Privacy Policy

1. Data we collect

We collect the following categories of data, depending on how you use the Platform:

Category	Examples	When
Account data	Name, email, phone number, password (hashed), role (pilgrim or provider)	Registration, Google sign-in
Booking data	Guest name, phone, visit date, persons count, vehicle number (for parking)	Making a booking
Payment data	Payment status, invoice amounts, Razorpay order/payment references	Completing an online payment
Chat & voice data	Text messages, uploaded voice recordings, conversation history	Using the AI chat assistant
Location data	Device GPS coordinates, area name	Only when you trigger SOS or grant location access
Provider data	Business name, facility details, payout bank/UPI details	Registering as a facility provider
Technical data	IP address, device/browser type, session identifiers	Automatically, on every visit

2. How we use your data

To create and secure your account, including OTP-based email verification.
To process and manage your bookings, and to let providers fulfil them.
To process payments and generate invoices.
To power the AI chat assistant's understanding of your requests and provide relevant, grounded answers.
To respond to SOS requests and notify your emergency contact and nearby providers, if you use that feature.
To send transactional emails (OTP codes, booking confirmations, security notices) — never marketing spam without your consent.
To detect and prevent fraud, abuse, and security incidents.
To improve the Platform — e.g. understanding which facilities and routes pilgrims search for most.

3. AI chat & voice data

When you chat with our AI assistant, your messages are processed by a third-party AI language model provider to generate a response, grounded in our live facility database. If you use voice input, your audio is sent to a third-party speech-to-text service for transcription, and spoken replies are generated by a third-party text-to-speech service. These providers process your data solely to generate the response and do not use it to build advertising profiles about you.

We retain a short rolling window of recent conversation turns to maintain context within a session, and we keep a durable log of conversation history so you (and, for support purposes, our team) can review past interactions — see Section 8 for how long.

4. Location & SOS data

We only access your device's precise location when you explicitly grant permission, typically to power crowd-aware suggestions or to trigger an SOS alert. When you use SOS, your location is shared with your registered emergency contact (if any) and with nearby verified providers who can assist, so that help can reach you quickly. We do not track or store your location outside of these specific, user-initiated moments.

5. Who we share data with

We share personal data only where necessary to operate the Platform:

Facility providers — booking details needed to fulfil your reservation (name, phone, visit date, vehicle number where relevant).
Payment processor (Razorpay) — payment details needed to process an online transaction.
AI & voice service providers — chat text and voice audio, solely to generate responses (see Section 3).
Google — if you choose to sign in with Google, basic profile data (name, email) from your Google account.
Emergency contacts & nearby providers — only when you trigger SOS.
Legal authorities — only where required by law, a valid legal process, or to protect the safety of a user.

We do not sell your personal data to third parties.

6. Payment data

Online payments are handled entirely by Razorpay, a licensed and PCI-DSS-compliant payment gateway. We do not receive or store your full card number, CVV, or UPI PIN — Razorpay passes us only a payment status and a transaction reference, which we use to mark your invoice as paid. Payouts to facility providers are processed separately using the bank or UPI details they provide us directly.

7. Cookies & similar technology

We use essential session cookies to keep you logged in and to protect against cross-site request forgery — these are required for the Platform to function and cannot be disabled while using the site. If you install AI Kumbh Sahayak as an app (PWA), your browser stores some data locally on your device (like your audio/language preferences and a short chat history cache) so the app works smoothly offline and across visits. We do not use third-party advertising or cross-site tracking cookies.

8. Data retention

Account data — kept while your account is active, and for a reasonable period after deletion to comply with legal/financial record-keeping obligations.
Booking & invoice records — retained as financial records; these cannot be deleted on request due to accounting and dispute-resolution requirements, consistent with standard practice for transactional records.
Conversation logs — retained to support you if you need help with a past interaction, and periodically reviewed in aggregate to improve assistant quality.
In-session chat memory — a short rolling window used only to keep a live conversation coherent; it is not a durable record and is cleared when a session ends.

9. How we protect your data

Passwords are stored using industry-standard one-way hashing, never in plain text. Sensitive account actions (login, password reset) are protected by OTP verification and rate-limiting against repeated guesses. Payment processing happens through Razorpay's secure, compliant infrastructure rather than on our own servers. We restrict internal access to personal data to what's needed for the relevant support or operational task, and administrative actions on the platform are logged for accountability.

10. Your rights & choices

Depending on your location, you may have the right to:

Access a copy of the personal data we hold about you.
Correct inaccurate account information (most of this you can update directly in your Profile).
Request deletion of your account and associated data, subject to the financial-record retention noted in Section 8.
Withdraw consent for optional features (like location access or push notifications) at any time via your device/browser settings.
Object to certain uses of your data, or ask us questions about how it's processed.

To exercise any of these rights, contact us using the details in Section 13.

11. Children's privacy

The Platform is intended for users aged 18 and above, or younger pilgrims travelling under the supervision of a parent or guardian who holds the account. We do not knowingly collect personal data directly from children to create their own independent account.

12. Changes to this policy

We may update this Privacy Policy as our services evolve or legal requirements change. We'll update the "Last updated" date above whenever we do, and for material changes, we'll make a reasonable effort to notify active users.

13. Contact us

For any privacy question, data access/deletion request, or concern, reach us using the details below or via our Contact page.