Privacy Policy

1Who we are and what this policy covers

1. This Privacy Policy explains how Spirioology collects, uses, shares and protects personal data, and the rights you have over it. Spirioology is the trade name of MANAS HEMANG RAVAL, a sole proprietor carrying on business in India (“Spirioology”, “we”, “us”). We decide why and how your personal data is processed, which makes us the “Data Fiduciary” under the Digital Personal Data Protection Act, 2023.
2. This policy applies to the Spirioology website (www.spirioology.com and its sub-domains), the Spirioology apps for Android and iOS, the Spirioology Partner app and partner website, the Spirioology Seller app and seller portal, and our dealings with you by email, phone and social media (together, the “Platform”).
3. It covers customers and visitors, partners (astrologers, pandits and other spiritual experts who perform services for Spirioology) and sellers and suppliers of products. Sections 3 and 15 explain what is different for partners and sellers.
4. This policy is published under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 (together, the “DPDP law”), as their provisions come into force. It forms part of our Terms and Conditions at www.spirioology.com/terms.
5. Websites and services run by others, such as payment pages, app stores and social media, have their own privacy policies, which apply when you use them.
6. This policy forms part of our Terms and Conditions at www.spirioology.com/terms. If this policy and the Terms describe the same thing differently, the version more favourable to you applies.

How to contact us about privacy

2The personal data we collect from customers

We collect only what we need for the services you use. Data marked “needed” is required to provide that service. Data marked “optional” is up to you, and the service still works without it, though it may be less personal.

1. Sensitive personal data. Some data is treated as sensitive under the SPDI Rules, such as bank account and payment details, and voice or images that could be considered biometric. We collect it only for the purposes stated here, with your consent, and protect it with extra care. We do not use your palm photo or voice to identify you, and we do not create a voiceprint, a hand-geometry measurement or any other biometric template from them.
2. Health information. Please do not share medical details in questions or consultations unless they are necessary for your question. If you do, we use them only to answer you.
3. Other people’s data. When you give us details of another person, such as a partner for kundli matching or a family member for a sankalp, you confirm that you have their permission or are legally entitled to give it, for example as their parent or guardian. We use their details only for the service you request.
4. We do not knowingly collect personal data of children except a child’s birth profile added by a parent or guardian, as explained in section 10.

3The personal data we collect from partners and sellers

1. Partners’ public profiles show their name or professional name, photo, skills, languages, experience, price, rating and reviews. Your phone number, address, KYC documents and bank details are never shown to customers.

4How we use personal data, and why we may

We use personal data only for the purposes below. Under the DPDP law, we process it either with your consent or for a legitimate use the law allows, such as data you give us voluntarily for a stated purpose, or compliance with law. Where we rely on consent, you can withdraw it at any time (section 9).

What we do not do

• We do not sell your personal data, or share it with anyone for their own advertising.
• We do not use your identifiable chats, birth details, palm photos or voice to train AI models, or publish them as testimonials or in advertising, without your separate permission.
• We do not make decisions that have a legal or similarly significant effect on you based only on automated processing. We do use automated tools to detect fraud and to rank experts and products, as our Terms explain.

5Spirio AI and our AI providers

1. To answer a Spirio AI question, we send your question, the chart details needed and, for Talk and palm reading, your voice or palm photo to our AI providers, which process it on our instructions. The app asks for your permission before this happens for the first time.
2. We do not send AI providers your name, phone number, email address or payment details. We use provider settings under which your data is not used to train their models. Providers may keep requests for a limited period, usually no more than 30 days, to detect misuse, and then delete them.
3. Your questions and the answers are saved in your account under Readings, so you can reopen them. You can delete a reading at any time.
4. Palm photos are used only to prepare your palm reading and are deleted within 30 days unless you choose to keep them in your Readings. Voice from a Talk session is used to produce the answer and the transcript, and we do not keep the audio afterwards.
5. We may keep a short summary of your previous Spirio AI conversations so that answers stay consistent. You can see and delete this summary in Settings, then Privacy and data.
6. Our team may read a Spirio AI conversation only to investigate a complaint or a report of misuse, or to check that Spirio AI is following our safety rules, and access is limited to the people who need it.

6Who we share personal data with

1. We keep an up-to-date list of the service providers we use, which you can request from the Grievance Officer.
2. We share data with anyone else only with your consent.

7Storing data outside India

1. Your data is stored and processed in India and in other countries where our service providers operate, such as the United States and countries of the European Union. We transfer data outside India only as the DPDP law permits, and not to any country the Government of India restricts.
2. Where data is transferred, we use providers that are bound by contract to protect it with safeguards at least as strong as those in this policy.

8How long we keep personal data

1. When a retention period ends, we delete the data or anonymise it so that it can no longer identify you, and we ask our service providers to do the same.

9Your rights and how to use them

1. You have the right to
   • access a summary of the personal data we hold about you and how we use it, and the names of those we have shared it with
   • correct, complete or update inaccurate or incomplete data
   • erase data we no longer need, or that you no longer consent to us using, unless the law requires us to keep it
   • withdraw your consent at any time, as easily as you gave it. This does not affect what we did before you withdrew it, and some services may no longer be available
   • nominate another person to exercise your rights if you die or become unable to
   • have your grievances addressed by our Grievance Officer, and then by the Data Protection Board of India once that right is in force
2. How to ask. Use Settings, then Privacy and data, in the app or on the website, or write to the Grievance Officer. You can download your readings, correct your profile, manage permissions and delete your account there. We may ask you to confirm your identity first.
3. How quickly. We acknowledge requests within 24 hours and complete them within 30 days. A complaint about how we have handled your data, as opposed to a request to use one of these rights, follows the 7-day timeline in our Grievance Redressal Policy. Using your rights is free.
4. Marketing. You can stop promotional messages at any time by using the unsubscribe link in an email, or through Settings, then Notifications. Service messages, such as OTPs and booking updates, continue while you use the service.
5. Deleting your account. You can delete your account in the app (Settings, then Account, then Delete account), on the website, or by writing to us. Our Delete Your Account page explains what happens to bookings, wallet balance and purchases.
6. If you are in the European Union or the United Kingdom, you also have the rights to object to processing, to restrict it, to receive your data in a portable format, and to complain to your local data protection authority. Where the law of your country requires a legal basis, we rely on the contract with you, your consent, our legitimate interests in running a safe and useful service, and legal obligations. Puja bookings, sankalp details and gotra may reveal your religious beliefs, and for these we rely on your explicit consent, which you give when you book.

10Children

1. You must be 18 or older to create a Spirioology account. We do not knowingly allow children to register.
2. A parent or lawful guardian may add a child’s birth profile to their own account for services such as naming or a child’s kundli. By doing so, you confirm that you are the child’s parent or guardian and consent to us processing that profile for the services you request.
3. We do not track or monitor the behaviour of children, use children’s data for targeted advertising or profiling, or process it in any way likely to harm a child. A child’s birth profile is never used for advertising, and analytics and advertising tools do not receive it. From the date the DPDP law requires it, we will ask for verifiable parental consent before processing a child’s data, as the law describes.
4. If you believe a child has created an account, please tell the Grievance Officer and we will delete it.

11Cookies, analytics and similar tools

1. Our website uses cookies and similar technologies, and our apps use software development kits, for three purposes. Essential tools keep you signed in, remember your language and keep the Platform secure. Analytics tools help us understand how the Platform is used and fix crashes. Advertising tools measure whether our advertisements work.
2. Essential tools are always on, because the Platform cannot work without them. Analytics and advertising tools run only with your consent, which you can give or change in the cookie settings on the website and in Settings, then Privacy and data, in the app. Examples are Google Analytics for Firebase and Firebase Crashlytics for analytics and crash reports, and the Meta Pixel and Google Ads tags for measuring advertisements.
3. On iPhone, the app asks your permission before using your advertising identifier, and you can change this in your phone’s settings. On Android, you can reset or delete your advertising identifier in your phone’s settings.

12App permissions

1. We do not access your contacts, call logs or SMS inbox, and we ask for each permission only when you first use the feature that needs it.

13Calls and chats

1. Consultations take place inside the Platform, so that customers and experts never see each other’s phone numbers.
2. Chat transcripts are saved in your account. We keep call details such as time and duration to bill sessions and resolve complaints.
3. A call is recorded only if the app tells both parties before it starts and you agree. Recordings are used only to resolve complaints, check quality and keep users safe, and are kept as section 8 states.
4. Our team may review a consultation record only to investigate a complaint, a report of misconduct or suspected fraud, or when the law requires it.

14How we protect personal data

1. We use reasonable security practices in line with the SPDI Rules and the DPDP law, including encryption of data in transit and at rest, access controls so that each user can see only their own data, limited staff access on a need-to-know basis, monitoring and logs, regular backups and contracts with our service providers that require them to protect data.
2. Card and UPI payments are handled by payment providers authorised by the Reserve Bank of India and certified to industry security standards. We never store full card numbers, CVVs or UPI PINs.
3. No system is completely secure. If a personal data breach occurs, we will take steps to contain it, report cyber incidents to CERT-In within 6 hours, and tell affected users without delay what happened, what it may mean for them, what we have done and what they can do to protect themselves. From the date the DPDP law requires it, we will also tell the Data Protection Board of India without delay and send it a detailed report within 72 hours.
4. Please keep your phone and OTPs safe. Spirioology will never ask for your OTP, PIN or password.

15Additional information for partners and sellers

1. Aadhaar. We do not use Aadhaar authentication or Aadhaar e-KYC, and we never ask for your Aadhaar number or a copy of your Aadhaar card. We check only whether your PAN is operative, which shows whether it is linked to Aadhaar, using the Income Tax Department’s records.
2. Tax. We share your PAN, payout amounts and tax deducted with the Income Tax Department, and your GST details with the GST authorities, as the law requires. Your tax statements show the tax we deducted.
3. Social security. Where the Code on Social Security, 2020 or a State law for gig and platform workers applies, we share the details the law requires, such as your name, contact details, your e-Shram number if you have one, the work you do through us and your earnings, with the e-Shram portal or the State welfare board, so that you can receive the benefits those laws provide.
4. Quality and safety. We may review session records, ratings, complaints and puja proof to check quality, investigate complaints and enforce the Partner Agreement or Seller Agreement.
5. Customer data you receive. Customer data shared with you is Spirioology’s responsibility and is for performing the booked service only. The Partner Agreement and Seller Agreement explain your duty to keep it confidential and not to contact customers outside the Platform.
6. When you stop working with us, your public profile is removed within 7 days, and your other data is kept as section 8 states.

16Changes to this policy

1. We may update this policy when our services or the law change. For important changes, we will notify you in the app or by email at least 7 days before they take effect, and ask for fresh consent where the law requires it.
2. The version and date are shown at the top of this page, and previous versions are available on request.