Privacy Policy

1. Who we are

For the purposes of the Digital Personal Data Protection Act, 2023, Beeshi is the Data Fiduciary and you are the Data Principal.

2. What we collect

Information you give us:

• Account details — name, phone number, email address, password (stored only as a cryptographic hash, never in readable form), profile photograph.
• Identity verification — where required, PAN and proof of address.
• Circle records — the circles you belong to, contributions you record, payments you claim, payouts you receive, bids you place, and guarantees you give or accept.
• Content — messages, photographs, snaps, challenge entries and time-capsule contributions.

From your device, with your permission:

• Contacts — so we can show which of your contacts already use Beeshi. You can refuse this and still use the application.
• Notifications — a push token, so we can alert you to activity in your circles.
• Camera, photos, microphone — only when you use a feature that needs them.
• Biometrics — verified by your device. Beeshi never receives, sees or stores your fingerprint or face data.

What we do not collect:

• We do not collect your bank credentials, card numbers, or UPI PIN. Beeshi never handles a payment instrument.
• We do not share your circle records with any third party for their own purposes without asking you first.

3. Your consent

We process your personal data on the basis of the consent you give when you register and when you grant a device permission. You may withdraw consent at any time, with the same ease with which you gave it, from Settings. Withdrawal does not affect processing already carried out. Withdrawing consent for a feature essential to a circle may mean you can no longer participate in it.

Your consent covers the purposes listed above, and nothing else. If we later want to process your data for a new purpose — for example advertising, or working with a bank or lender — that is a new purpose, and we will come back and ask you for it separately. You will be able to say no and continue using Beeshi.

4. Advertising, and working with lenders

We do not currently show advertising, and we do not currently share your data with any bank, lender or other financial institution.

We may do either in future — advertising is one way we could fund a product we give away free, and some members may find a lender through us useful. We are telling you this now rather than changing the policy quietly later.

5. Who else sees your data

We also use service providers for cloud hosting and storage, push notification delivery, and real-time calling. They process data on our instructions and may not use it for their own purposes. We may disclose personal data where required by law, court order, or a lawful government request.

6. How long we keep it

• Account data — while your account is open.
• Circle and ledger records — retained after account closure where other members of that circle still rely on the record of a shared arrangement.
• Technical logs — a limited period, for security and diagnosis.

Ledger entries are append-only and are not deleted, because removing one member’s entries would corrupt the record for everyone else in that circle. The correct treatment of an erasure request against a shared financial record is a question we have put to counsel, and this section will be revised on their advice.

7. Your rights

Under the DPDP Act you have the right to obtain a summary of the personal data we process; to have inaccurate or incomplete data corrected; to have data erased where it is no longer needed and retention is not required by law; to nominate another person to exercise your rights in the event of death or incapacity; and to have your grievance heard.

To exercise any of these, write to grievance@beeshi.in or use the controls in Settings. Account deletion is available in the application.

8. Children, and security

Beeshi is not for anyone under 18, and we do not knowingly process the personal data of a child. If we learn that we have, we will delete it.

We take reasonable safeguards, including passwords stored only as cryptographic hashes, session tokens that rotate and are invalidated on sign-out, optional biometric unlock verified on your own device, and media served through time-limited signed links. No system is perfectly secure. In the event of a breach we will notify the Data Protection Board and affected Data Principals as required.