Kebijakan pribadi

Hello Friend — Kebijakan pribadi
ABNEXTGEN WEBMASTERS PRIVATE LIMITED · CIN: U62099MP2025PTC077618 · Last updated: 16 October 2026

1. Introduction and Scope

This Privacy Policy explains how Hello Friend ("Hello Friend", "we", "us" or "our"), operated by ABNEXTGEN WEBMASTERS PRIVATE LIMITED, a private limited company incorporated under the Companies Act, 2013 (CIN: U62099MP2025PTC077618), having its registered office at C/O Deepak, Scheme No. 113, Flat No. 01, Cliffton Park, Indore G.P.O., Indore - 452001, Madhya Pradesh, India, collects, uses, stores, shares and protects your personal data when you use our website hellofriend.in, our Android and iOS applications, our messenger applications, our developer APIs and any other product or service that links to this Policy (together, the "Services").

Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") we act as a Data Fiduciary. Where the EU/UK General Data Protection Regulation ("GDPR") applies, we act as a Data Controller. This Policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules"), the DPDP Act and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules").

By creating an account or using the Services you confirm that you have read and understood this Policy. Where we rely on your consent, we ask for it separately, clearly and specifically, and you may withdraw it at any time as described in Section 17. This Policy should be read together with our Terms of Use, Community Guidelines, Cookie Policy and Refund & Cancellation Policy, which are published alongside it.

2. Privacy at a Glance

• We collect the information you give us (account details, profile, posts, messages, payments), information created when you use the Services (device, log, cookie and usage data) and information from partners you choose to connect (such as social login providers and payment gateways).
• We use it to run the Services, keep your account secure, show you relevant content and ads, process payments, prevent abuse and comply with the law.
• We do not sell your personal data.
• Much of what you post (your name, username, profile picture, cover photo and public posts) can be seen by anyone, including people without an account and search engines. You control the audience of most content in your Privacy Settings.
• Private messages are stored on our servers so that they can be delivered and synchronised across your devices. They are not end-to-end encrypted.
• You can access, correct, download and delete your data, and withdraw consent, at any time from your Settings or by contacting our Grievance Officer (Section 25).
• You must be at least 18 years old to use the Services (Section 19).

3. Key Definitions

4. Information We Collect

4.1 Information you provide to us

4.2 Information collected automatically

4.3 Information from third parties

• Social login providers - if you sign up or log in with Google, Facebook, Instagram, X (Twitter), LinkedIn, TikTok, Discord, VKontakte, OK.ru, Mail.ru, WeChat, QQ or WordPress, we receive the information you allow that provider to share, typically your name, email address, profile photo and a provider user ID. We do not receive your password for that provider.
• Payment providers - transaction confirmation, payment status, transaction ID, amount, currency, and limited payer details (such as name, email, last four digits of a card or the payment method type). We never receive or store your full card number, CVV or net-banking/UPI PIN.
• SMS and authentication providers - delivery status of OTPs and verification codes.
• Other users - when someone tags or mentions you, sends you a message, invites you, shares your content, or reports content involving you.
• Referral and affiliate partners - information that you signed up through a referral link.
• Public sources and safety partners - information that helps us detect spam, fraud and security threats.

4.4 Sensitive personal data

Some data we process is treated as sensitive under Indian law (the 2011 SPDI Rules) or as special-category data under the GDPR. This includes passwords, financial information (bank account and payment instrument details) and identity documents submitted for verification. We collect these only for the specific purpose stated, with your consent, protect them with additional security controls, and restrict access to authorised staff.

We do not use facial recognition, and we do not create biometric templates from selfies or ID photos. Verification documents are deleted within 30 days after a verification decision unless we are legally required to retain them.

You may choose to share information in your profile or posts that reveals your religious or political beliefs, health, sexual orientation or ethnicity. Doing so is entirely optional; if you make it public, others can see it. We do not use such information to target advertising.

5. How We Use Your Information

We will not use your personal data for a purpose that is incompatible with the purposes above without first telling you and, where required, obtaining your consent. We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing; automated tools may flag content or accounts, but enforcement decisions such as permanent bans can be appealed to a human reviewer.

6. Public Information and Your Privacy Controls

The Services are a social platform, so some information is public by design. The following are always public: your name, username, profile photo, cover photo, verified badge status, and the fact that you have an account. Content posted to public pages, public groups, public events, forums, blogs, the marketplace, and public live streams is visible to anyone.

You can control who sees your posts, who can follow you, who can message you, who can see your friends/followers list, your birthday, your online status, "last seen" and other profile details from Settings > Privacy. You can block users, restrict who can tag you, and delete any content you have posted. Search engines may index public profiles and public content through our sitemap.

Please remember that anyone who can see your content can copy, screenshot or share it outside the Services. Content you share in other people's posts, groups or chats may remain visible after you delete your account (for example, a comment on another user's post may remain until that post is deleted, or a message you sent remains in the recipient's inbox).

7. Messages, Calls and Live Streaming

Private messages and group chats are transmitted using encrypted connections (HTTPS/TLS) and stored on our servers so they can be delivered and synced. They are not end-to-end encrypted, which means authorised systems and, in limited cases, authorised staff may access them, for example to investigate a report you or the other person made, to comply with a lawful order, or to protect someone's safety. We do not read your messages for advertising.

Audio and video calls and live streams are processed by our real-time communications providers (such as Agora and Millicast). If live-video recording is enabled, your live stream may be saved and published as a video on your profile until you delete it. Viewers of a public live stream can see your video, audio and comments in real time.

8. Artificial Intelligence (AI) Features

Where available, you can use AI tools to generate posts, blog articles, profile text and images. When you use them:

• Your prompt and relevant context are sent to our AI providers, OpenAI (for text) and Replicate (for images), which process the data on our behalf to return a result. These providers may retain data for a limited time for abuse monitoring under their own policies.
• We do not use your private messages or private content to train AI models, and we do not allow our AI providers to use your inputs to train their models where the provider offers this option.
• Please do not enter sensitive personal information, other people's personal data or confidential information into AI prompts.
• AI output can be inaccurate. You are responsible for content you publish. We may label content as AI-generated.
• AI credits you purchase and their usage are recorded in your transaction history.

9. Advertising

The Services are supported by advertising. Ads may be shown in your feed, sidebar, stories, videos and other places. We show:

• User ads - ads created by other users and businesses on our self-serve ads system, targeted using factors such as country, city, gender, age range, language and interests derived from your activity on the Services.
• Site ads - ad placements managed by us or by third-party ad networks such as Google AdSense or AdMob, where enabled, which may use cookies or device identifiers under their own privacy policies.
• Boosted content - posts, pages and products that users have paid to promote.

Advertisers receive only aggregated reports (impressions, clicks, reach). We do not give advertisers your name, email, phone number or messages, and we do not sell your personal data. Depending on their plan, Pro members may enjoy a reduced-ad or ad-free experience. You can manage ad preferences and cookie consent in Settings and through your device's advertising ID controls.

10. Location Information

We use your approximate location (from IP address) to set your country, language and currency, show relevant content and ads, and detect suspicious logins. With your permission, we use precise location to add places to posts, show maps (via Google Maps or Yandex Maps), and enable location-based features such as "nearby people" where available. You can turn off location access at any time in your device settings; some features may then not work. We do not continuously track your location in the background.

11. Cookies and Similar Technologies

Where required by law, we ask for your consent before setting non-essential cookies. You can change your choice at any time through the Cookie Settings link in the website footer or your browser settings. Blocking cookies may affect some features. Our mobile apps use SDKs and device identifiers for similar purposes, which you can control through your device's privacy settings.

12. Third-Party Service Providers We Use

To run the Services we use trusted third-party providers who process personal data on our behalf under contracts that require confidentiality and security. Depending on the features enabled, these include:

Each third party processes data under its own privacy policy when acting independently (for example, when you log in with Google or pay through PayPal). We encourage you to read those policies. An up-to-date list of providers is available on request from our Grievance Officer.

13. How We Share Your Information

We share personal data only in the following situations:

• With other users, according to your privacy settings and the nature of the feature (public posts, comments, messages to recipients, group members, buyers and sellers in a marketplace transaction, job applications to the employer).
• With service providers listed in Section 12, only to the extent needed to perform their services for us.
• With third-party apps you authorise - if you connect an app built by a developer using our API, that app receives the data you approve on the authorisation screen. You can revoke access at any time in Settings.
• For legal reasons - when required by law, court order or a lawful request by government agencies, including requests under Section 69 of the IT Act and the IT Rules (which can require assistance within 72 hours); to protect the rights, property or safety of us, our users or the public; or to detect and prevent fraud and security issues.
• Business transfers - in a merger, acquisition, restructuring or sale of assets, subject to this Policy, and with notice to you.
• With your consent or at your direction.
• Aggregated or de-identified data that cannot reasonably identify you, for example usage statistics.

We do not sell, rent or trade your personal data, and we do not share it with third parties for their own marketing without your consent.

14. International Data Transfers

Our servers are operated by our hosting providers and may be located in India or other countries, and some of our providers process data in other countries, including the United States and the European Union. We transfer personal data outside India only in compliance with the DPDP Act and any restrictions notified by the Government of India. For users in the EEA, UK or Switzerland, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (and the UK Addendum) together with appropriate safeguards.

15. How Long We Keep Your Information

16. How We Protect Your Information

We implement reasonable security practices consistent with ISO/IEC 27001-type controls and the requirements of the DPDP Rules, including:

• Encryption of data in transit using HTTPS/TLS, and encryption of sensitive data at rest where supported;
• Passwords stored only as salted one-way hashes; password complexity rules;
• Optional two-factor authentication (SMS/email OTP or authenticator app), new-device login alerts and limits on failed login attempts;
• Role-based access controls, access logging and least-privilege access for staff and administrators;
• Regular backups, monitoring of our systems for unauthorised access, and vulnerability testing;
• Contracts with our processors requiring them to protect personal data.

No system is completely secure. Please use a strong unique password, enable two-factor authentication and do not share your login credentials. Data breach: if a personal data breach occurs, we will inform affected users without undue delay in plain language (describing what happened, the likely consequences, what we are doing and what you can do), notify the Data Protection Board of India and CERT-In within the timelines required by law, and, where the GDPR applies, the competent supervisory authority within 72 hours.

17. Your Rights and Choices

Subject to applicable law, you have the following rights:

We will verify your identity before acting on a request. We respond within the time required by law - for DPDP requests, as soon as reasonably possible and in any case within 90 days; for GDPR requests, within one month (extendable in limited cases). Exercising your rights is free of charge unless a request is manifestly unfounded or excessive. As a Data Principal you also have a duty not to provide false information, not to impersonate others and not to file frivolous complaints.

18. Deleting or Deactivating Your Account

• On the website or app: go to Settings > Delete Account, confirm with your password, and submit.
• Without logging in: email support@hellofriend.in from your registered email address or visit our account deletion page at hellofriend.in/terms/account-deletion.
• Deletion is permanent once processed. Your profile, posts, photos, videos, comments and reactions are removed, and you lose access to wallet balance, Pro membership, credits and purchased items. Please withdraw any wallet balance before deleting, subject to our Refund Policy.
• Some information may remain as described in Sections 6 and 15 (for example, messages in other users' inboxes, records we must keep by law, or backups until overwritten).
• If you only want a break, you can simply log out; your account remains until you choose to delete it.

19. Children's Privacy

The Services are intended only for persons aged 18 years or older. Under the DPDP Act, a "child" is anyone under 18, and we do not knowingly collect personal data from children or allow them to create accounts. Every user must confirm that they are 18 or older when signing up, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If we learn that an account belongs to a person under 18, we will delete the account and its personal data.

If you believe a child has provided us with personal data without the required consent, please contact our Grievance Officer and we will delete it promptly.

20. Third-Party Links, Apps and Games

The Services may contain links to other websites, embedded content (such as YouTube videos), games, movies, and third-party apps that use our API. We are not responsible for the privacy practices of those third parties. Your use of them is governed by their own policies. Content shared by other users may also link to external sites.

21. Content Moderation and Compliance with the IT Rules

As an intermediary, we make reasonable efforts to ensure users do not host, display, upload or share content prohibited by Rule 3(1)(b) of the IT Rules and our Community Guidelines. We use a combination of user reports, word filters and human review. When we remove content or restrict an account, we will notify you where appropriate, give reasons, and offer an opportunity to appeal. Reports of content that exposes a person's private parts, shows sexual acts or impersonates an individual in electronically modified images will be acted on within 24 hours of receipt.

22. Region-Specific Information

22.1 India

This Policy is the notice required under Section 5 of the DPDP Act. It is available in English and, on request, in any language listed in the Eighth Schedule to the Constitution of India. Contact our Grievance Officer to request a translation. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India.

22.2 European Economic Area, United Kingdom and Switzerland

The legal bases for each processing purpose are given in Section 5. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. You may lodge a complaint with the data protection supervisory authority in your country of residence. Where required by Article 27 of the GDPR, we will appoint and publish the details of a representative in the EU/UK.

22.3 California and other US states

In the past 12 months we have collected the categories of personal information described in Section 4 (identifiers, commercial information, internet activity, geolocation, audio/visual information, and inferences) for the business purposes in Section 5. We do not sell personal information and we do not knowingly sell or share the personal information of consumers under 16. You have the right to know, delete, correct, and opt out of the "sharing" of personal information for cross-context behavioural advertising, and the right not to be discriminated against for exercising these rights. Submit requests to grievance@hellofriend.in.

23. Do Not Track

Some browsers send "Do Not Track" signals. As there is no common industry standard for these signals, we do not currently respond to them, but you can manage tracking through the cookie settings described in Section 11. Where legally required, we honour Global Privacy Control (GPC) signals as a request to opt out.

24. Changes to This Policy

We may update this Policy from time to time to reflect changes in our Services, technology or law. The "Last updated" date at the top shows when it was last revised. For material changes, we will notify you in advance through the Services, by email or by push notification at least 30 days before the change takes effect and, where required, ask for your consent again. Previous versions are available on request.

25. Contact Us and Grievance Officer

In accordance with the IT Act, 2000, the IT Rules, 2021 and the DPDP Act, 2023, the details of our Grievance Officer are given below. You may contact the Grievance Officer for any complaint or question about this Policy, your personal data, or content on the Services.

We will acknowledge your complaint within 24 hours and resolve it within 15 days of receipt, as required by the IT Rules (or within 72 hours where the IT Rules require faster action). Please include your username, registered email, a description of the issue and any relevant links or screenshots so that we can help you quickly.