Privacy Policy

---

1. Information We Collect

1.1 Information You Provide Directly

• Account information: When you create an account, we collect your name, email address, and password (stored as a one-way hash — we never store your plain-text password). If you sign in with Google or Apple, we receive your name and email from those providers. If you use Apple's "Hide My Email", we may ask you for your real email address so we can send receipts and account emails; giving it is your choice.
• Username and social profile: If you choose a username, it is visible to other BhaiFinder users who search for it, together with your display name. Friends you connect with can also see your avatar (emoji and colour), save streak and save/share counts.
• Friends, groups and sharing: Friend requests you send and receive, your friend connections, groups you create or join, the items and categories you share with friends or groups (a copy of the shared item's link, text, preview image and AI summary), and emoji reactions you leave on shared posts. There is no chat — only shared saves and reactions.
• Bhai Caller (optional, off by default): If you turn on Bhai Caller, a due nudge can ring as an in-app voice call with an AI assistant. Your voice is streamed in real time from your device to OpenAI so the assistant can understand and reply; we do not store the audio. We store a text transcript of the conversation for 90 days, plus call details (time, duration, whether it was answered, and the outcome — done, doing or snoozed). Your call settings (quiet hours, ringtone) are stored with your profile.
• Voice search: If you search by voice, your speech is converted to text by your phone's speech-recognition service (Apple on iOS, Google on Android), which may process the audio on its own servers under its own privacy terms. We receive only the resulting text.
• Searches: Your recent search queries and the search suggestions you tap, so we can show recent searches and better suggestions.
• Preferences: Language (Hinglish or English), time zone, notification and call tones, and feature settings such as auto-sort and "Allow AI parse".
• Website forms and promotions: If you ask for an app link on our Website, we collect your email address. If you take part in a gift campaign, we collect your name, email address (verified with a one-time code), mobile number, and your locality or delivery address so the gift can reach you.
• Content you save: Any link, photo, text, PDF, visiting card, screenshot, or other content you share with BhaiFinder through the share sheet or within the app. This content is stored on our servers to power the Service.
• Profile information: Any updates you make to your profile, such as display name or notification preferences.
• Payment information: When you subscribe to Bhai Pro or Bhai Pro Max, your payment is processed by Razorpay (currently for all customers, including payments in US dollars made with cards issued outside India) or, where we offer it in your region, by Paddle.com Market Ltd. We do not store your card number, UPI ID, or bank account details. We receive a subscription ID and payment confirmation from the relevant payment provider. If you provide a GSTIN for GST invoicing, we store that. Where Paddle processes your payment, it acts as Merchant of Record and processes your billing details under its own privacy policy.
• Support communications: If you contact us at hello@bhaifinder.com, we store that correspondence.
• Support tickets: If you raise a support ticket inside the app (You → Help & FAQ → Support), we store the description you write, every message exchanged with our support team on that ticket, its status, and your name and email address so we can identify and reply to you. Support tickets are deleted along with your account.

1.2 Information Collected Automatically

• Device information: Device type, operating system version, and app version. We do not collect advertising identifiers — we do not read your Android Advertising ID or iOS IDFA, and we do not use them for tracking or profiling.
• Usage data: Features used, screens viewed, saves created, searches performed, reminders set and completed.
• Log data: IP address, timestamps, app version, crash reports, error logs.
• Push notification token: Your Firebase Cloud Messaging (FCM) token, used solely to send you reminders and app notifications.
• Time zone: Your device's time zone, so reminders, nudges, calls and weekly insights arrive at the right local time.
• Website visits: When you visit the Website, we measure visits ourselves (no third-party tracker). We store a random visitor ID in your browser's local storage, and record your IP address, browser and device type, approximate city (derived from your IP address), how you arrived (for example the referring site or an ad campaign tag), and on-page events such as sections viewed, buttons tapped, scroll depth and answers to the short on-page quiz. These records are deleted automatically after 90 days. See our Cookie Policy.

1.3 Information from Third Parties

• Google Sign-In / Apple Sign-In: If you use social login, we receive your name and email from those providers under their respective privacy terms.
• Instagram (Meta) — saving reels via direct message: If you choose to save a reel or post by sharing it in a direct message to our Instagram account (@BhaiFinder), we receive that message from Meta through the Instagram Platform. This includes your Instagram-scoped user ID and the content you shared with us (such as the link to the reel or post). We use this solely to save that content into your BhaiFinder library and to reply to you with a confirmation. You link your Instagram to your BhaiFinder account through a secure one-time link. We do not access your Instagram profile, your followers, your private messages with other people, or any content you have not shared directly with us. You can unlink at any time by contacting us, after which we stop associating your Instagram ID with your account.
• Instagram (Meta) — saving a post by commenting @BhaiFinder: If you comment "@BhaiFinder" on an Instagram post, Meta notifies us of that mention. We then read back that comment and the post's link, save the post into your BhaiFinder library if your Instagram is linked, and may send you one private reply. You can also unlink your Instagram by sending "unlink" in your direct-message thread with @BhaiFinder. We remember the language you chose for our Instagram replies against your Instagram-scoped ID.
• Public information about links you save: When you save a link, we fetch publicly available information about it (such as the title, caption and preview image) from the linked website. For Instagram posts we may use a third-party service (Apify) to fetch that public information, and for YouTube videos we use the YouTube Data API. Only the link is sent — never your name, email or account details.
• Razorpay: Payment status, subscription status, and transaction metadata.
• Paddle: Payment status, subscription status, and transaction metadata, where Paddle processes your payment.

---

2. How We Use Your Information

We use the information we collect to:

• Provide the Service: Store your saved content, run AI categorization, execute reminders, and return search results.
• AI processing: Content you save is processed by the OpenAI API (GPT-4o mini model) to extract category, context, and tags. This processing happens server-side. We send only the content of what you saved — we do not send your name, email, or account details to OpenAI for this purpose.
• OCR processing: Photos and visiting cards are first processed using Google ML Kit on your device. That OCR step never leaves your phone; only the extracted text is sent to our servers.
• Image understanding (fallback): If on-device OCR finds no usable text in a photo — for example a picture of a product or a place rather than a document — the image itself is sent once to the OpenAI API so it can be described for categorisation. This happens only for that fallback case. The image is used for that single request and is not stored by us, and is not used to train any model. The original photo otherwise stays on your device.
• Search: To find saves by meaning rather than exact words, we create a numeric representation ("embedding") of each save's text using the OpenAI API and store it with the item. When a search needs interpreting (for example "the cafe I saved last week"), the search query is sent to the OpenAI API. Your name and email are not sent.
• Bhai Insights: Once a week we summarise what kinds of things you saved (for example the share of food, travel or learning saves) into an Insights card. A short playful headline for the card is written by the OpenAI API from those summary figures only. Insights cards are kept for up to 12 months.
• Vibe Match: When you open Vibe Match with a friend, each of you sees only the overall shape of the other's interests — the percentage of saves in each broad built-in category. Your items, titles, links, tags, counts and custom category names are never shown.
• Friends, groups and sharing: Deliver the items and categories you choose to share to the friends or groups you choose, show reactions, and send related notifications (for example a friend request or a new shared post).
• Bhai Caller: If you turn it on, ring you when a nudge is due (outside your quiet hours), let the AI assistant ask about the task, and apply what you say (mark it done, keep it active, or snooze it). The assistant only proposes these actions; our servers apply them. You can turn Bhai Caller off at any time in Settings.
• Notification wording: Some reminder and engagement notifications are worded by the OpenAI API so they don't feel repetitive. This uses the item's title or category, never your name or email.
• Instagram saving: Save reels and posts you send to @BhaiFinder in a direct message, or tag @BhaiFinder in a comment, and reply to you on Instagram.
• Promotions: Run referral rewards and gift campaigns — verify eligibility, prevent abuse, and arrange delivery of physical gifts.
• Website measurement: Count visits and understand which parts of the Website help people find the app, using first-party data only.
• Send reminders: Deliver push notifications for reminders you set, using Firebase Cloud Messaging.
• Account management: Authenticate you, manage your subscription, and process payments.
• Improve the Service: Analyse anonymised usage patterns to fix bugs and improve features. We do not use your saved content to train AI models.
• Communicate with you: Send transactional emails (receipts, OTP codes, password resets). We do not send marketing emails without your explicit consent.
• Legal compliance: Comply with applicable laws, respond to lawful requests, and enforce our Terms of Service.

---

3. How We Share Your Information

We do not sell your personal information. Ever.

We share information only in the following limited circumstances:

Recipient	What we share	Why
OpenAI	Content of what you saved (text, URLs); and, only when on-device OCR finds no usable text, the photo itself	AI categorisation, context extraction, and image description. Not stored by OpenAI for training.
OpenAI (search, insights, notifications, Bhai Caller)	Search queries and save text for search; weekly category percentages for Insights headlines; item titles for notification wording; and, only if you turn on Bhai Caller, your live call audio and the task titles being discussed	Search, Insights, notification wording, and the voice assistant in Bhai Caller. Not used by OpenAI for training.
Google (Firebase)	FCM push tokens	Reminder and notification delivery
Google (ML Kit)	Nothing — runs entirely on your device	On-device OCR text extraction
Razorpay	Subscription/payment transactions (India, and US-dollar payments made with cards issued outside India)	Payment processing
Paddle.com Market Ltd	Subscription/payment transactions (outside India, where we offer Paddle checkout)	Payment processing & Merchant of Record
MongoDB Atlas	All user and content data	Cloud database hosting
Amazon Web Services (Mumbai, India)	All data processed by our servers; secrets; copies of saved links' public preview images	Server hosting, secrets management, and preview-image storage and delivery (Amazon S3 / CloudFront)
Meta Platforms (Instagram)	Messages and comments you send to @BhaiFinder, and our replies	Saving Instagram posts you send us, and replying to you
Apify	The public link of an Instagram post you save — no account data	Fetching the post's public caption and preview image
Google (YouTube Data API)	The link or ID of a YouTube video you save — no account data	Fetching the video's public title and details
Google (Gmail / Google Workspace)	Your email address and the email's content	Sending transactional emails (sign-up codes, password resets, receipts, gift updates)
Apple / Google speech recognition	Your voice, only when you use voice search — sent by your phone's operating system, not by us	Turning speech into a search query
goQR.me (api.qrserver.com)	Your gift code — only if you claim a gift	Drawing the QR code shown in gift emails

All third-party processors we use are bound by data processing agreements. We select providers that offer adequate data protection.

Other BhaiFinder users. Some features are social by design. Users who search for your username see your username and display name. Friends you accept see your avatar, save streak and save/share counts, and anything you choose to share with them or with a group they are in, along with your reactions. In Vibe Match, a friend sees only the percentage split of your saves across broad categories. Once you share an item or category, the recipient keeps their copy even if you later delete yours.

We may disclose your information if required by:

• A court order, subpoena, or other legal process
• A government authority in India or internationally, where required by applicable law
• Protection of the rights, property, or safety of BharatAI Solutions, our users, or others

---

4. Data Storage and Security

• Your data is stored on MongoDB Atlas servers, preferably in the Asia Pacific (Mumbai) region.
• Our servers run on Amazon Web Services in the Asia Pacific (Mumbai) region.
• Photos and PDFs you attach stay on your own device. We do not upload or store the original files on our servers — only the text extracted from them, and the AI context derived from that text, are saved to your account. If you uninstall the app or clear its data, those local files are gone.
• Link preview images: When you save a link, we may copy its public preview image (for example a reel's thumbnail) into our own storage on Amazon Web Services, so the preview keeps working after the original site's image link expires. This applies only to public preview images of links — your own photos still stay on your device as described above. A preview image is stored once and shared by every saved item that points to it, and preview images no longer linked to any saved item are removed in a periodic cleanup.
• Bhai Caller audio is not stored. Call audio streams directly between your device and OpenAI during the call; we keep only the text transcript, for 90 days.
• We use industry-standard security measures: HTTPS/TLS for all data in transit, encryption at rest, JWT-based authentication, and bcrypt password hashing.
• Access to production systems is restricted to authorised personnel only.
• We conduct periodic security reviews.

No system is 100% secure. If we discover a breach that affects your personal data, we will notify you as required under applicable law.

International data transfers

BhaiFinder is currently not offered in the European Economic Area, the United Kingdom or Switzerland (see our Terms of Service). The rights described in Section 6 for those regions still apply to anyone they protect.

We are based in India, and your data is stored primarily in India (Mumbai). If you use BhaiFinder from outside India, your data is transferred to India. Some of our service providers listed in Section 3 (for example OpenAI, Google, Meta, Apify and Paddle) may process data in other countries, including the United States, the United Kingdom and the European Union. Preview images may be delivered to you from content-delivery servers close to your location around the world.

Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) included in our providers' data processing terms, together with the security measures described above. You can ask us for more information about these safeguards by emailing hello@bhaifinder.com.

---

5. Data Retention

• Active accounts: We retain your data for as long as your account is active.
• Deleted accounts: Deletion is immediate and irreversible — there is no grace period and no way to restore your account. Your account and all data linked to it (saved items, categories, reminders, notifications, Bhai Caller call records, Bhai Insights, support tickets, friends, groups and shares, search history, subscription records and logs tied to you) are permanently erased in the same step. Payment records and invoices are held by our payment processor, Razorpay, as Indian tax law requires; we do not keep a copy after deletion (see our Data Deletion Policy for the full breakdown).
• Monthly usage record: So that deleting and re-creating an account cannot reset free limits, we keep a one-way hash of your email address and/or sign-in provider ID together with how much of that month's free allowance (saves, AI credits, Bhai Caller calls, referral bonus balance) had been used. It contains no name, readable email, IP address or plan. If you sign up again with the same identity in the same month, the new account starts with that usage. The record deletes itself automatically at 00:00 IST on the 1st of the following month.
• Audit logs: Retained for 90 days, then automatically deleted.
• Bhai Caller transcripts and call records: Automatically deleted 90 days after the call, or earlier if you delete your account.
• Bhai Insights cards: Automatically deleted 12 months after they are created, or earlier if you delete your account.
• Website visit records: Automatically deleted after 90 days.
• Server request logs: Automatically deleted after 7 days. Records of suspicious or malicious requests (used to block attacks) are deleted after 30 days.
• Shared items: When a friend or group member saves an item you shared, or imports a category you shared, they get their own copy, which stays in their library until they delete it — even if you delete yours or delete your account. Shares they had not saved are removed when you delete your account.
• Link preview images: Deleting a saved item does not immediately delete its preview image, because the same image may be used by other saved items (for example a copy a friend saved). Preview images that are no longer linked to any saved item are removed in a periodic cleanup.
• Gift campaign records: Kept for as long as needed to run the campaign, deliver gifts and handle any delivery questions or disputes.
• Referral abuse-prevention record: To stop the same person from repeatedly deleting and re-creating an account to farm referral bonuses, we keep a minimal, permanent record that an identity has already used a referral. This record stores only a one-way hash of your email address and/or sign-in provider ID — never your email in readable form, and no other personal data. Because its sole purpose is fraud prevention, this hashed record is retained even after your account is deleted.
• Cancelled subscriptions: Your saved content remains accessible until your paid period ends. After that, it remains on a Free plan.

---

6. Your Rights

Depending on where you are located, you may have the following rights regarding your personal data:

For all users (India — IT Act 2000 and DPDP Act 2023)

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and personal data (subject to legal retention obligations).
• Grievance redressal: Contact our Grievance Officer (see Section 10).

For EU/EEA users (GDPR)

In addition to the above:

• Portability: Receive your personal data in a structured, machine-readable format.
• Restriction: Request that we restrict processing of your data.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.
• Complaint: Lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first — email us.

These rights also apply to users in the United Kingdom (UK GDPR) and Switzerland.

Legal bases (EEA, UK and Switzerland). We process your personal data on these bases:

• Contract: to provide the Service you signed up for — your account, saves, AI sorting, search, reminders, sharing with friends you choose, and paid plans.
• Consent: for optional features you switch on, such as Bhai Caller, linking Instagram, voice search, and joining a gift campaign. You can withdraw consent at any time by turning the feature off or contacting us.
• Legitimate interests: to keep the Service secure, prevent fraud and referral abuse, measure Website visits with first-party data, and improve the Service. You can object to this processing.
• Legal obligation: to keep tax and payment records and respond to lawful requests.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. AI is used only to sort, describe and find your own saves.

For California users (CCPA)

• Know: What personal information we collect, use, disclose, and sell (we do not sell personal information).
• Delete: Request deletion of your personal information, subject to exceptions.
• Non-discrimination: We will not discriminate against you for exercising your rights.
• Correct: Request correction of inaccurate personal information.
• No selling or sharing for advertising: We do not sell personal information and do not "share" it for cross-context behavioural advertising.

Other locations

If you live in another US state with a privacy law (for example Virginia, Colorado, Connecticut, Utah or Texas), or in another country with data protection laws (for example Brazil, Canada, Singapore or Australia), you may have similar rights to access, correct, delete or port your data, and to appeal a decision we make about your request. Email us and we will honour the rights your local law gives you. If we decline a request, you can appeal by replying to our decision; if you remain unhappy, you can contact your local data protection authority.

To exercise any of these rights, email hello@bhaifinder.com with the subject line "Privacy Request." We will respond within 30 days.

---

7. Cookies and Tracking

The BhaiFinder website (bhaifinder.com) uses:

• Essential cookies: Required for the website to function (session management).
• No analytics or advertising cookies. We do not run Google Analytics or any comparable third-party tracker on the Website. If that changes, we will update this policy and ask for your consent first.
• First-party visit measurement: A random visitor ID kept in your browser's local storage, used only by us to count visits and see which parts of the Website are used (see Section 1.2). It is never shared with advertisers.
• Checkout session cookie: A short-lived cookie (about 30 minutes) that keeps you signed in on the plans page after you open it from the app.

The BhaiFinder mobile app does not use browser cookies. It includes the Firebase Analytics SDK, used to understand which features are used and where people get stuck so we can improve the app. Analytics collection is switched off by default and no analytics data is collected unless it is enabled. When enabled, Firebase Analytics records anonymised in-app usage events (for example: screens viewed, an item saved, a plan viewed) together with an app-instance identifier, device model, app version and approximate region derived from your IP address. It is never used for advertising, and the app does not read your Android Advertising ID or iOS IDFA. The other Google service the app uses at runtime is Firebase Cloud Messaging, for delivering notifications.

For full details, see our Cookie Policy.

---

8. Children's Privacy

BhaiFinder is not directed at children under the age of 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at hello@bhaifinder.com and we will delete it promptly.

If you are under 18, you may use BhaiFinder only with the consent and supervision of a parent or legal guardian, as also stated in our Terms of Service. We do not knowingly track minors' behaviour or target them with advertising.

---

9. Third-Party Links

Content you save may include links to third-party websites. Our Privacy Policy does not apply to those websites. We are not responsible for the privacy practices of third parties.

---

10. Grievance Officer (India — DPDP Act 2023)

As required under Indian law, we have designated a Grievance Officer:

Name: Grievance Officer, BharatAI Solutions Private Limited
Address: C-24 Shaha Dana Colony, Izzat Nagar, Bareilly, Uttar Pradesh 243122, India
Email: hello@bhaifinder.com
Response time: We aim to acknowledge grievances within 48 hours and resolve them within 30 days.

---

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Post a notice in the app on your next login
• Send an email notification for significant changes

Continued use of the Service after changes constitute acceptance of the updated policy.

---

12. Contact Us

BharatAI Solutions Private Limited
Product: BhaiFinder
Address: C-24 Shaha Dana Colony, Izzat Nagar, Bareilly, Uttar Pradesh 243122, India
Email: hello@bhaifinder.com
Website: bhaifinder.com

BhaiFinder is a product of BharatAI Solutions Private Limited, incorporated in India.