Privacy policy

Kheyal (kheyal.in) is run by [EDIT legal business name], [EDIT street address], [EDIT city, state, PIN code], India ("Kheyal", "we"). We act as the data fiduciary for the personal data described here, under India's Digital Personal Data Protection Act, 2023 (DPDP Act). We collect as little as we can, and we delete gift pages when they expire.

What we collect

• From you, the person making a page: your email address (required, for the link, receipts and reminders), your mobile number (optional), and your name if you add it to the page.
• Page content: the recipient's name, your message, the quotes you pick, photos and their captions, and optional details such as a relationship start date or birth year, used only to fill in lines like "{years} years together".
• Payments: handled by Razorpay. We receive the order and payment ids, amount and status. We never see or store card, UPI or bank details.
• Usage: an anonymous view count and the date a page was last opened. Your IP address is used briefly to stop abuse (rate limits) and is not stored with your data.
• Reports: if someone reports a page, the reason, details and an optional email they choose to give.

Why we use it

• To build, host and deliver the page you paid for (performance of a contract).
• To email your link, receipt, expiry reminders and sign-in links.
• To keep the service safe: rate limits, abuse reports and fraud checks.
• To keep accounting and tax records, as the law requires.

We do not sell personal data, show ads, or use your photos for anything other than your page. Photos are stripped of location and camera data when uploaded.

Photos and names of other people

Pages usually show someone else: the person the gift is for, and sometimes friends or family in photos. Before paying, you confirm that you have the right to share every photo and name you add. If you appear on a page without agreeing to it, use the "Report this page" link at the bottom of the page and we will review it.

Who can see a page

Anyone who has the link. Links are long and random, are never listed or indexed by search engines, and can be protected with a password on some plans. Treat a link like a private letter: share it only with the person it is for.

How long we keep data

• Unpaid drafts: deleted automatically after about 48 hours.
• Live pages: kept for the plan's validity. When a page expires it goes offline, and after a grace period (30 days unless your plan says otherwise) its photos, messages, names, quotes, reactions and visit data are permanently deleted.
• "Delete my page now": you can delete a page at any time from Find my page. The same permanent deletion happens immediately.
• Orders: order and payment records, and the email used to pay, are kept for as long as Indian tax and accounting law requires ([EDIT e.g. 8 years]), even after a page is deleted. They contain no photos or messages.
• Abuse reports are kept while needed to handle them and to prevent repeat abuse.

Who processes data for us

• Razorpay (payments, India).
• Cloudflare R2 (storage of photos and media).
• Resend (sending emails).
• [EDIT hosting and database providers], and Upstash (rate limiting).

Some of these providers may process data outside India ([EDIT e.g. India and the United States]), under contracts that require them to protect it.

Cookies

We use only cookies that the service needs: one that keeps your unfinished draft, one for a short sign-in session when you manage your pages, one that remembers a page password you entered, and one for our admin staff. No advertising or tracking cookies.

Your rights

Under the DPDP Act you can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct or complete it;
• erase it (pages can be deleted instantly from Find my page);
• nominate someone to exercise these rights if you are unable to; and
• hear a grievance.

Write to hello@kheyal.in from the email you used. We reply within 30 days. Grievance officer: [EDIT grievance officer name], [EDIT grievance officer email], [EDIT street address], [EDIT city, state, PIN code], India. If you are not satisfied, you may complain to the Data Protection Board of India.

Children

Kheyal is for adults. You must be 18 or older to buy a page. A page may celebrate a child (a birthday, for example) when made by a parent or guardian.

Changes

If we change this policy in a way that matters, we will update the date above and, for significant changes, email customers with live pages.