Effective date: 24 September 2026. Data Fiduciary: BRID NETWORK LLP, LLPIN ACY-8529, Kollam, Kerala 691583, India.

Privacy Notice (Digital Personal Data Protection Act, 2023)

1. What we collect

Depending on how you use OMallu we may process:

• Account: phone number, date of birth, display name, profile photo, device and app identifiers.
• Calls: call metadata (who, when, duration, mode). We do not record call audio or video.
• Chat: message content while active; messages are deleted after 24 hours unless reported.
• Payments: Google Play / payment references, coin purchases and ledger entries (not full card numbers).
• Reports & safety: report reason, and a snapshot of your own screen when you report someone, kept up to 180 days. Reported chat may be kept up to 180 days.
• Partners (extra): PAN, bank account details, KYC documents, payout and TDS records.
• Optional: analytics, SMS or WhatsApp notifications if you consent in Settings.

2. Why we process it (purposes)

To create and secure your account; provide calls and billing; prevent fraud and welcome-coin abuse; pay partners and meet tax duties; handle reports and legal requests; improve the product (if you consent to analytics); and send service messages. We rely on your consent where required, and on uses necessary to provide the service you request.

3. Retention

Account data while your account is active and for a limited period after deletion as needed for law, disputes and fraud prevention. Report evidence and reported chat: up to 180 days. KYC and tax records: as required under Indian tax and KYC rules. Chat (unreported): 24 hours.

4. Sharing

We use processors such as cloud hosting, SMS gateways, call infrastructure (e.g. Agora), and Google Play for payments. They process data on our instructions. We may disclose data if required by law or to protect users. We do not sell personal data.

5. Where data is stored

Primary application databases and report-evidence object storage are hosted in the Mumbai (India) region. Call audio and video are not stored by OMallu; live call media is routed through our call infrastructure provider (Agora) and is not retained by us as recordings. We do not sell personal data for advertising.

6. Your rights (DPDP)

You may access, correct, and erase personal data, and withdraw consent for optional processing, from Settings or by emailing support@omallu.io. You may nominate another person as required by law. You may complain to our Grievance Officer and to the Data Protection Board of India.

7. Children

OMallu is for adults 18+. We do not knowingly allow under-18 accounts. If we learn a user is under 18 we ban the account and delete personal data except where we must retain evidence of misuse.

8. Security

We use encryption in transit, encryption of sensitive fields at rest, access controls, and monitoring. Report vulnerabilities to security@omallu.io.

9. Grievance Officer

Ananthu | support@omallu.io | Kollam, Kerala 691583, India

10. Changes

We will update this Notice in the app and at https://omallu.io when practices change materially.

Version 2026-09-27-r3. This is the same text shown in the OMallu app. See all policies.