PRIVACY POLICY & DATA NOTICE

Effective date: 6 November 2026 (planned launch date; confirm before publication) | Last updated: 11 October 2026

1. Purpose and who controls the data

This Privacy Policy explains how HABIBTI DATING PRIVATE LIMITED processes personal data when you use HABIBTI. For the purposes of applicable Indian data-protection law, the company’s role and obligations depend on the processing it determines. We will identify the responsible entity and provide the contact details required by law. This notice should be read with any just-in-time notices presented when you enable location, upload photos, complete verification, use AI-assisted features, make a purchase or join a promotion.

2. Plain-language summary

• We use information to create and secure accounts, show profiles, enable matching and messages, operate Community, process payments, support users, prevent abuse and comply with law.
• Your profile and content may be visible to other users according to your settings and the feature used. Information shared with another user can be copied or redistributed by that user.
• We do not sell personal data as a standalone product. We may share necessary data with service providers, payment/app-store partners, other users as part of the service, professional advisers, authorities where legally required, and parties to a corporate transaction subject to safeguards.
• You can use the controls we provide to manage profile visibility, permissions, marketing preferences and account deletion. Some data may need to be retained for legal, security, fraud, payment or dispute purposes.
• We do not knowingly permit people under 18 to use HABIBTI.

3. Categories of data we may process

3.1 Account and identity data

Name or display name, date of birth/age, phone number, email address, login identifiers, account settings, age-assurance results, verification status and information you provide to recover or secure your account.

3.2 Profile and preference data

Photos, videos, bio, interests, relationship intentions, preferences, language, city or broad location, and any other fields you choose to share. Sensitive information may be inferred from content or voluntarily disclosed by you. Do not request or collect sensitive data unless it is necessary, lawfully justified, transparently disclosed and approved before launch.

3.3 Dating, communication and Community data

Likes, matches, blocks, reports, messages, prompts, reactions, posts, comments, stories, event participation, moderation records and interactions with other users. We may process content to deliver messaging, display Community content, investigate reports, detect scams, enforce rules and comply with lawful requests. We will disclose any automated scanning or AI analysis in a clear notice.

3.4 Location and device data

With permission where required, we may process precise or approximate location for nearby discovery, distance display, safety or event features. We may also process IP address, device identifiers, app version, operating system, crash logs, time zone, language, access logs and security signals. Use the minimum precision and retention needed for each purpose. Do not collect background or continuous location unless the feature genuinely requires it, the user has clear notice and controls, and counsel has approved the design.

3.5 Verification and safety data

Phone/email verification, selfie or liveness-check results, document-check outcomes if implemented, reports, appeals, evidence supplied by users, fraud indicators and enforcement history. If biometric data or facial templates are processed by HABIBTI or a vendor, this requires a specific pre-launch legal, security, necessity and retention review. Do not store raw identity documents or biometric templates by default.

3.6 Purchase and rewards data

Subscription tier, transaction identifiers, payment status, purchase/renewal/cancellation records, invoices, refunds, promotional eligibility, reward milestones, delivery information where needed and tax-related records. Full card credentials and UPI PINs should be handled by authorised payment providers, not stored by HABIBTI.

3.7 Support, preference and usage data

Support requests, correspondence, survey responses, notification preferences, consent records, feature usage, analytics events and marketing preferences.

4. Purposes and lawful grounds

We process data only for specified, disclosed purposes and under a lawful basis available under applicable law. Depending on the activity and the law in force, purposes may include:

• Providing the service you request: account creation, profile display, discovery, matching, messaging, Community, settings and purchases.
• Consent-based processing: optional precise location, marketing, optional analytics or cookies where consent is required, and any feature for which specific consent is required.
• Safety and platform integrity: age assurance, fraud prevention, spam detection, reporting, moderation, account security and investigation of suspected violations.
• Legal compliance: responding to valid legal process, keeping required records, consumer protection, tax/accounting, and protecting legal rights.
• Service operation and improvement: reliability, troubleshooting, accessibility, aggregate measurement and product improvement, using proportionate data and controls.
• Communications: transactional notices, security alerts, service updates and, separately where required, promotional communications.

We will not rely on a broad “legitimate interests” statement as a substitute for identifying a valid legal basis under Indian law. Consent must be informed, specific, clear, withdrawable where applicable and as easy to withdraw as to give. Withdrawal does not invalidate processing already lawfully carried out.

5. What other users can see

Information on your public or discoverable profile, posts, stories, photos, interests and other content is shown according to the feature’s design and your settings. A message is ordinarily available to the participants, but may be accessed by authorised staff or systems where reasonably necessary for user reports, safety, support, fraud prevention, legal compliance or service operation, subject to safeguards. We do not promise that content is confidential once shared with another user.

6. Sharing and disclosures

• Other users: information needed to display your profile, posts, match activity or messages to the relevant recipients.
• Service providers/processors: hosting, database, messaging, email/SMS, customer support, security, analytics, verification, moderation, mapping, payment and app-store providers acting under appropriate contractual safeguards.
• Payment and app-store partners: purchase, subscription, refund and transaction information needed to complete or manage a transaction.
• Authorities and legal recipients: where required by applicable law, valid legal process, court order or lawful government request; or where necessary to address an imminent threat, subject to legal review.
• Professional advisers and auditors: where necessary for legal, accounting, security or compliance advice and subject to confidentiality obligations.
• Corporate transactions: due diligence or transfer connected with a merger, restructuring, financing or asset sale, with appropriate safeguards and notices where required.
• With your direction or consent: where you expressly ask us to share information or authorise a third-party integration.

We do not permit vendors to use personal data for their own unrelated advertising or purposes unless separately disclosed and lawfully permitted. A vendor register should be maintained internally and updated when providers change.

7. International transfers and hosting

Data may be processed or stored in India or other jurisdictions by service providers. Before transfer, we will assess applicable Indian restrictions, government notifications, contractual safeguards, access controls, security, subprocessors and user notices. We will not promise that every transfer is lawful merely because a vendor is reputable. The current vendor and hosting locations should be listed in the internal data map.

8. Retention and deletion schedule

We retain personal data only as long as reasonably necessary for the disclosed purpose, applicable law, security, fraud prevention, payment records and legal claims. The following is a proposed operational schedule, not a substitute for a verified data inventory. Confirm exact periods with counsel and technical owners before launch.

• Active account/profile data: while the account remains active and necessary to provide the service.
• Deleted account data: remove from public display promptly after verified deletion request; erase or de-identify from active systems within [RETENTION PERIOD TO BE CONFIRMED BEFORE PUBLICATION], unless a lawful exception applies.
• Backups: expire on a documented rolling schedule of [RETENTION PERIOD TO BE CONFIRMED BEFORE PUBLICATION]; deleted data should not be restored to active use except for disaster recovery and then re-deleted under documented controls.
• Reports, appeals and enforcement evidence: retain for [RETENTION PERIOD TO BE CONFIRMED BEFORE PUBLICATION] or longer only where required for an active investigation, safety risk or legal obligation.
• Security and access logs: retain for [RETENTION PERIOD TO BE CONFIRMED BEFORE PUBLICATION] based on security needs and applicable law; restrict access and avoid unnecessary content.
• Payment, tax and accounting records: retain for the statutory period applicable to the relevant record and transaction.
• Consent and preference records: retain for as long as needed to demonstrate compliance and honour withdrawals.
• Marketing data: until consent is withdrawn or the data is no longer needed, with suppression records retained to prevent future unwanted marketing.
• Minor-related data: restrict immediately and delete as soon as legally and operationally appropriate, preserving only narrowly necessary evidence or records where required.

Do not publish a retention promise unless the engineering system can actually implement it. If data is held for a legal hold, disclose the category and reason where lawful, restrict access, and delete it when the hold ends.

9. Security safeguards and incident response

We will implement safeguards proportionate to the sensitivity and volume of data, including least-privilege access, strong authentication for staff, encryption in transit and where appropriate at rest, secrets management, secure development, dependency patching, monitoring, backups, vendor due diligence, staff confidentiality, incident response and periodic testing. We cannot truthfully promise absolute security. If a personal-data breach occurs, we will assess, contain, investigate, document and notify affected people and authorities within the timelines and manner required by applicable law.

10. Your choices and rights

Subject to applicable law and verification of your identity, you may be able to access information about processing, correct or update inaccurate data, request erasure, withdraw consent, raise a grievance, nominate another person where legally available, or exercise other statutory rights. Use the in-app privacy settings and rights-request option, once implemented or email [PRIVACY CONTACT DETAILS TO BE PROVIDED BEFORE PUBLICATION]. We will respond within the timelines prescribed by applicable law and explain any lawful limitation. We may request proportionate information to verify a request and protect another person’s data.

You can change device permissions for location, camera, microphone, photos and notifications through your device settings. Disabling a permission may make the related feature unavailable. Marketing opt-out does not stop essential service, security, billing or legal notices.

11. Children and suspected minors

HABIBTI is for adults aged 18+. We do not knowingly allow children to create accounts. If we learn that a person under 18 has provided personal data, we will restrict the account, assess immediate safety risks, and delete data as required by applicable law, while preserving only information lawfully necessary for safety, investigations or legal obligations. Report concerns at [SAFETY / CHILD-SAFETY CONTACT TO BE PROVIDED BEFORE PUBLICATION].

12. Cookies, SDKs and analytics

The website may use essential cookies for security, session management and preferences, and optional analytics or advertising technologies if implemented. The app may use SDKs that collect device or usage data. Before launch, maintain a cookie/SDK inventory, identify each provider and purpose, configure consent where required, provide opt-out controls where applicable, and avoid non-essential tracking before required consent.

13. AI, recommendations and automated processing

HABIBTI may use automated systems to recommend profiles, rank content, detect spam or fraud, moderate content, assist support or power optional relationship/conversation features. The exact features active at any time must be listed in an in-product notice. Automated outputs may be inaccurate or incomplete and must not be presented as a guaranteed assessment of a person’s character, mental health, compatibility or safety.

Do not use private messages, sensitive inferences, face images or user content to train general-purpose AI models unless the purpose, lawful basis, provider terms, retention, user choice and safeguards have been specifically assessed and clearly disclosed. Users must not be misled into believing AI-generated content was written by a human. Provide a route to challenge consequential moderation decisions and human review where required or appropriate.

14. Public posts, screenshots and third-party links

Public Community posts may be indexed, copied, captured or shared by other users. Deleting a post removes it from active display but cannot guarantee removal of screenshots, copies, cached material or content already lawfully disclosed. Avoid posting sensitive personal information. Third-party websites and services have their own policies.

15. Changes to this Privacy Policy

We may update this notice as the service or law changes. We will publish the new version and date and provide additional notice or seek renewed consent where required. Material changes to purposes, categories, sharing or rights must not be hidden in a routine update.

16. Privacy contact

Data fiduciary/controller entity: HABIBTI DATING PRIVATE LIMITED (CIN: U18200RJ2026PTC114818) | Registered office: C-160 Vardhman Sarovar, Opp Heera Path Petrolpump, Mansarovar, Jaipur, Rajasthan, 302020 | Privacy contact: [PRIVACY CONTACT NAME / TITLE TO BE PROVIDED BEFORE PUBLICATION] | Email: [PRIVACY CONTACT DETAILS TO BE PROVIDED BEFORE PUBLICATION] | Grievance Officer: [GRIEVANCE OFFICER DETAILS TO BE PROVIDED BEFORE PUBLICATION].