Privacy Policy

1. Information We Collect

a. Account Information

• Full name and email address
• Password (stored as a bcrypt hash — never in plain text)
• Preferred language (English / Hindi)
• Account creation date and subscription status

b. Kundli (Birth Chart) Data

• Full name, date of birth, time of birth, place of birth
• Relationship to the person (self, spouse, child, etc.)

This data is used exclusively to generate astrological charts and analysis. We do not share this data with third parties except as necessary to provide the service (e.g., geocoding the birth place to get coordinates).

c. Payment Information

• Transaction ID, Razorpay order ID, subscription plan details
• GST invoice details (if provided: GSTIN, state of supply)

We do not store full card numbers, CVV, or banking credentials. All payment processing is handled by Razorpay (PCI-DSS Level 1 compliant).

d. Usage and Technical Data

• Pages visited, features used, session duration
• Device type, browser type, operating system
• IP address (used for security and fraud prevention; not linked to your profile for marketing)
• Error logs and performance data

2. How We Use Your Information

• Service delivery: To generate Kundli charts, predictions, matchmaking reports, and all other subscribed services
• Account management: To manage your account, verify identity, and process subscriptions
• Payments and invoicing: To process payments via Razorpay and issue GST-compliant tax invoices
• Communication: To send account verification emails, payment confirmations, subscription reminders, and service updates
• Platform improvement: To improve our AI models and service quality using anonymized, aggregated usage data — no personally identifiable information is used for model training
• Security: To detect, prevent, and investigate fraud, abuse, or unauthorized access
• Legal compliance: To meet our obligations under Indian tax law, consumer protection regulations, and other applicable laws

3. Legal Basis for Processing

We process your personal data on the following legal grounds under the DPDP Act, 2023:

• Consent: You provide consent when you register an account and agree to these Terms
• Contract performance: Processing necessary to deliver the services you have subscribed to
• Legal obligation: Retaining invoice and transaction data as required by Indian GST laws
• Legitimate interest: Security monitoring and fraud prevention

4. Data Storage and Security

• Your data is stored on secure servers with industry-standard encryption (AES-256 at rest)
• All data transmission uses HTTPS/TLS 1.2 or higher
• Passwords are hashed using bcrypt with appropriate work factors
• Access to your personal data is restricted to authorized personnel only, on a need-to-know basis
• We conduct periodic security reviews of our systems

While we take all reasonable steps to protect your data, no system is 100% secure. We encourage you to use a strong, unique password and to enable additional security measures where available.

5. Third-Party Services

We share limited data with trusted third-party providers solely to operate the Platform:

• Razorpay: Payment processing. Razorpay receives your payment details and transaction data. Governed by Razorpay's Privacy Policy.
• Email service providers: For transactional emails (account verification, invoices, notifications). We share only your email address and the content of the specific email.
• Geocoding APIs: Your birth place name is sent to a geocoding service to obtain coordinates for chart calculation. This is typically a city/district name — no personally identifying information is attached.
• Cloud infrastructure: Your data is hosted on secure cloud servers. Our hosting provider cannot access the contents of your data.

We do not sell your personal data to any third party. We do not share your data with advertisers, data brokers, or marketing companies.

6. Cookies

We use cookies for session management and user authentication. For full details, see our Cookie Policy.

7. Data Retention

• Account data: Retained while your account is active and for 3 years after account closure, for dispute resolution and legal compliance
• Kundli birth data: Retained as long as your account is active; deleted within 30 days of account deletion
• Payment and invoice records: Retained for 7 years as required under Indian GST laws
• Usage logs: Retained for 90 days, then automatically deleted
• Email communication logs: Retained for 1 year

8. Your Rights under the DPDP Act, 2023

As a Data Principal, you have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements — e.g., we cannot delete invoice records required by tax law)
• Right to Withdraw Consent: Withdraw your consent at any time. This may affect your ability to continue using the Platform.
• Right to Grievance Redressal: Lodge a complaint with us and, if unresolved, with the Data Protection Board of India
• Right to Nominate: Nominate an individual to exercise these rights on your behalf in the event of your death or incapacity

To exercise any of these rights, contact us at legal@jyotishstack.com. We will respond within 30 days.

9. Children's Privacy

Our Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately at legal@jyotishstack.com and we will delete it promptly.

10. Data Transfers

Your data is primarily stored and processed within India. In cases where data is transferred to countries outside India (e.g., through certain cloud services or APIs), we ensure that adequate safeguards — including contractual protections — are in place to protect your data.

11. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes via email and by updating the "Last Updated" date. Continued use of the Platform after such changes constitutes acceptance.

12. Contact and Grievance Officer