Effective date: 28 October 2026
1. Who we are
This notice is issued by Upaaywala India Pvt. Ltd., a private limited company incorporated in India with its principal place of business at 40/1A, Poushyaa Complex, Vijaya Bank Layout, Kodichikkanahalli, Bengaluru, Karnataka 560076 ("Upaaywala", "we", "us"). For the personal data described here, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"): we decide why and how your personal data is processed.
You can contact us about privacy at customercare@upaaywala.com. Our grievance officer is Anshul Tyagi, Grievance Officer, reachable at cc.kesarilabs@gmail.com or +91 80 4589 2240.
2. What this notice covers
This notice applies when you browse the website, submit a service or product enquiry, raise a grievance, submit a review, or contact our support team. It does not cover other websites linked from ours.
3. Personal data we collect, and why
We collect only what we need for each purpose below.
Service and product enquiries. Your name, email address and/or phone number, city, preferred language, preferred date, service format and your message. Purpose: to check availability, prepare a service plan or product quotation, and reply to you. Basis: your consent, given when you submit the enquiry.
Astrology and ritual details you choose to share. Birth date, birth time, birth place, gotra, family names for a sankalpa, or similar details you include in a message. Purpose: only to prepare the specific service you asked about. Basis: your consent. Please share these only when a service needs them. We do not use them for profiling or marketing.
Grievances. Your name, contact details, the category and description of your complaint, and any related reference. Purpose: to investigate, respond to and resolve your grievance, and to keep the record required by consumer protection law. Basis: your consent and our legal obligations.
Reviews. Your name, email address, rating, review text, an optional order or booking reference and an optional experience date. Purpose: to moderate genuine reviews and, if approved, publish your name, rating and review text. Your email address and reference are never published. Basis: your consent.
Support correspondence. Messages you send to our support email or phone. Purpose: to answer you. Basis: your consent.
Customer accounts. Your email address, a one-way hash of your password (never the password itself), your name and phone number, and any optional details you add, such as date of birth, gender, preferred language and address. Purpose: to let you sign in, pre-fill your enquiries and show your history with us. Basis: your consent, given when you create the account. You can update these details on your account page or ask us to delete the account.
Astrologer consultations. The astrologer and time you choose, the phone or WhatsApp number we call you on, the length of the call and any topic or birth details you choose to share. Purpose: to arrange and connect your consultation. Basis: your consent. Our astrologers are independent consultants; the astrologer you choose receives your name, phone number and the details you shared for the consultation, and nothing more.
Security and technical records. When you submit a form or report a page error, we store a one-way, keyed fingerprint derived from your network address and a coarse browser and platform label. We do not store your raw IP address, your full browser string or the content of page errors. Purpose: preventing abuse and spam, and keeping the website secure. Basis: legitimate uses permitted by law, including preventing fraud and maintaining the security of our systems.
We do not knowingly collect data about children. If you are under 18, please do not submit a form. Ask a parent or lawful guardian to contact us instead. If we learn that we have collected a child's personal data without verifiable consent from a parent or guardian, we will delete it.
4. Cookies and similar technologies
The public website does not set advertising or analytics cookies, and it does not load third-party tracking scripts. A strictly necessary, secure session cookie is used only when you sign in to your customer account or our staff sign in to the administration area. If we add analytics or other non-essential cookies in future, we will update this notice first and ask for your consent where the law requires it.
5. Who receives your personal data
We do not sell your personal data or share it for advertising.
We share personal data only where needed for the purpose you asked for:
- The priest, astrologer, temple-service provider or supplier assigned to your service or product, who receives only the details needed to perform it. - Our hosting provider, Hostinger International Ltd., on servers located in India, which stores the website and database on our behalf as a Data Processor. - Our email provider, Hostinger International Ltd. (Hostinger Email), which sends our enquiry and grievance notifications as a Data Processor. - A courier or logistics partner, the courier company that delivers your order, for delivering a product you have ordered. - Professional advisers, auditors, regulators, courts or law enforcement, where the law requires it or to protect our legal rights.
Every Data Processor acts only on our instructions under a written contract that requires reasonable security safeguards.
Where a provider processes data outside India, we transfer it only to countries not restricted by the Central Government under section 16 of the DPDP Act. Current locations outside India: none. Your personal data is stored in India.
6. How long we keep personal data
We keep personal data only as long as the purpose needs it, or as long as the law requires, and then erase or anonymise it.
- Customer accounts: while your account is open. When you ask us to close it, we erase your account details within 30 days, except records the law requires us to keep. - Enquiries: 24 months after the enquiry is closed, unless it becomes a booking or order. - Booking, order and invoice records: 8 years, as required by tax and accounting law. - Grievances: 3 years after resolution. - Reviews: while published, and for 30 days after withdrawal or rejection. - Security events: 180 days. - Page-failure records: these contain no personal data, and resolved records are removed after 90 days. - Backups: encrypted copies are kept for 90 days and then destroyed. Erasure requests are recorded and re-applied if a backup is ever restored.
7. How we protect personal data
Our reasonable security safeguards include:
- encrypted HTTPS connections; - access to the administration area restricted to authorised staff, using individual passwords, two-step verification and session limits; - passwords stored only as salted one-way hashes; - one-way fingerprints in place of IP addresses; - integrity-checked, access-controlled backups; - activity logs of administrative actions; and - a documented incident response process.
8. If a personal data breach happens
If a breach affects your personal data, we will inform you without delay, in plain language. We will tell you what happened, which data was involved, the likely consequences, what we have done, and what you can do. We will also report it to the Data Protection Board of India and to CERT-In within the periods the law requires.
9. Your rights
Under the DPDP Act, you may:
- withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing that already happened, but we may then be unable to continue a service you asked for; - ask for a summary of the personal data we hold about you, how we are using it, and with whom we have shared it; - ask us to correct, complete or update inaccurate or incomplete data; - ask us to erase personal data that is no longer needed, unless the law requires us to keep it; - nominate another person to exercise your rights if you die or become incapable; - raise a grievance with us and receive a response; and - complain to the Data Protection Board of India once you have used our grievance process.
To exercise a right, email customercare@upaaywala.com or use the grievance page on this website, choosing "Privacy or my personal data". We may ask you to confirm your identity before acting. We will respond within 30 days, and in any case within the period set by law.
10. Your duties
When using the website, please give accurate information. Do not impersonate anyone, and do not share another person's personal data without their permission. Do not file false or frivolous complaints. These duties are set out in section 15 of the DPDP Act.
11. Language
This notice is available in English. You can ask for it in any language listed in the Eighth Schedule to the Constitution of India by writing to customercare@upaaywala.com.
12. Changes to this notice
We will post any change on this page with a new effective date. If a change materially affects how we use personal data you have already given us, we will tell you, and ask for fresh consent where the law requires it.