Privacy Policy

Site: example.com · Effective: [DATE TO BE ADDED] · Version: 2.0 (draft)

1. Who we are

MeriKundali is operated by Parmanand LLC dba MeriKundali at merikundali.in. Privacy contact: privacy@example.com. We will respond to privacy requests within 30 days.

2. What we collect

We collect only what is necessary to provide the service:

Birth details — date, time, and place of birth; resolved to latitude, longitude, and timezone offset. Stored encrypted at rest.
Delivery handle — your Telegram ID or email address. Stored encrypted at rest; treated separately from your birth data.
Consent record — timestamp, source (web form / bot /start / email confirmation click), a SHA-256 hash of your handle (never the plaintext), truncated IP address (/24 for IPv4), and truncated User-Agent string (64 chars). This record is append-only and survives account deletion for 3 years.

We do not collect your name. We do not collect your phone number. We do not collect payment information.

3. Why we process it

Birth details and your delivery handle are used solely to: (a) generate your Vedic birth chart, (b) deliver your chart and weekly forecast to your chosen channel (Telegram or email).

We do not use your data for advertising, profiling, behavioral analytics, or resale. Your birth data is not processed by any AI model — the forecast engine is a fully deterministic rule-based system derived from classical Vedic texts (Phaladeepika, Brihat Parashara Hora Shastra).

4. How it is processed

All calculations are performed by a deterministic rules engine — no machine learning, no language models, no human review of your data. Birth data and delivery handles are encrypted at rest using AES-256-GCM field-level encryption. Encryption keys are stored in a separate secret store, not in the database. Your delivery handle is stored separately from your birth data and is never combined into a named profile.

5. Third-party processors

Telegram — if you use the Telegram channel, your Telegram chat ID is stored (encrypted) and messages are delivered via the Telegram Bot API. See Telegram's Privacy Policy.
Resend — if you use the email channel, emails are delivered via Resend. See Resend's Privacy Policy. (Wired in Increment B.)
OpenStreetMap / Nominatim — geocoding your place of birth to latitude/longitude. Only the place name is transmitted; no other personal data.
Hosting provider — server infrastructure (Render). See their data processing terms.
Cloudflare — DNS. Traffic metadata may pass through Cloudflare's network.

We do not use Google Analytics, Meta Pixel, or any retargeting, session recording, or behavioral advertising trackers anywhere on this service.

6. Retention

Birth data, chart data, and delivery handle: retained while your subscription is active.
After you unsubscribe (/stop or one-click unsubscribe): birth data, chart, and delivery handle are deleted within 30 days.
Consent log records: retained for 3 years in hashed, unlinkable form (to demonstrate compliance). Consent records cannot be used to re-identify you.
Unconfirmed email staging records: deleted automatically after 24 hours if not confirmed.

7. Your rights

You have the right to access, correct, or delete your personal data. You may also withdraw consent at any time. To exercise these rights:

Delete / unsubscribe: Send /stop from your Telegram, or click the one-click unsubscribe link in any forecast email. No login required.
Access / correction: Email privacy@example.com with the subject line "Data Request". We will verify by asking you to control your delivery handle (send /stop from your Telegram, or click a link sent to your email) — name-free verification. We will respond within 30 days.
Data subject access request (DSAR): We will return your birth row, delivery handle, account creation date, and the list of third-party processors.

8. International data transfers

Our servers are located in the United States. If you are accessing this service from the European Economic Area (EEA) or the United Kingdom, your data is transferred to the US. We rely on Standard Contractual Clauses (SCCs) for such transfers. [SCCs to be executed before EEA/UK public launch.]

9. No sale or sharing

We do not sell, rent, license, or share your personal data with any third party for their own commercial purposes. Data is shared with processors listed in Section 5 only as necessary to operate the service.

10. Children

This service is not directed to children under 13 years of age (as defined under COPPA in the US) or under 18 years of age (as defined under India's DPDP Act for data fiduciaries with elevated risk). We do not knowingly collect data from children below these thresholds. If you believe a minor has submitted data, contact privacy@example.com and we will delete it.

11. Changes to this policy

We will notify you of material changes via your delivery channel (Telegram message or email) before they take effect, and will update the version number and effective date at the top of this page. Continued use of the service after the effective date constitutes acceptance of the revised policy.

12. Contact

For privacy-related requests or questions:
Email: privacy@example.com
We aim to respond within 30 days.

← Back to home