Privacy Policy — KaraKundali

Before publishing: replace every [BRACKETED] placeholder with your registered entity name, address, GSTIN and grievance officer details. Have a lawyer review this — particularly the palm-photograph and DPDP sections, since palm creases are biometric data and that carries obligations beyond ordinary personal data.

The short version. We collect your name, contact details and birth information because a chart cannot be calculated without them. If you send palm photographs, we analyse them and delete them after 30 days. We never sell your data. You can delete everything at any time, and we will actually delete it.

1. Who we are

KaraKundali is operated by [REGISTERED ENTITY NAME], [REGISTERED ADDRESS], India. For any privacy question, contact [PRIVACY EMAIL].

Under India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described below, and you are the Data Principal.

2. What we collect, and why

Data	Why we need it	How long we keep it
Name, email, mobile number	To create and secure your account, and to send your report	Until you delete your account
Password	Authentication. Stored only as a cryptographic hash — we cannot read it	Until you delete your account
Date, time and place of birth	These three values are the chart. Without an exact time the Ascendant and all twelve houses cannot be placed, and we withhold those sections rather than guess	Until you delete your account
Palm photographs	To measure crease geometry and image quality	30 days, then deleted automatically
Generated reports (PDF)	So you can re-download what you paid for	180 days
Third-party calculation responses	An audit trail, so any figure in your report can be traced to its source	90 days
WhatsApp messages you send us	To run the conversation and avoid processing the same message twice	Until you delete your account
Payment records	Legal and tax obligation	As required by Indian tax law, typically 8 years

Sensitive data: your palm photographs

Palm creases are biometric characteristics. We treat these photographs as sensitive personal data. They are used solely to produce your reading, are never used to identify you, are not used to train any model, and are deleted automatically after 30 days.

If we ever wish to use customer palm photographs to train a model, we will ask for your separate, explicit consent first. Consenting to a reading is not consent to training.

3. How your data is protected

Sensitive fields are encrypted at rest. Names, contact details, birth details and coordinates are stored encrypted, not in plain text.
Transport is encrypted. All traffic uses HTTPS.
Payment details never reach us. Card and UPI details are handled entirely by Razorpay. We store only an order reference and payment status.
Webhooks are signature-verified before any data is accepted.

4. Who we share data with

We do not sell your personal data, and we do not share it for advertising. We share the minimum necessary with these processors:

Service	What it receives	Why
Prokerala	Birth date, time and coordinates — not your name or contact details	Independent astronomical calculation, used to cross-check our own
OpenStreetMap / Nominatim	The birthplace text you type	To convert a place name into coordinates and a historical timezone
Razorpay	Order amount and reference; your contact details at checkout	To take payment
Meta (WhatsApp Business Platform)	Your WhatsApp number and the messages you exchange with us	To deliver the service over WhatsApp
[EMAIL PROVIDER]	Your email address	Verification codes and transactional email

Each operates under its own privacy policy. We do not transfer your data outside India except as necessary for these services to function.

5. Your rights

Under the DPDP Act you may:

Access the personal data we hold about you — request an export from your account, or by email.
Correct anything inaccurate. Birth details matter especially: an error of a few minutes changes the chart.
Erase everything. Send DELETE on WhatsApp, or use account deletion. This removes your birth records, palm images and reports. It is not reversible.
Withdraw consent at any time.
Complain to our Grievance Officer, and then to the Data Protection Board of India if unsatisfied.

Grievance Officer: [NAME], [EMAIL], [PHONE]. We respond within 30 days.

6. Children

KaraKundali is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has registered, contact us and we will delete the account.

7. Cookies

We use only what the service needs to work: a session cookie to keep you signed in and a CSRF token to protect your account. We do not use advertising or tracking cookies.

8. Changes

If we change this policy materially we will notify you by email or in the app before the change takes effect.