Privacy Policy.

1. Who is responsible for your data

This Privacy Policy explains how Yurix Ventures Private Limited (CIN U62090UP2025PTC215977, registered office at Plot No. 73, Vishnu Lok, Kanpur Road, Lucknow, Uttar Pradesh 226023, India), operating the Jhatpat app, website and WhatsApp channel (the "Platform"), collects, uses, shares, stores and protects personal data. We are the data fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, and we comply with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 for as long as they apply. This policy covers customers, visitors to myjhatpat.com and, together with the Service Partner Privacy Notice, partners.

2. What we collect

• Account — mobile number (verified by OTP), name, gender (optional, used to honour partner-preference requests), email (optional, for receipts), preferred language, and whether you use customer mode, partner mode or both.
• Location and addresses — your saved addresses (house number, floor, landmark, receiver name and phone) and your device's precise location while the app is in use, to check serviceability, show nearby partners and shops, estimate distance fares and guide partners to your door. For partners, precise location is collected while you are online and during an active job — including in the background while a job is in progress — so customers can see your arrival and trips can be metered. Location collection stops when you go offline.
• Bookings and payments — services booked, options and answers you enter on a service page, timings, start codes, ratings and reviews, tips, refunds and payout history. Card, UPI and bank details are collected and stored by our payment partner Razorpay under its own policy; we store only the payment status, a masked identifier or the last four digits, and the UPI ID you give us for payouts.
• Care and household details — only what a booking needs: access instructions, a child's name and age band, a parent's mobility or dietary notes, an emergency contact, allergies relevant to a carer. These are entered by an adult account holder for a specific booking.
• Health-related information — only when you choose to upload a prescription for a medicine order or a note for a hospital-escort booking. It is shared solely with the pharmacy or partner fulfilling that booking and is never used for advertising or profiling.
• Partner verification — government identity document (Aadhaar is verified through DigiLocker or OTP and the full number is not stored in the app; only a masked reference and the verification result), live selfie, police-verification certificate where required, driving licence and vehicle registration for drivers and movers, shop, GST, PSARA, IRDAI, CPCB / SPCB or NGO registration details for the corresponding partner types, PAN where required for payouts, and training records.
• Communications — masked-number call logs (time and duration, not the content), in-app chat, WhatsApp messages you send to our official number, support tickets and grievance correspondence. Support calls may be recorded after notice at the start of the call.
• Photos, voice notes and documents — only those you choose to upload: a photo of an appliance fault, a voice note describing a task, a reference design, a prescription, a policy copy, photos of an item you are selling, or job photos and checklists captured by partners as proof of work.
• Device and usage data — device model and OS version, app version, a push-notification token, a device identifier, IP address, crash reports and product-analytics events (screens viewed, actions taken) that help us fix bugs, prevent fraud and improve the app.
• Job records — for partners: online hours, jobs offered, accepted and declined, arrival and completion times, checklist and photo proofs, earnings and payouts.

We do not collect your contacts, your SMS inbox (the OTP is read only through the Android SMS Retriever API, which delivers a single message addressed to the app), your call content, or precise location when the app is closed and you are not on an active partner job. We never ask for your UPI PIN, card PIN, CVV or banking password.

3. Where the data comes from

Directly from you; from your device with the permissions you grant; from the partner or shop involved in your booking (job photos, quotes, delivery status); from our payment, messaging, maps and analytics providers; and from lawful verification sources (DigiLocker, identity-verification vendors, IMEI / serial registries for buyback) where the service or the law requires it.

4. Why we use it and on what basis

We process personal data (a) with your consent, given when you create an account and grant device permissions, and (b) for the legitimate uses the DPDP Act allows when you have voluntarily provided data to obtain the service you asked for, to comply with law or to respond to a medical or safety emergency. Specifically, to:

• create and secure your account and verify your identity or partner credentials;
• show availability, prices and estimates for your address, and match your booking with a nearby partner;
• run the booking end to end — start code, live status, masked calls, quotes, checklists, payment, payouts, invoices and receipts;
• send booking updates by push notification, SMS and WhatsApp, and optional offers you can turn off in Account → Notifications;
• provide support, investigate complaints, disputes, safety incidents and fraud, and enforce our Terms;
• run the Jhatpat Assured programme — verification, ratings, quality checks and refunds;
• meet legal obligations — tax invoices, accounting records, responding to lawful requests from authorities, and the licence checks required for regulated services;
• establish, exercise or defend legal claims;
• improve the Platform through aggregated and, where possible, de-identified analytics.

We do not sell personal data, do not use it for third-party advertising, and do not make automated decisions with legal effects on you without human review. You may withdraw consent at any time (section 9); withdrawal does not affect processing already done and may stop a feature that needs that data.

5. Who we share it with

• The partner doing your booking sees your first name, the booking details you entered, the address, a masked phone number for the duration of the booking, and your rating history summary. Partners may use this only to perform the booking (section 4 of the Service Partner Terms). Customers see a partner's name, photo, rating, "ID verified" badge, languages and — for regulated services — the licence or registration reference (for example the PSARA licence or IRDAI registration number).
• Service providers (data processors) who act on our instructions — Razorpay (payments, payouts, refunds), Google Cloud and Firebase (hosting, authentication, push notifications, crash reporting), Google Maps Platform (maps, places, routes), Meta's WhatsApp Business Platform and SMS gateways (messages), DigiLocker and identity-verification providers (KYC), IMEI / serial registry providers (buyback checks), PostHog and Sentry (analytics and error monitoring), and cloud storage for photos and documents. Each is bound by contract to use the data only to provide its service to us.
• Licensed third parties who fulfil regulated services — security agencies, insurance professionals, pharmacies, recyclers and NGOs — receive the booking details needed to perform the service and are responsible for their own use of that data as independent data fiduciaries.
• Authorities and legal requirements — when required by law, court order or a lawful request, or to protect the safety of a customer, partner or the public.
• Professional advisers, auditors and insurers — under confidentiality, where needed to run the business or handle a claim.
• Business transfers — if Yurix Ventures Private Limited is merged, acquired or sells the Jhatpat business, personal data may be transferred to the successor under this policy.

Personal data is stored in India (Google Cloud, asia-south regions). Where a processor stores data outside India, we transfer only what the service requires, under contractual safeguards and only as permitted by Indian law.

6. How long we keep it

• Account and profile data: while your account is active, then deleted within 30 days of an account-deletion request, except as noted below.
• Booking, payment, invoice and payout records: 8 years after the transaction, as required by Indian tax and company law, then deleted or anonymised.
• Partner verification documents: while the partner is active and for 3 years after deactivation for dispute and regulatory purposes; Aadhaar numbers are never stored in full.
• Location trails: 30 days for active jobs (90 days for disputed jobs), then aggregated.
• Chat, call metadata, recordings and support tickets: 12 months after the booking closes, longer if a dispute, safety incident or legal matter is open.
• Prescriptions and care notes: 90 days after the booking closes, unless a dispute is open.
• Analytics and crash logs: 13 months, de-identified where possible.

7. How we protect it

Data is encrypted in transit (TLS) and at rest, access is limited to staff and processors who need it for their role and is logged, customer and partner phone numbers are masked in calls and hidden from each other, payment credentials never touch our servers, and identity documents are stored in restricted storage separate from booking data. We test and review these controls regularly. No system is perfectly secure; if a breach affects your data we will contain and investigate it and notify you and the Data Protection Board of India as the DPDP Act requires.

8. Children

The Platform is for adults (18+). We do not knowingly create accounts for children or collect personal data from them; where a service involves a child (a babysitter, school escort or tutor, for example) the booking is made by a parent or guardian, who confirms they have authority to share the child's details, and only the details needed for the service (name and age band) are collected. A child's data is never used for advertising or profiling. If you believe a child has given us data, write to jhatpat@gmail.com and we will delete it.

9. Your rights and choices

Under the DPDP Act you may: access a summary of the personal data we hold and how it is used; correct or update it; erase it (subject to the retention required by law); withdraw consent, including for optional permissions and marketing messages; nominate a person to exercise these rights on your behalf if you are unable to; and raise a grievance. Most of this is self-service in the app — Account → Edit profile, Saved addresses, Notifications, and Account → Delete account (see the Account & Data Deletion Policy). You can also write to jhatpat@gmail.com; we respond within 30 days and may ask you to verify your identity first. Withdrawing consent for location or notifications may mean some features do not work. If you are not satisfied with our response you may complain to the Data Protection Board of India.

10. Communications

Transactional messages — OTPs, booking status, partner arrival, payments, cancellations, safety and account alerts — are needed to run the service and cannot be switched off while you have an account. Promotional messages are sent only with your consent, in line with TRAI's telecom commercial communication regulations, and can be turned off in Account → Notifications or by replying STOP where offered.

11. Permissions the app asks for

Permission	Why	When
Location (precise)	Serviceability, nearby partners and shops, distance fares, guiding partners to you; partners: matching and live tracking during jobs (background while a job is active)	Asked with an explanation before the system dialog; customers "while using the app", partners "always" only if they go online
Notifications	Booking status, start codes, partner arrival, offers (optional)	After your first booking
Camera and photos	Photos and documents you choose to upload, partner selfie and job proofs	When you tap Add photo / Upload
Microphone	Voice notes describing a task	When you tap Voice note
SMS Retriever	Auto-reads the Jhatpat OTP only (no SMS inbox access)	At sign-in
Phone	Placing masked calls through the app	When you tap Call

12. Cookies and website analytics

myjhatpat.com uses essential cookies and, if you accept, privacy-friendly analytics to understand which pages are useful. No advertising cookies are set. See the Cookie Policy. WhatsApp, Play Store and other third-party links open services under their own policies; review them before sharing information there.

13. Grievance Officer and data protection contact

Grievance Officer — Anmol Mishra, Yurix Ventures Private Limited, Plot No. 73, Vishnu Lok, Kanpur Road, Lucknow, Uttar Pradesh 226023 · jhatpat@gmail.com · +91 87569 92565

Grievances are acknowledged within 24 hours and resolved within 15 days, in line with the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, 2023. The Grievance Redressal & Customer Support Policy explains the process.

14. Changes to this policy

We will post any changes here and in the app, with the effective date updated at the top. Material changes are announced at least 7 days in advance. This version is 1.1, effective 16 September 2026.

Printable copy: use your browser's Print → Save as PDF. Questions: jhatpat@gmail.com.