Privacy Policy

The short version

We collect what we need to draw your chart, answer your questions, take your money once, and deliver what you bought. Nothing more.

We do not sell your personal data. We do not use your birth details to target you with advertising.

We measure how the website and apps are used, and whether our own ads work. In most of the world this is on by default, with a clear notice, and you can turn it off at any time. In the EEA, the UK and Switzerland it stays off until you say yes.

We send email tips. You can unsubscribe in one click. Promotional SMS, WhatsApp messages and phone calls are sent only if you said yes first.

You can see your data, correct it, take it with you, and delete your account from inside the app or from this website.

Who we are

Xalen Technology Private Limited ("we", "us") is the Data Fiduciary for GrahaGuru, GrahaGuru Shop and GrahaGuru Mall. Our registered address and GSTIN are listed at the end of this policy.

This policy covers the GrahaGuru website at grahaguru.in, the GrahaGuru mobile apps, and the Shop and Mall surfaces. Where a surface has extra rules, we say so.

The Astro wallet, Shop store credit and a Mall transaction are separate records on separate planes. Value, eligibility, a refund or a transaction on one surface does not create or change value, eligibility, a refund or a transaction on another, and a balance shown on one surface is not proof of a balance on another.

What we collect

You give us some of this. Some of it is created when you use the service.

• Account details: your name, email address, phone number, and the sign-in method you chose.
• Birth details: date of birth, time of birth and place of birth. We need these to compute a chart. They are the reason the service works.
• What you ask: your questions to Vedika AI, your saved chats, and the reports and readings we generated for you.
• Photographs you upload for a palm reading, and the reading produced from them.
• Purchase records: what you bought, when, the amount, the tax charged, the invoice, and the store or gateway reference. We never see or store your full card number or UPI credentials.
• Wallet ledger: every credit and debit against your balance, and whether the credit was paid or promotional.
• Delivery details for physical orders: the address, phone number and pincode you enter, and the courier's tracking events.
• Device and usage data: app version, device model, operating system, crash reports, language, which screens you opened, which website pages you visited, and how you found us, for example by clicking one of our ads. This includes random IDs for your browser or app. Where your device has one and you have not turned it off, it also includes an advertising ID.

Why we use it

We only process personal data for a lawful purpose. Where the law needs your consent, we ask for it. Where it does not, we tell you what we do and give you an easy way to say no.

• To deliver what you asked for: charts, readings, answers, reports, orders.
• To take payment, issue a GST invoice, and keep the accounting records the law requires us to keep.
• To keep accounts safe, stop fraud and abuse, and enforce our Terms.
• To answer your support messages and your grievances.
• To fix crashes, to measure how the website and apps are used, and to make the product work better.
• To measure whether our own ads worked, and to show our own ads to people who visited GrahaGuru. See "How we measure and advertise".
• To send you service messages, such as sign-in codes, receipts and order updates.
• To send you email tips about charts, horoscopes and readings, as a short series over your first 30 days. In most of the world these are on when you sign in, with a notice, and every email has an unsubscribe link. In the EEA, the UK and Switzerland they are off until you say yes.
• To send you notifications you allowed on your phone, such as your daily horoscope and order updates. Offers and promotions by push notification only if you said yes in the app.
• Promotional SMS, WhatsApp messages and phone calls only if you said yes first. This applies everywhere. Indian telecom rules require it for SMS and calls, and we ask for a yes before any promotional WhatsApp message too.

Vedika AI and astrology processing

Vedika AI is our astrology assistant. When you ask it something, we send the question and the chart context it needs to our AI providers so that an answer can be produced. Full details are in the Consumer AI Privacy Notice.

Answers, readings and reports are generated by software. They are for guidance and reflection. They are not medical, legal, financial or psychiatric advice, and they are not a prediction of a guaranteed outcome. The Generative AI Disclosure explains how we label them.

We do not use your questions or your birth details to train a public foundation model.

Who we share it with

We share the minimum needed, with processors bound by contract to use it only on our instructions.

• Astrology and AI engines that compute charts and generate text.
• Payment processors and the app stores, to take payment and verify a purchase.
• Couriers and logistics partners, for physical orders only.
• Cloud hosting, email delivery, crash reporting, analytics and advertising measurement providers. We name them in "How we measure and advertise".
• Government authorities, courts and law enforcement where a valid legal request requires it.

How we measure and advertise

We use a few outside tools to see how GrahaGuru is used and to check whether our own ads work. This section names them.

In most of the world these tools are on by default, and we tell you in a notice. You can turn them off at any time. See "How to opt out". In the EEA, the UK and Switzerland they stay off until you say yes. See "Regional rules".

We do not send your birth details, the text of your questions to Vedika AI, or the content of your reports to these tools.

These companies handle the data for us or under their own terms and privacy statements. We do not sell your personal data. Letting Google and Meta measure and target our own ads can count as "sharing" or "targeted advertising" under some laws. "Regional rules" explains your choices.

• Google Analytics 4, run by Google. It counts visits and shows us which pages and features people use. It sets cookies and uses a random ID for your browser. If you are signed in, we also send your account ID, so one person is counted once across devices.
• Google Ads, run by Google. It measures the sign-ups and purchases that came from our ads. It can also let Google show our ads to people who visited GrahaGuru (remarketing). If you buy or sign up and you have allowed advertising, we send Google a scrambled (hashed) copy of your email address so it can match the sale to an ad. We never send it for analytics alone.
• Google Signals, a Google Analytics feature that we have turned on. When you are signed in to a Google account with ad personalisation on, Google can add that data to our reports and ad audiences. Google may combine it with the IDs above. You control this in your Google ad settings.
• Microsoft Clarity, run by Microsoft. It records how you scroll, click and move on our pages, and plays it back to us with heatmaps. We use it to find pages that confuse people. Microsoft handles the recordings under its own terms.
• Meta pixel, run by Meta. It measures the sign-ups and purchases that came from our ads on Facebook and Instagram, and helps build audiences for them. It loads only while the advertising choice is on.
• Cloudflare. It protects and delivers the website. It also tells us your approximate country from your connection, so we can show you the right cookie choices.
• Atlassian Statuspage. Our Help pages ask our public status page, run by Atlassian, whether GrahaGuru is up. The request carries no cookie and no referrer, so it sets nothing on your device. Like any web request, it shows your IP address to Atlassian.
• Firebase Analytics, run by Google. It counts which screens and features you use. Events are tied to a random app ID and, once you sign in, to your account ID, your language and whether you hold a paid plan.
• Firebase Crashlytics, run by Google. It sends crash reports and diagnostics so we can fix what broke. In the EEA, the UK and Switzerland, crash reports are sent only after you turn on Analytics.
• Google Ads measurement through Firebase. When "Use my activity to improve and measure ads" is on, the app shares activity with Google so it can measure our ads.
• Google Play Install Referrer, on Android. When you first open the app, Google Play tells us which campaign sent you, for example one of our ads. We read it only while Analytics is on.
• Notifications. Firebase Cloud Messaging on Android, Apple's push service on iPhone, and the Expo push service carry the notifications you allow.
• Our own servers. App events also go to our own systems on AWS in Mumbai.

Regional rules

The rules for analytics and advertising depend on where you are. On the website we work out your region from your approximate location. In the app we use your phone's region, time zone and phone number. If we cannot tell, we treat you as if you were in the EEA, the UK or Switzerland.

• EEA, UK and Switzerland. This means the 27 EU countries, Iceland, Liechtenstein, Norway, the United Kingdom and Switzerland. Nothing that is not strictly needed runs until you choose. That covers analytics, session recordings, advertising measurement and crash reports. The cookie banner and the app sign-in screen give you Accept and Reject with equal weight. You can sign in and use GrahaGuru with everything off. Email tips are off until you switch them on. You can change your choice at any time. You can ask to see, correct, delete, move or limit the use of your data, object to its use, and complain to your data protection authority.
• United States. We give you notice and an easy way to opt out. We do not sell your personal data. Use Cookie settings on the website or Profile in the app to opt out of ad measurement. On the website we also treat a Global Privacy Control signal from your browser as an opt-out of sale, sharing and targeted advertising for that browser. Depending on your state, you may have the right to know, access, correct and delete your data, and not to be treated worse for using these rights. Write to [email protected]. Every email tip has an unsubscribe link, and we stop sending when you use it.
• India. Today we give you notice and an easy way to opt out of analytics, ad measurement and email tips. When the consent rules of the Digital Personal Data Protection Act, 2023 start to apply, which we expect on 13 May 2027, we will ask for a separate yes to each of these. We will not treat this notice as that yes. Marketing messages by SMS, WhatsApp or phone call stay yes-first now and after that date.
• Everywhere else. We give you notice and an easy way to opt out. If the law where you live asks for more, we follow it.

Where your data lives

GrahaGuru data is hosted in India, in the Asia Pacific (Mumbai) region. Some processors operate outside India; where that happens we transfer only what that processor needs, and only to countries the Central Government has not restricted under section 16 of the Digital Personal Data Protection Act, 2023.

How long we keep it

We keep your account data while your account is open. When you delete your account we erase or anonymise personal data within 30 days, except records we are legally required to retain.

Invoices, tax records and payment evidence are kept for eight years, because the Companies Act, 2013 and GST law require it. A retained invoice is not a live account.

Support tickets and grievance records are kept for three years so that we can show how a complaint was handled.

Keeping it safe

Data is encrypted in transit and at rest. Access is restricted to staff who need it, and administrative access is logged.

If a personal data breach occurs, we will notify the Data Protection Board of India and every affected Data Principal, as required by section 8(6) of the Digital Personal Data Protection Act, 2023 and the rules made under it.

Your rights

As a Data Principal under the Digital Personal Data Protection Act, 2023 you can ask us to do the following. Write to [email protected] and we will respond within 30 days.

Use Delete account in the GrahaGuru app Profile, or the Account and Data Deletion page on this website, to erase your account yourself.

• Get a summary of the personal data we hold about you and who we shared it with.
• Correct, complete or update anything that is inaccurate.
• Erase personal data we no longer need for the purpose you gave it for.
• Nominate another person to exercise these rights if you die or become incapable.
• Withdraw a consent you gave. Withdrawing consent stops future processing; it does not undo processing that already happened, and some features stop working without the data they need.
• Turn off analytics, ad measurement and email tips at any time. See "How to opt out". Rights for people in the EEA, the UK, Switzerland and the United States are in "Regional rules".
• Raise a grievance with our Grievance Officer, and, if we do not resolve it, complain to the Data Protection Board of India.

How to opt out

Opting out stops future use. It does not undo data already collected, and Google, Meta or Microsoft may keep what they already received under their own terms. Service messages such as sign-in codes, receipts and order updates are not marketing, so they carry on.

• Website: use the Cookie settings button at the bottom of every page. Turn off Measurement, Advertising or both. This also removes the IDs already stored in your browser.
• Website: turn on Global Privacy Control in your browser, or in an extension that sends it. We treat it as an opt-out of advertising for that browser.
• Your browser: block or delete cookies in your browser settings. Some parts of the site may stop working.
• Google: change what Google uses for ads at adssettings.google.com. You can also install Google's opt-out add-on for Analytics from tools.google.com/dlpage/gaoptout.
• Meta: change your ad settings in your Facebook or Instagram account.
• App: open Profile, then Settings. Switch off Analytics, "Use my activity to improve and measure ads", and "Email tips from GrahaGuru". Use the Notifications switch for push notifications.
• Your phone: on Android, open Settings, then Privacy or Google, then Ads, to delete your advertising ID or turn off ad personalisation. On iPhone we do not read the advertising ID and we do not show the tracking prompt. If that ever changes, we will show Apple's prompt first and follow your answer.
• Email: every email tip has an unsubscribe link. One click stops them.
• Anything else: write to [email protected].

Children

GrahaGuru services are for people aged 18 or older. The products are not directed to children.

GrahaGuru is for adults. You must be 18 or older to hold an account. We do not knowingly create accounts for children or process the personal data of a child, and we do no behavioural advertising or tracking directed at children. If you believe a child holds an account, write to [email protected] and we will delete it.

Changes to this policy

If we change this policy in a way that materially affects you, we will tell you in the app or by email before the change takes effect. The version and effective date are shown on this page.

Contact and grievances

Privacy questions and Data Principal requests: [email protected], or by post to Xalen Technology Private Limited, A704, Gagan Unnati Co Op Hsg Soc, Katraj Kondhwa Road, Pune, Maharashtra 411048, India.

Grievance Officer: Vansh Joshi, Grievance Officer, [email protected], +91 89658 15111. Xalen Technology Private Limited, A704, Gagan Unnati Co Op Hsg Soc, Katraj Kondhwa Road, Pune, Maharashtra 411048, India. GSTIN 27AAACX6117C1ZL.

We acknowledge every grievance within 24 hours and resolve it within 15 days, as required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.