described on the How We Verify Helpers page; to match Helpers with Clients; to arrange interviews and placements; to provide replacement cover; to meet legal requirements; and to handle grievances.

11.3Who sees it. The verification dossier, comprising identity proof, the summary of references and assessment, and police-verification status, is shared with a Client only when the Client selects the Helper for interview or placement. It is shared in confidence, and our Terms of Service require the Client to use it only for the Engagement, not to copy or forward it, and to delete it when it is no longer needed. Identity and address details are shared with the police authority for verification. Helper data is otherwise processed only by our team and the providers in Section 4.2.

11.4Aadhaar. We do not perform Aadhaar authentication and we do not store or publish Aadhaar numbers. Identity validation uses the offline verification methods permitted under the Aadhaar Act, 2016 and the regulations under it, and we retain only the verification outcome and a masked reference.

11.5Retention. We keep a Helper's verification data for the period of their association with our pool and for thirty-six (36) months after their last placement or last contact, to provide replacement cover, to respond to grievances from households, and to defend legal claims, after which it is erased or anonymised. A police-verification report is retained for the period stated by the issuing authority, or thirty-six (36) months, whichever is shorter.

11.6Helpers' rights. Helpers have every right described in Section 8, exercisable in the same way. We provide this policy and the consent form to Helpers in English and, on request, in Hindi or any other language listed in the Eighth Schedule to the Constitution, and our team explains it in person before consent is taken.

12Communications and marketing

12.1Service communications. We send messages about your requests, interviews, placements, replacements, payments, safety, and changes to our terms or this policy by email, SMS, WhatsApp and in-app notification. These are necessary to provide the service and are sent regardless of marketing preferences.

12.2Promotional communications. We send offers, tips and news only with your consent, and in compliance with the Telecom Commercial Communications Customer Preference Regulations, 2018. Every promotional message contains a way to opt out, and you may also opt out by emailing governance@mybuddymaid.in. Opting out takes effect within seven (7) days.

12.3WhatsApp. If you contact us on WhatsApp, or agree to receive messages there, Meta processes your phone number and messages under its own privacy policy. We use WhatsApp for conversations about your requests and plan, not for bulk marketing.

13Links to other sites

13.1The Platform links to third-party sites and services, including PayU's payment pages, Google's sign-in pages, WhatsApp, and our social-media pages. Those sites have their own privacy policies, which we do not control. This policy applies only to the Platform.

14Additional information for the EU, UK and California

14.1European Economic Area and United Kingdom. If you are in the EEA or the UK, the following applies in addition to the rest of this policy.

• (a) Controller and representative. The controller is the entity named in Section 1.1.
• (b) Lawful bases. The lawful basis for each purpose is stated in the right-hand column of the table in Section 3.1. Where we rely on legitimate interests, we have balanced those interests against your rights, and you may ask us for a summary of that assessment.
• (c) Your additional rights. You have the right to data portability, the right to restrict processing, the right to object to processing based on legitimate interests and to direct marketing, and the right not to be subject to a decision based solely on automated processing. Exercise them by emailing governance@mybuddymaid.in; we respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension.
• (d) Transfers. See Section 5.5.
• (e) Complaints. You may lodge a complaint with the supervisory authority of the EU member state in which you live or work or in which the alleged infringement occurred, or, in the UK, with the Information Commissioner's Office.

14.2California. If you are a California resident, the CCPA gives you the following rights, which you may exercise by emailing governance@mybuddymaid.in or calling +91 93551 14869, and which we honour without discrimination.

• (a) Right to know. The categories of personal information we collect and the categories of sources, purposes and recipients are set out in Sections 2 to 4. In CCPA terms, over the preceding twelve (12) months we have collected: identifiers; personal information under Cal. Civ. Code §1798.80(e) (name, contact details, payment references); commercial information (plans purchased); internet or other electronic network activity; coarse geolocation (city level, derived from IP address); and, where you include it in your notes, sensitive personal information about health, religion or a child. We collect professional and employment-related information from Helpers only.
• (b) Right to delete and right to correct. Exercisable as described in Section 8.2.
• (c) Right to opt out of sale or sharing. We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the preceding twelve (12) months. We honour Global Privacy Control signals.
• (d) Right to limit use of sensitive personal information. We use sensitive personal information only to provide the service you request, and do not use it to infer characteristics about you.
• (e) Authorised agents. You may designate an authorised agent to make a request on your behalf; we will ask for proof of the authorisation and verify your identity.
• (f) Retention. The retention period for each category is stated in Section 6.
• (g) Notice at collection. This policy serves as the notice at collection. We do not offer financial incentives in exchange for personal information.

14.3Other countries. If you use the Platform from another country, the mandatory data-protection law of that country applies in addition to this policy to the extent it cannot be excluded, and we will respond to any request made under it.

15Changes to this policy

15.1We may update this policy from time to time. The version number and effective date appear at the top. Where a change materially affects how we use your personal data, we will notify you at least fifteen (15) days before it takes effect by email and by notice in the app, and, where the change requires fresh consent, we will ask for it. Earlier versions are archived and available on the Platform.

16Contact and Grievance Officer

16.1Grievance Officer. In accordance with the DPDP Act and the rules made under it, the Consumer Protection (E-Commerce) Rules, 2020 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our Grievance Officer is:

• Name: Shivraj Singh
• Designation: Grievance Officer, MyBuddyMaid Private Limited
• Email: governance@mybuddymaid.in
• Privacy requests: governance@mybuddymaid.in
• Telephone: +91 93551 14869 (Monday to Saturday, 10:00 AM to 7:00 PM IST)
• Address: C/o Kanchan Bhatiya, 2-A/3 SF, Front Side, Asif Ali Road, Darya Ganj, New Delhi, Central Delhi 110002, Delhi, India

16.2Escalation. A grievance that is not resolved to your satisfaction within thirty (30) days may be escalated to the Data Protection Board of India under Section 13(3) of the DPDP Act.

16.3General enquiries. For anything else, email info@mybuddymaid.in or message us on WhatsApp at +91 93551 14869.