← HelloShop

Privacy Policy

This policy explains what personal data HelloShop collects, why, and what rights you have. ProWin Apps is the data fiduciary for this data. We handle it under India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

1. What we collect

Account information

When you sign in with Google we receive your name, email address, profile photo URL and a Google account identifier, through Firebase Authentication. We store an identifier linking your account to your subscription.

Location

With your permission the app uses your device location, or a location you select on the map, to find shops near that point. Coordinates are sent to our backend and to mapping providers to retrieve nearby places. We also store your most recent scan location against your account so the app can restore your last session when you reopen it.

Research activity

The areas you scan, shop ideas you save, and plans you generate.

Subscription information

Your plan, renewal date and usage counts. We never receive or store your card, UPI or bank details — payment is handled entirely by Google Play.

Technical data

App version, device model, operating system version and error diagnostics.

Content you provide

Text you enter into AI features, and profile details you add yourself.

2. Why we process it

Purpose	Basis
Providing scans, analysis and AI features	Performance of contract
Managing your subscription	Performance of contract
Restoring your last session	Performance of contract
Caching area data to reduce running cost	Legitimate use
Diagnosing errors and improving the app	Legitimate use
Meeting legal obligations	Legal obligation

We do not sell your personal data and we do not share it for advertising.

3. Who receives your data

We share the minimum necessary with providers that process data on our behalf:

• Google Firebase — sign-in and account identity.
• Google Maps Platform — receives scan coordinates to return nearby places, and provides the map shown in the app.
• Supabase — database holding your profile, subscription state and cached area data.
• Render — hosts our backend server.
• OpenAI — generates AI advisor responses and AI layout images from the text you submit.
• OpenStreetMap / Overpass — receives scan coordinates from your device to return map data, used on the free tier and for wider brand searches.
• WorldPop — receives an area boundary to return population estimates.
• Google Play — payments and subscription management.

Each provider has its own privacy practices, and we encourage you to review them. We may also disclose data where required by law or to protect our legal rights.

4. International transfers

Some of these providers process data outside India. Where that happens we rely on the provider's contractual safeguards.

5. How long we keep it

• Account data — while your account is active, and up to 90 days after deletion for backups and legal records.
• Cached area data — up to 7 days from the scan, then refreshed or discarded. This is aggregated map data and is not linked to your identity.
• AI chat history — stored on your device only, until you clear it or uninstall the app.
• Diagnostics — up to 12 months.

6. Your rights

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• access a summary of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased;
• nominate another person to exercise these rights on your behalf in the event of your death or incapacity;
• raise a grievance with us and, if unresolved, with the Data Protection Board of India.

You can request deletion using the Delete my account option in the app's Profile screen, or directly on our Delete Your Account & Data page. We verify the request against your account email and respond within 30 days.

You can revoke location permission at any time in your device settings. The app still works — you will select locations manually instead.

7. Children

HelloShop is not directed to anyone under 18 and we do not knowingly collect personal data from children. Subscriptions may only be purchased by adults. If you believe a child has provided us with data, contact us and we will delete it.

8. Security

Data is encrypted in transit and access to our systems is restricted. No method of transmission or storage is completely secure and we cannot guarantee absolute security. We will notify affected users and the Data Protection Board of any breach as required.

9. Changes

We may update this policy. Material changes will be notified in the app and reflected in the "Last updated" date above.

10. Contact and Grievance Officer

As required under the Information Technology Act, 2000 and the Consumer Protection (E-Commerce) Rules, 2020: