Privacy Policy

Introduction

Kundlo ("we", "us", "our", or "the Service") is a Vedic astrology AI assistant operated via WhatsApp and accessible through the website www.kundlo.com. Kundlo is provided by Kundlo("the Company", "Data Controller").

This Privacy Policy describes what personal information we collect, how we use it, who we share it with, how long we keep it, and the rights you have over your data. By tapping "I Agree" to this Privacy Policy and the accompanying Terms of Service, you acknowledge that you have read, understood, and consented to the practices described below.

This Privacy Policy is published in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), which requires publishing of privacy policies for the collection, use, storage, management, and transfer of personal data.

Data Controller

• ◆Company: Kundlo
• ◆Website: www.kundlo.com
• ◆WhatsApp: Coming Soon
• ◆Email: privacy@kundlo.com

For all matters relating to your personal data, please contact us at the email above.

Information We Collect

Information You Provide Directly

• ◆Identity Data: Your name as provided to WhatsApp or as you tell us in chat (first name, last name, nickname)
• ◆Contact Data: Your WhatsApp phone number (E.164 format, e.g., +91XXXXXXXXXX)
• ◆Birth & Astrological Data: Date of birth, exact time of birth, city/place of birth, gender (required for astrological chart computation)
• ◆Conversation Data: The questions, messages, and information you send us (career, relationships, health, family member names, life situations)
• ◆Profile Data: Birth profiles you create for yourself or family members (names, birth details, and relationship labels such as "mother," "wife," "son")

Information Collected Automatically

• ◆WhatsApp Metadata: Sender name, message timestamps, message identifiers, and webhook payload metadata received from WhatsApp/Meta
• ◆Transaction Data: Payment IDs, order IDs, plan purchased, and wallet/points balance (processed via Razorpay)
• ◆Usage Data: Profile access frequency, feature usage counts, conversation session identifiers

Information We Do NOT Collect

We want to be explicit about what we do not collect:

• ◆We do not collect or store credit card, debit card, UPI, or bank account numbers. All payments are processed by Razorpay, and we only receive payment confirmation and transaction IDs.
• ◆We do not use cookies, web beacons, or browser tracking technologies. We have no analytics SDK, crash reporter, or advertising tracker on our Service.
• ◆We do not collect device identifiers, IP addresses, browser fingerprints, or geolocation data from your device.
• ◆We do not collect your email address unless you voluntarily provide it for support purposes.

How We Use Your Information

We process your personal data for the following specific purposes:

• ◆Providing astrological readings and chart computations: Birth data, profile data, conversation data (Your consent)
• ◆Responding to your questions: Conversation data, birth data, derived chart data (Your consent)
• ◆Generating PDF astrology reports: Birth data, chart data, name, conversation context (Your consent)
• ◆Creating and managing family member profiles: Profile data for each person you add (Your consent)
• ◆Compatibility (Milan) analysis: Birth data of both partners (Your consent - you represent that you have permission to share the other person's data)
• ◆Processing payments: Transaction data, wallet balance (Performance of a contract - your purchase of Kundlo Points)
• ◆Maintaining conversation history: Conversation data (up to 30 days - see Data Retention section) (Your consent)
• ◆Improving AI response quality: Anonymized conversation patterns (not individual identifiable data) (Our legitimate interest in service improvement)
• ◆Compliance with legal obligations: Any relevant data (Legal obligation under applicable law)

Special Sensitivity of Birth Data

We want you to understand that birth data - specifically the combination of your date of birth, exact time of birth, and place of birth - is considered sensitive personal data. This combination can uniquely identify an individual with very high precision.

We process this data solely for the purpose of computing Vedic astrological charts and providing readings. We do not sell, rent, or trade this data to any third party for marketing, advertising, or any purpose other than providing the Service.

Third-Party Data Sharing

We share certain personal data with the following categories of third-party service providers who help us operate the Service. Each provider is bound by their own privacy and data protection commitments.

Cloud Database Provider

• ◆Provider: Supabase (managed PostgreSQL database)
• ◆Data shared: All data described above (identity, contact, birth, conversation, profile, transaction, consent data)
• ◆Purpose: Primary data storage and retrieval
• ◆Location: Cloud-hosted (region configurable)

Messaging Platform

• ◆Provider: WhatsApp / Meta Platforms, Inc.
• ◆Data shared: Your phone number, sender name, all messages you send to us, and all messages/reports we send back to you (including PDF attachments)
• ◆Purpose: The Service operates through WhatsApp. Meta processes message delivery and may retain data per their own policies.
• ◆Meta's Privacy Policy: https://www.whatsapp.com/legal/privacy-policy

AI / LLM Providers

• ◆Providers: DeepSeek (default), Anthropic, Groq, OpenAI, and/or Google Gemini
• ◆Data shared: Birth data, profile data, and conversation messages
• ◆Purpose: AI-powered astrological analysis and conversation generation
• ◆Important: These providers may be located outside of India. Your birth data and conversation content are transmitted to and processed by these providers. By consenting to this Privacy Policy, you acknowledge and agree to this cross-border transfer of your data.
• ◆Provider privacy policies:DeepSeek,Anthropic,Groq,OpenAI,Google Gemini

Payment Processor

• ◆Provider: Razorpay
• ◆Data shared: Your user ID, the plan you are purchasing, and the payment amount. No card, bank, or UPI details are shared with or stored by us.
• ◆Purpose: Processing payments for Kundlo Points subscription plans
• ◆Razorpay Privacy Policy: https://razorpay.com/privacy/

Geocoding Service

• ◆Provider: Open-Meteo
• ◆Data shared: City name only (the place of birth you specify)
• ◆Purpose: Converting a city name into geographic coordinates and timezone for astrological chart computation
• ◆Note: Only city names within India are processed through this service.

We Do NOT Share Data With

• ◆We do not sell your personal data to any third party.
• ◆We do not share your data with advertising or marketing networks.
• ◆We do not share your data with data brokers.
• ◆We do not share your data with any party for their independent commercial purposes.

Cross-Border Data Transfer

Your personal data is processed and stored across multiple jurisdictions:

• ◆Birth data, conversation data: Transferred to AI/LLM providers (potentially located outside India - including but not limited to the United States, the United Kingdom, and other regions)
• ◆Messages, phone number: Transferred to Meta/WhatsApp (United States and other regions)
• ◆City name: Transferred to Open-Meteo geocoding service
• ◆All stored data: Stored in Supabase (cloud-hosted PostgreSQL)

By using Kundlo and consenting to this Privacy Policy, you explicitly consent to the transfer and processing of your personal data, including sensitive birth data, to and in jurisdictions outside India, including jurisdictions that may have different data protection standards than India.

Data Retention

We retain your personal data for the following periods:

• ◆Conversation history (chat messages): Up to 30 days from the date of the message. We retain your conversation history for up to 30 days so that the AI assistant can reference your recent questions and provide a contextual, continuous experience. Messages older than 30 days may be summarized (condensed into a brief summary) rather than stored verbatim, or may be permanently deleted at our discretion.
• ◆Birth profile data: Retained for the lifetime of your account. Required for ongoing astrological chart computation and readings.
• ◆Computed astrological charts: Retained for the lifetime of your account. Cached to avoid recomputation; derived entirely from birth data.
• ◆PDF report data: Retained for the lifetime of your account. So you can request reports without regeneration delays.
• ◆Wallet & transaction records: Retained for the lifetime of your account + 7 years. Required for financial audit, tax compliance, and dispute resolution.
• ◆Consent records: Retained for the lifetime of your account + 7 years. Legal audit trail of your consent and any withdrawal.
• ◆WhatsApp metadata: Retained for the lifetime of your account. Audit and account recovery.
• ◆Cached data (Redis): Ephemeral - automatically expires within hours. Performance optimization only.
• ◆Server logs (stdout): Not persisted to long-term storage. Operational logging only; not written to permanent storage.

Conversation Summarization

When your conversation history exceeds 30 days or becomes very long, older messages may be processed by our AI to create a summarythat retains the key context (e.g., "the user asked about career prospects and was advised to focus on Saturn dasha"). The original verbatim messages may then be deleted while the summary is retained. This allows the assistant to maintain continuity without storing indefinite raw chat history.

Account Deletion

If you request account deletion, we will delete your personal data as follows:

• ◆Birth profiles, charts, reports, conversation data: Deleted within 30 days of verification.
• ◆Wallet & transaction records: Retained for 7 years as required by Indian tax and financial regulations.
• ◆Consent audit records: Retained for 7 years for legal compliance.

Data Security

We implement the following security measures to protect your personal data:

• ◆Encryption in transit: All API communications use HTTPS/TLS encryption
• ◆Encryption at rest: Database (Supabase/PostgreSQL) encrypts data at rest
• ◆Access control: Database accessed via service-role credentials; no public read/write access
• ◆Webhook verification: All inbound WhatsApp and Razorpay webhooks are HMAC-signature-verified to prevent spoofing
• ◆No card data storage: We never receive, process, or store payment card data (Razorpay handles this entirely)
• ◆No third-party analytics: No tracking SDKs, analytics pixels, or advertising libraries
• ◆Key management: API keys and credentials stored as environment variables, never committed to source code
• ◆Row-Level Security: Database tables have RLS policies enabled

Despite these measures, no system can be guaranteed to be 100% secure. We will notify you and the relevant authorities of any data breach affecting your personal data in accordance with applicable law, including the Digital Personal Data Protection Act, 2023 (DPDP Act).

Your Rights

Under the Digital Personal Data Protection Act, 2023 (India) and, where applicable, the GDPR (EU) and other data protection laws, you have the following rights:

• ◆Right to Access: Request a copy of the personal data we hold about you. Email us with "Data Access Request" in the subject line.
• ◆Right to Correction: Request correction of inaccurate or incomplete data. Email us specifying the correction needed.
• ◆Right to Erasure: Request deletion of your personal data (subject to legal retention obligations for financial records). Email us with "Data Deletion Request" in the subject line.
• ◆Right to Withdraw Consent: Withdraw your consent to data processing at any time. Tap the "Withdraw Consent" button in WhatsApp (available via the consent flow), or email us. Withdrawal does not affect the lawfulness of processing before withdrawal.
• ◆Right to Grievance: File a grievance if you believe your data rights have been violated. Email us with "Grievance" in the subject line. We will respond within 30 days.
• ◆Right to Nominate: Nominate another individual to exercise your rights in the event of death or incapacity. Email us with nomination details.

Important Note on Consent Withdrawal

When you withdraw consent:

• ◆You will be re-gated - you will need to agree to the Privacy Policy and Terms again before using the Service.
• ◆Your consented-at timestamp and policy version are retained as an audit trail.
• ◆Your data is not automatically deleted upon consent withdrawal. To have your data deleted, you must submit a separate Data Deletion Request as described above.
• ◆Certain data (financial transaction records) will be retained for 7 years regardless of consent withdrawal, as required by Indian law.

Children's Data

Our Service is not directed at children under the age of 18. We do not knowingly collect personal data from individuals under 18.

However, you may create birth profiles for minors (e.g., your children) within your account for astrological purposes. By creating such a profile, you confirm that:

• ◆You are the parent or legal guardian of the minor.
• ◆You consent to the processing of the minor's birth data for astrological purposes.
• ◆You have the legal authority to provide this consent on behalf of the minor.

Milan (Compatibility) - Second Person's Data

When you request a Milan (compatibility analysis) between two individuals, you will need to provide birth data for both partners. If the second person is not the account holder (i.e., they have not consented to this Privacy Policy):

• ◆You represent and warrant that you have obtained the second person's consent to share their birth data with Kundlo for the purpose of compatibility analysis.
• ◆You are solely responsible for ensuring you have the legal right to share the second person's personal data.
• ◆Kundlo is not liable for any unauthorized sharing of a third party's birth data by an account holder.

Cookies and Tracking Technologies

We do not use cookies. We do not use web beacons, tracking pixels, advertising tags, or any similar technologies on our Service. Our Service is primarily a WhatsApp-based assistant and does not serve web pages that set cookies.

If you visit our website (www.kundlo.com), no cookies are used as our Service is WhatsApp-based and does not require browser tracking technologies.

Automated Decision-Making and AI Processing

Kundlo uses artificial intelligence (including large language models) to generate astrological readings, analyze charts, and respond to your questions. You should be aware that:

• ◆All astrological content is generated by AI based on Vedic astrology principles and planetary computations.
• ◆The AI processes your birth data and conversation history to produce personalized responses.
• ◆AI-generated content may not always be accurate and should not be relied upon for important life decisions (see the Terms of Service for full disclaimers).
• ◆You have the right to request human review of any AI-generated content that you believe is harmful or incorrect. Contact us to request such a review.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do:

• ◆We will increase the version number (currently 1.0.0).
• ◆If the changes are material (i.e., they change what data we collect, how we use it, or who we share it with), we will require you to re-consent by presenting the updated policy and asking you to agree again before you can continue using the Service.
• ◆If the changes are immaterial (minor clarifications, formatting, contact details), we will update the policy without requiring re-consent.
• ◆The effective date at the top of this document will be updated.
• ◆We will retain the previous version of the policy for audit purposes.

Grievance Officer

As required under the DPDP Act, 2023, we have designated a Grievance Officer:

• ◆Name: Kundlo Team
• ◆Email: grievance@kundlo.com
• ◆Response time: Within 30 working days of receiving a complaint

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• ◆Email: privacy@kundlo.com
• ◆Website: www.kundlo.com/contact
• ◆WhatsApp: Message us directly within the app