Privacy Policy

1. INTERPRETATION AND DEFINITIONS

1.1 Interpretation

For the purposes of this Privacy Policy, the following capitalized terms shall have the meanings ascribed to them hereinbelow, unless the context expressly requires otherwise. The headings and sub-headings are included for convenience and identification purposes only and shall not be deemed to construe, limit, or describe the scope or intent of any provision of this Privacy Policy.

1.2 Definitions

• "Account" means a unique account created for You to access our Service or parts of our Service.
• "Affiliate" means an entity that controls, is controlled by, or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest, or other securities entitled to vote for election of directors or other managing authority.
• "Application" or "Platform" means the OnlyPal software program provided by the Company downloaded by You on any electronic device.
• "Applicable Law" means all applicable laws, statutes, regulations, rules, ordinances, codes, orders, decrees, judgments, injunctions, or legally binding directives of any governmental authority having jurisdiction.
• "Company" (referred to as either "the Company," "ByteFrost Technologies," "We," "Us," or "Our" in this Agreement) refers to ByteFrost Technologies, the parent entity operating the OnlyPal Platform.
• "Cookies" means small files that are placed on Your computer, mobile device, or any other device by a website, containing the details of Your browsing history on that website among its many uses.
• "Data Controller" means the natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any Personal Data are, or are to be, processed.
• "Data Processor" means any natural or legal person who processes the data on behalf of the Data Controller.
• "Data Subject" means any living individual who is the subject of Personal Data.
• "Device" means any device that can access the Service such as a computer, a cellphone, or a digital tablet.
• "End User" or "User" means any natural person who accesses, uses, or interacts with the Platform, including but not limited to "Sharers" (service recipients) and "Pals" (service providers).
• "GDPR" means the General Data Protection Regulation (EU) 2016/679.
• "Personal Data" means any information relating to an identified or identifiable natural person ('Data Subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
• "Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• "Sensitive Personal Data or Information" ("SPDI") means Personal Data consisting of information relating to: passwords; financial information such as bank account, credit card, debit card, or other payment instrument details; physical, physiological, and mental health condition; sexual orientation; medical records and history; biometric information; any detail relating to the above as provided to or received by the Company for processing or storage.
• "Service Provider" means any natural or legal person who processes the data on behalf of the Company.
• "Third-Party Social Media Service" means any services or content (including data, information, products, or services) provided by a third party that may be displayed, included, or made available by the Service.
• "Usage Data" refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• "You" means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

2. DATA CONTROLLER AND GOVERNING LAW

ByteFrost Technologies, operating as the parent entity for OnlyPal, acts as the Data Controller for all Personal Data collected, processed, and stored through the Platform. This Privacy Policy is governed by and shall be construed in accordance with the laws of India, including but not limited to:

• The Information Technology Act, 2000 ("IT Act");
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules");
• The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
• To the extent applicable, the General Data Protection Regulation (EU) 2016/679 ("GDPR") for users located in the European Economic Area;
• To the extent applicable, the California Consumer Privacy Act of 2018 ("CCPA") and California Privacy Rights Act of 2020 ("CPRA") for residents of California, United States;
• Any other Applicable Laws pertaining to data protection and privacy.

3. SCOPE AND APPLICABILITY

This Privacy Policy applies to all Users of the OnlyPal Platform, including:

• Sharers: Individual users seeking advisory, consultative, or communicative services;
• Pals: Verified service providers offering expertise through voice calls and chat messaging;
• Visitors: Any individual accessing our website or Platform without creating an Account.

By accessing, browsing, or otherwise using the Platform, You expressly consent to the collection, processing, storage, disclosure, and transfer of Your Personal Data as described herein. If You do not agree to the terms of this Privacy Policy, You must immediately cease all use of the Platform and refrain from submitting any Personal Data.

4. CATEGORIES OF PERSONAL DATA COLLECTED

4.1 Personal Data Provided Directly by Users

We collect the following categories of Personal Data that You voluntarily provide when using our Platform:

4.1.1 Account Registration Information

• Full legal name (first name and last name)
• Email address
• Telephone number
• Date of birth
• Gender identity
• Profile photograph (optional)
• Biographical information (optional)
• Language preferences (up to 5 languages)
• Interest categories (up to 5 topics)

4.1.2 Authentication Credentials

• Third-party authentication provider credentials
• Third-party authentication provider information
• Device identifiers and authentication tokens

4.1.3 Financial and Transaction Data (SPDI)

• Wallet balance information
• Payment method details (processed through third-party payment gateways)
• Transaction history and records
• Billing addresses
• Tax identification numbers (where applicable)
• Bank account information (for Pals receiving payouts)
• UPI IDs and payment gateway transaction identifiers

4.1.4 Pal-Specific Information

For users registering as Pals (service providers), additional information collected includes:

• Professional qualifications and certifications
• Areas of expertise and topic specializations
• Call rate per minute and chat rate per reply
• Professional biographical statement
• Verification documents (identification proof, address proof, professional credentials)
• Availability schedule and operational hours
• Performance metrics (rating, total calls, total chats, earnings)

4.1.5 Communication Content

• Text messages exchanged through the in-app chat feature
• Call metadata (duration, participants, connection quality) — call audio is not recorded
• Audio messages (if applicable)
• Reviews, ratings, and feedback
• Customer support correspondence

Chat messages and live voice calls are secured with end-to-end encryption; neither the Company nor its Service Providers can access call or chat content.

4.2 Automatically Collected Data

4.2.1 Usage Data

• Device information (manufacturer, model, operating system version)
• Internet Protocol (IP) address (collected in masked or truncated form to reduce identifiability)
• Browser type and version
• Pages visited, time and date of visits
• Time spent on pages
• Unique device identifiers
• Mobile network information
• Application performance metrics and crash logs

Masked IP collection helps prevent precise geo-location, reduces exposure of Your network information to other parties, and still allows us to detect fraud, abuse, and service disruptions.

4.2.2 Location Data

Subject to Your device settings and permissions, we collect:

• Exact location (GPS coordinates): When You grant location permissions, we track Your precise geographic coordinates in real-time
• Approximate location derived from IP address (country, region, city)
• Location history and movement patterns

Reasons for collecting location data:

• Fraud Prevention and Security: To detect and prevent fraudulent activities, account takeovers, and unauthorized access attempts by identifying unusual location patterns or logins from unexpected geographic locations
• Compliance and Legal Requirements: To comply with applicable laws and regulations, including Know Your Customer (KYC) requirements, anti-money laundering (AML) statutes, and jurisdictional restrictions that may apply to certain services
• User Safety and Verification: To verify user identity, prevent account sharing, and ensure the safety and security of all Platform users by detecting suspicious or potentially harmful behavior
• Service Optimization: To optimize network routing, improve call quality, and enhance service delivery based on geographic distribution of users
• Content Moderation: To assist in content moderation efforts and enforce Terms of Service violations that may be location-specific

You can control location permissions through Your device settings, though disabling location access may limit certain security features and fraud prevention capabilities.

4.2.3 Device Permissions

The Application may request access to:

• Microphone (for voice calling functionality)
• Camera (for profile photo upload)
• Storage (for media access and caching)
• Notification permissions
• Network state and connectivity information

4.3 Tracking Technologies and Cookies

We employ Cookies and similar tracking technologies to monitor activity on our Service and store certain information. Technologies utilized include:

• Session Cookies: To operate and authenticate Users
• Persistent Cookies: To remember User preferences
• Security Cookies: For security and fraud prevention purposes
• Analytics Cookies: To understand Service usage patterns
• Analytics Services: To collect aggregated usage statistics
• Web Analytics: To analyze web traffic (where applicable)

5. LEGAL BASIS FOR PROCESSING PERSONAL DATA

We process Your Personal Data on the following lawful grounds:

5.1 Contractual Necessity

Processing is necessary for the performance of our contract with You to provide the Platform services, including Account creation, facilitating connections between Sharers and Pals, processing payments, and delivering communication features.

5.2 Consent

Where You have provided explicit, informed, and freely given consent for specific processing activities, including the processing of SPDI, marketing communications, and optional features.

5.3 Legitimate Interests

Processing is necessary for our legitimate business interests, including:

• Fraud detection and prevention
• Network and information security
• Service improvement and optimization
• Internal analytics and business intelligence
• Enforcement of Terms of Service

5.4 Legal Obligations

Processing is necessary to comply with legal obligations imposed by Applicable Law, including tax regulations, Know Your Customer (KYC) requirements, anti-money laundering (AML) statutes, and judicial orders.

5.5 Vital Interests

Processing is necessary to protect the vital interests of You or another natural person, particularly in emergency situations.

6. PURPOSES OF DATA PROCESSING

The Company processes Your Personal Data for the following purposes:

6.1 Service Provision and Account Management

• To create and manage Your Account on the Platform
• To authenticate and verify Your identity
• To provide, maintain, and improve the Platform's functionality
• To facilitate connections between Sharers and Pals
• To enable voice calling and chat messaging features
• To process financial transactions and maintain wallet functionality

6.2 Communication and Customer Support

• To provide customer support and respond to inquiries
• To send transactional communications (call notifications, chat messages, payment confirmations)
• To deliver service announcements and updates
• To send push notifications (subject to Your preferences)

6.3 Safety, Security, and Compliance

• To detect, prevent, and address technical issues
• To investigate and prevent fraudulent transactions and unauthorized access
• To enforce our Terms of Service and Community Guidelines
• To comply with legal obligations and respond to lawful requests from authorities
• To verify the identity and credentials of Pals

6.4 Analytics and Service Improvement

• To analyze usage patterns and trends
• To conduct research and development for service enhancement
• To measure the effectiveness of features
• To optimize user experience and interface design

6.5 Marketing and Promotional Activities

Subject to Your consent and preferences:

• To send promotional materials and special offers
• To conduct marketing campaigns
• To provide personalized recommendations

6.6 Payment Processing

• To process wallet top-ups and recharges
• To calculate and deduct charges for calls and chats
• To facilitate payouts to Pals
• To maintain transaction records for accounting and tax purposes

6.7 Ratings and Reviews

• To collect and display User ratings and reviews
• To maintain reputation systems for quality assurance
• To facilitate informed decision-making by Users

7. DATA SHARING AND DISCLOSURE

7.1 Sharing with Other Users

Certain Personal Data is visible to other Users of the Platform:

• Pal Profiles: Name, profile photo, bio, interests, languages, ratings, reviews, call/chat rates, and availability status are visible to all Sharers
• Sharer Information: Limited information (first name, profile photo) may be visible to Pals during active sessions
• Reviews and Ratings: Your reviews and ratings may be publicly displayed with Your first name

7.2 Service Providers and Third-Party Partners

We engage Service Providers and third-party partners who process Personal Data on our behalf, subject to appropriate data protection agreements:

7.2.1 Technology Infrastructure Providers

• Backend services, authentication, analytics, and cloud storage providers
• Data hosting and cloud computing service providers

7.2.2 Payment Service Providers

• Payment gateway providers for processing transactions
• Banking institutions for fund transfers and payouts
• Payment fraud detection services

7.2.3 Analytics and Performance Monitoring

• Usage analytics and crash reporting services
• Web analytics services (if applicable)

7.2.4 Communication Services

• Email service providers for transactional emails
• SMS gateway providers for OTP and notifications
• Push notification services

7.2.5 Customer Support Tools

• Customer relationship management (CRM) platforms
• Help desk and ticketing systems

7.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, Your Personal Data may be transferred to the successor entity. You will be notified via email and/or prominent notice on the Platform of any such change in ownership or control of Your Personal Data.

7.4 Legal Requirements and Law Enforcement

We may disclose Your Personal Data if required to do so by law or in response to:

• Valid legal processes (subpoenas, court orders, search warrants)
• Requests from governmental authorities or law enforcement agencies
• National security or law enforcement requirements
• Investigations of potential violations of our Terms of Service
• Circumstances involving potential threats to the physical safety of any person

7.5 Aggregated and Anonymized Data

We may share aggregated, de-identified, or anonymized data that cannot reasonably be used to identify You with third parties for research, marketing, analytics, or other purposes. Such data is not considered Personal Data under this Privacy Policy.

7.6 No Sale of Personal Data

The Company does not sell, rent, or trade Your Personal Data to third parties for monetary consideration. Any sharing of data with Service Providers is conducted pursuant to appropriate data processing agreements and for the specific purposes outlined in this Privacy Policy.

7.7 No Third-Party Advertising

We do not display third-party advertisements on our Platform. We are committed to providing a premium, distraction-free experience. We do not share your Personal Data with third-party advertisers or ad networks for their marketing purposes.

8. INTERNATIONAL DATA TRANSFERS

Your Personal Data may be transferred to, processed, and stored in jurisdictions outside Your country of residence where data protection laws may differ from those in Your jurisdiction. Such transfers are conducted in accordance with Applicable Law and appropriate safeguards, including:

• Standard Contractual Clauses approved by the European Commission (for transfers from the EEA)
• Adequacy decisions by relevant data protection authorities
• Binding Corporate Rules
• Consent, where required by Applicable Law

By using the Platform, You acknowledge and consent to such international transfers of Your Personal Data.

9. DATA RETENTION

The Company retains Your Personal Data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by Applicable Law.

9.1 Retention Periods

• Account Data: Retained for the duration of Your Account and for a reasonable period thereafter (typically 90 days) to facilitate Account reactivation
• Transaction Records: Retained for a minimum of 7 years in compliance with tax and financial regulations
• Communication Content: Chat messages retained for 180 days; call metadata (no audio recordings) retained for 1 year
• Usage Data and Logs: Retained for 18 months for security and analytics purposes
• Marketing Communications: Retained until You opt out or withdraw consent
• Verification Documents: Retained for the duration of Pal status and 3 years thereafter

9.2 Secure Deletion

Upon expiration of the applicable retention period, Personal Data is securely deleted or anonymized in accordance with industry best practices and Applicable Law. Deletion methods include secure overwriting, cryptographic erasure, and physical destruction of storage media where appropriate.

10. SECURITY OF PERSONAL DATA

The Company implements reasonable security practices and procedures as mandated by the SPDI Rules and international standards to protect Personal Data against unauthorized access, alteration, disclosure, or destruction.

10.1 Technical and Organizational Measures

• Encryption: Data in transit is encrypted using industry-standard protocols; sensitive data at rest is encrypted using industry-standard encryption standards
• End-to-End Protection: Chat messages and live voice calls use end-to-end encryption, so only participants can access content
• Access Controls: Role-based access controls (RBAC) and multi-factor authentication (MFA) for administrative access
• Network Security: Firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS)
• Regular Security Audits: Periodic vulnerability assessments and penetration testing
• Data Minimization: Collection and retention limited to what is strictly necessary
• Pseudonymization: Where feasible, pseudonymization techniques are employed
• Incident Response: Documented incident response procedures and data breach notification protocols
• Employee Training: Regular training on data protection and security best practices

10.2 Limitation of Security

While we strive to protect Your Personal Data, no method of transmission over the Internet or electronic storage is 100% secure. Therefore, we cannot guarantee absolute security. You acknowledge and accept the inherent security risks of providing information online and will not hold us liable for any breach of security beyond our reasonable control.

10.3 Account Security

You are responsible for maintaining the confidentiality of Your Account credentials and for all activities occurring under Your Account. You agree to notify us immediately of any unauthorized access or use of Your Account.

11. YOUR RIGHTS AND CHOICES

11.1 General Rights

Subject to Applicable Law, You have the following rights regarding Your Personal Data:

11.1.1 Right of Access

You have the right to request confirmation of whether we process Your Personal Data and to obtain a copy of such data in a structured, commonly used, and machine-readable format.

11.1.2 Right to Rectification

You have the right to request correction of inaccurate Personal Data and completion of incomplete data.

11.1.3 Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of Your Personal Data where:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Erasure is required to comply with a legal obligation

11.1.4 Right to Restriction of Processing

You have the right to request restriction of processing where:

• You contest the accuracy of the Personal Data
• Processing is unlawful but You oppose erasure
• We no longer need the data but You require it for legal claims
• You have objected to processing pending verification

11.1.5 Right to Data Portability

You have the right to receive Your Personal Data in a structured, commonly used, machine-readable format and to transmit that data to another controller without hindrance.

11.1.6 Right to Object

You have the right to object to processing of Your Personal Data based on legitimate interests or for direct marketing purposes.

11.1.7 Right to Withdraw Consent

Where processing is based on consent, You have the right to withdraw such consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

11.1.8 Right Not to be Subject to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning You or similarly significantly affect You.

11.2 GDPR-Specific Rights (EEA Users)

If You are located in the European Economic Area (EEA), You have additional rights under the GDPR, including:

• The right to lodge a complaint with a supervisory authority
• Enhanced rights regarding automated decision-making and profiling
• Specific requirements for consent (explicit, informed, freely given)

11.3 CCPA/CPRA Rights (California Residents)

If You are a California resident, You have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of categories and specific pieces of Personal Information collected
• Right to Delete: Request deletion of Personal Information
• Right to Opt-Out: Opt-out of the sale or sharing of Personal Information (Note: We do not sell Personal Information)
• Right to Correct: Request correction of inaccurate Personal Information
• Right to Limit Use of Sensitive Personal Information: Limit use of Sensitive Personal Information
• Right to Non-Discrimination: Not be discriminated against for exercising these rights

11.4 Exercising Your Rights

To exercise any of the rights described above, please contact us using the contact information provided in Section 16. We will respond to Your request within the timeframes mandated by Applicable Law:

• GDPR: Within 30 days (extendable by 60 days for complex requests)
• CCPA/CPRA: Within 45 days (extendable by 45 days)
• Indian Law: Within 30 days

We may require verification of Your identity before processing Your request. We will not discriminate against You for exercising Your rights.

11.5 Marketing Preferences

You may opt-out of receiving promotional communications by:

• Following the unsubscribe instructions in emails
• Adjusting notification settings in the Application
• Contacting us directly

Please note that even if You opt-out of promotional communications, we may still send You transactional or service-related communications.

12. CHILDREN'S PRIVACY

The Platform is not intended for use by individuals under the age of 18 years ("Minors"). We do not knowingly collect Personal Data from Minors. If You are a parent or guardian and become aware that Your child has provided us with Personal Data without Your consent, please contact us immediately. If we become aware that we have collected Personal Data from Minors without verification of parental consent, we will take steps to delete such information from our servers promptly.

13. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites, services, or applications that are not owned or controlled by the Company. This Privacy Policy does not apply to third-party services. We are not responsible for the privacy practices of such third parties. We encourage You to review the privacy policies of any third-party services You access.

13.1 Third-Party Authentication

When You use third-party authentication services, You authorize us to collect authentication information (such as Your name, email address, and profile picture) as permitted by the third-party service's terms and privacy policy.

14. CHANGES TO THIS PRIVACY POLICY

We reserve the right to modify, amend, or update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. Changes will be effective immediately upon posting the updated Privacy Policy on the Platform, with the "Last Updated" date revised accordingly.

14.1 Material Changes

For material changes that significantly affect Your rights or our data processing practices, we will provide prominent notice through:

• Email notification to the email address associated with Your Account
• In-app notification upon next login
• Prominent banner on the Platform

Continued use of the Platform following notice of changes constitutes Your acknowledgment and acceptance of the updated Privacy Policy. If You do not agree to the changes, You must discontinue use of the Platform and may request deletion of Your Account and Personal Data.

15. GRIEVANCE REDRESSAL MECHANISM

In accordance with the Information Technology Act, 2000, and the SPDI Rules, the Company has designated a Grievance Officer to address complaints regarding Personal Data processing.

15.1 Grievance Officer

You may contact the Grievance Officer regarding any discrepancies, grievances, or concerns related to the processing of Your Personal Data. The Grievance Officer will acknowledge Your complaint within 48 hours and endeavor to resolve the matter within 30 days of receipt.

16. CONTACT INFORMATION

If You have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

17. CONSENT

By accessing and using the OnlyPal Platform, You expressly consent to:

• The collection, processing, storage, and disclosure of Your Personal Data as described in this Privacy Policy;
• The processing of Sensitive Personal Data or Information (SPDI) where applicable;
• The transfer of Your Personal Data to third-party Service Providers and across international borders as necessary for the provision of Services;
• The use of Cookies and tracking technologies as described herein;
• Receiving communications from us as described in this Privacy Policy.

You acknowledge that You have read, understood, and agree to be bound by this Privacy Policy. You further acknowledge that Your consent is freely given, specific, informed, and unambiguous.

18. SEVERABILITY

If any provision of this Privacy Policy is found to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it enforceable, or if such modification is not possible, severed from this Privacy Policy. The remaining provisions shall remain in full force and effect.

19. WAIVER

No waiver of any term or provision of this Privacy Policy shall be deemed a further or continuing waiver of such term or any other term, and our failure to assert any right or provision under this Privacy Policy shall not constitute a waiver of such right or provision.

20. ENTIRE AGREEMENT

This Privacy Policy, together with our Terms of Service and any other legal notices published by us on the Platform, constitutes the entire agreement between You and the Company concerning the processing of Your Personal Data.

21. DISPUTE RESOLUTION AND JURISDICTION

Any disputes arising out of or relating to this Privacy Policy shall be governed by the laws of India. Subject to Section 15 (Grievance Redressal), You agree that any disputes shall be subject to the exclusive jurisdiction of the courts located in [City to be specified], India.