Privacy Policy

1. Introduction and Scope

This Privacy Policy (“Policy”) describes how Palmaestro (“Company”, “We”, “Us”, “Our”), acting as the Data Fiduciary under the Digital Personal Data Protection (DPDP) Act, 2023, collects, uses, stores, shares, protects, and deletes your personal data in connection with your use of the Palmaestro mobile application (“Application”) on iOS and Android.

The Application captures palm images using the device camera. All AI analysis of palm images is performed via Google Cloud Platform (GCP) infrastructure and/or contracted external AI APIs — there is no on-device AI model. The image is transmitted to GCP for analysis, and only the textual reading result is returned to your device. The user’s choice is solely whether to save the reading result, not whether to use Google Cloud (which is always used). This Policy explains exactly what data is transmitted, how it is processed, and how long it is retained.

This Policy complies with: (i) DPDP Act, 2023; (ii) IT (Reasonable Security Practices) Rules, 2011 (SPDI Rules); (iii) Consumer Protection Act, 2019 and E-Commerce Rules, 2020; (iv) Apple App Store Review Guidelines; and (v) Google Play Developer Policy (User Data & Privacy).

By using the Application, you acknowledge that you have read this Privacy Policy and consent to the collection and processing of your personal data as described herein. You may withdraw consent at any time via Settings > Privacy > Withdraw Consent, or by contacting Admin@palmaestro.com.

2. Personal Data We Collect

We collect only the minimum personal data necessary for the purposes specified (data minimisation principle — DPDP Act, 2023, Section 6(4)):

Google Cloud Platform Disclosure

When cloud processing is selected by the user, palm image data is transmitted to and processed on Google Cloud Platform (GCP) infrastructure located in asia-south1 – Mumbai, India. Processing is governed by Google’s Data Processing Addendum. GCP is contractually prohibited from using your data for any purpose other than providing the palm analysis service.

3. Biometric Data Processing Protocols

Given the sensitive nature of biometric data (palm images classified as Sensitive Personal Data under SPDI Rules, 2011 and processed under explicit consent per DPDP Act, 2023), we implement a granular, user-controlled processing framework:

3.1 How Palm Image Processing Works (Google Cloud — Always Active)

Your device camera captures your palm image locally. The image is then transmitted via a secure SSL/TLS 1.3 encrypted connection to Google Cloud Platform (GCP) for AI analysis. There is no on-device AI model — Google Cloud is always responsible for the analysis. Only the textual reading result generated by GCP is returned to and displayed on your device. The palm image itself is not permanently stored unless you explicitly choose to save your reading.

3.2 What Happens When You Save a Reading

By default, your palm image is transmitted to GCP, analysed, and then immediately deleted from GCP servers once the reading is generated — it is not retained. If you choose the “Save Reading” feature, the generated textual reading result (and, where you consent, the associated palm image) is stored on GCP’s encrypted servers for the period you specify or until you delete it. You will receive a clear disclosure prompt before saving. You can delete any saved reading at any time via Settings > My Readings > Delete.

3.3 User Controls for Biometric Data

• Control Reading Storage: Settings > Privacy > Uncheck “Save Readings” to ensure that after a reading is generated, both the image and result are deleted immediately from GCP servers and not retained.
• Disable Image Retention: Settings > Privacy > Uncheck “Store Photos on Server” to prevent GCP from retaining palm images after the reading is generated. Analysis will still use GCP, but no image will be stored post-analysis.
• Delete All Stored Images: Settings > Privacy > Delete All Biometric Data.
• Request Full Deletion: Email Admin@palmaestro.com for deletion within 72 hours.

4. Consent Framework and Legal Basis

4.1 Consent Standard. Under DPDP Act, 2023, we process your personal data only with your free, specific, informed, unconditional, and unambiguous consent. Consent is obtained through clear, plain-language prompts presented before any data collection begins.

4.2 Biometric Consent. A separate explicit consent prompt is presented before the first palm scan and before any image is transmitted to cloud servers. The prompt specifically describes: (a) what data is captured; (b) whether it is processed on-device or via Google Cloud; (c) who may access it; and (d) how to withdraw consent.

4.3 Consent Manager. In accordance with Section 7 of the DPDP Act, 2023, users have the right to manage, review, and withdraw their consents through a registered Consent Manager. You may exercise your consent rights via Settings > Privacy > Manage Consents, or by contacting our Grievance Officer. The Company acknowledges the user’s right to use a registered Consent Manager (as notified by the Central Government, once such framework is operationalized) to manage their consents on their behalf.

4.4 Communication Consent. By registering an account, you authorize the Company to contact you via email, phone, or SMS for service-related communications including account updates, subscription notices, promotional offers, and grievance responses. You may opt out of marketing communications at any time via Settings > Notifications > Manage Preferences or by emailing Admin@palmaestro.com.

4.5 Withdrawal of Consent. You may withdraw consent at any time. Upon withdrawal: (a) all future processing will cease immediately; (b) biometric data will be deleted within 72 hours; (c) account data will be deleted per the retention schedule; and (d) access to data-dependent features will be discontinued. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

4.6 Minor Consent. For any user under 18 accessing limited non-biometric features, verifiable parental or guardian consent is required via our in-app guardian consent workflow. No biometric data shall be collected from any user under 18 years of age.

5. How We Use Your Personal Data

We process your personal data for the following specified, explicit, and legitimate purposes. We will not use your data for any purpose not listed below without obtaining fresh consent:

In accordance with applicable law and our legitimate interests, the information collected may be used for: providing a personalised browsing and app experience; research and improving marketing and promotional efforts; analysing usage and improving content; and customising the Application’s layout to suit user needs, while guaranteeing the anonymity of the user where possible.

6. Data Retention and Deletion

6.1 We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to applicable legal and regulatory requirements. The retention schedule is detailed in Section 5 above.

6.2 Immediate Deletion — Biometric Data. Every palm image is transmitted to Google Cloud Platform for AI analysis. If you do not explicitly save your reading, your palm image is deleted from GCP servers immediately after the reading is generated — no image is retained on any server. If you save a reading, the image is retained only for the duration you specify and may be deleted at any time via Settings > My Readings > Delete.

6.3 Account Deletion. To delete your account: Settings > Account > Delete Account. Your personal data will be permanently deleted within 30 days, a grace period during which you may cancel the deletion. Data required to be retained by law (e.g., transaction logs for 7 years) will be held in an isolated archive and not used for any other purpose. You will receive a confirmation email once deletion is complete.

7. Data Sharing and Third-Party Disclosure

We do not sell your personal data. We do not permit third parties to use your data for their own marketing. We share personal data only in the following strictly limited circumstances:

7.1 Google Cloud Platform (GCP) — Primary Cloud Processor. When cloud processing is selected, palm images are transmitted to and processed on Google Cloud Platform. GCP processes data solely as a data processor acting on our instructions. GCP is bound by a Data Processing Addendum (DPA) under GDPR and Google’s Cloud Platform Terms of Service, and is contractually prohibited from using your data to train its models or for any purpose other than providing the service.

7.2 Contracted External AI APIs. The Company may use additional contracted third-party AI/ML processing APIs for specific analysis functions. All such partners are bound by Data Processing Agreements (DPAs) that: (a) prohibit use of data for any purpose other than service delivery; (b) prohibit training AI models on your data; (c) require equivalent data security; and (d) require deletion upon completion of processing.

7.3 Apple Inc. and Google LLC — Platform Billing. All In-App Purchase and Subscription transactions are processed entirely by Apple or Google. We receive only transaction confirmation metadata (Transaction ID, subscription status). We never receive or store payment card details, bank account information, or Apple/Google account credentials.

7.4 Analytics and Crash Reporting Tools. We use privacy-preserving analytics tools (such as Firebase Crashlytics) that collect anonymised, aggregated technical data. No personally identifiable information is shared with analytics providers. Data is used solely for app performance and stability improvement. Details of third-party SDK providers and their privacy policies are available on request to Admin@palmaestro.com.

7.5 Legal Disclosures. We may disclose your personal data if required by applicable law, court order, regulatory authority, or governmental request, or where disclosure is necessary to protect our legal rights, prevent fraud, or protect the safety of users or the public.

7.6 Business Transfers. In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. You will be notified at least 30 days before such transfer and will have the right to delete your account prior to the transfer.

7.7 Prohibition on Sale of Data. The Company will not, under any circumstances, sell, rent, or commercially exploit your personal data or palm images to any third party. We do not allow any third-party to use your images to train AI models.

8. Your Rights as a Data Principal (DPDP Act, 2023)

Under the DPDP Act, 2023, you (as the Data Principal) have the following rights in respect of your personal data processed by the Company (as the Data Fiduciary):

9. Data Security Measures

We implement a comprehensive, multi-layered security framework to protect your personal data:

9.1 Encryption

• All data in transit is encrypted using TLS 1.2 / TLS 1.3 with certificate pinning on mobile applications.
• All data at rest is encrypted using AES-256 encryption on servers and cloud storage (GCP encryption at rest).
• Palm images stored on GCP are individually encrypted. Hashed passwords use bcrypt (minimum cost factor 12).

9.2 Access Controls and Infrastructure

• Access to personal data is restricted on a strict need-to-know basis using role-based access control (RBAC).
• All staff with access to personal data undergo background checks and mandatory data protection training.
• Multi-factor authentication (MFA) is mandatory for all personnel with database access.
• Servers are hosted on Google Cloud Platform with ISO 27001 and SOC 2 certifications.
• Regular vulnerability assessments and penetration testing are conducted at least quarterly.
• A formal Incident Response Plan and Data Breach Response Protocol are maintained.

9.3 Breach Notification

In the event of a personal data breach, we will: (a) notify the Data Protection Board of India within 72 hours of becoming aware; and (b) notify affected users promptly via email and in-app notification, describing the nature of the breach, likely consequences, and measures taken.

10. Cookies, Tracking Technologies, and Analytics

10.1 The Application uses the following tracking technologies, each subject to user consent:

10.2 iOS App Tracking Transparency (ATT). On iOS 14.5 and later, the Application requests permission via Apple’s App Tracking Transparency (ATT) framework before tracking activity across apps and websites of third parties. Denying this permission does not affect core Application functionality.

10.3 Cookie Management — Website. If you access any associated web presence, cookie preferences can be controlled through your browser settings. Essential cookies cannot be disabled as they are required for the website to function. We use IP tracking details and cookie data only to facilitate website usage and personalised experience; information which is sensitive in nature will not be provided to any third party without the consent of the user.

11. Children's Privacy

11.1 The Application is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child under 13 has provided us with personal data, please contact us at Admin@palmaestro.com and we will delete such data within 72 hours.

11.2 In accordance with Section 9 of the DPDP Act, 2023, we treat all users under 18 years as children for data protection purposes. We obtain verifiable parental consent before processing any personal data of users under 18. We do not process personal data of children for targeted advertising or for any purpose that may be detrimental to their well-being. No biometric data (palm images) is collected from any user under 18 years of age.

12. Cross-Border Data Transfers

12.1 Primary Processing Location. Your personal data is primarily stored on Google Cloud Platform servers. Where possible, we configure GCP to process data within India (asia-south1 region — Mumbai). However, certain GCP services may involve cross-border data transfers.

12.2 International Transfer Safeguards. All cross-border transfers of personal data are made only: (a) to jurisdictions notified by the Central Government under Section 16 of the DPDP Act, 2023 (once such whitelist is officially published); or (b) under binding contractual obligations including Standard Contractual Clauses and GCP’s Data Processing Addendum, providing equivalent data protection standards. As Google Cloud is always used for palm image analysis, cross-border transfers are governed by GCP’s Data Processing Addendum. You are informed of all international transfers through this Policy.

12.3 External AI API Transfers. Where contracted external AI APIs are located outside India, data transfers are governed by binding Data Processing Agreements incorporating standard contractual protections consistent with the DPDP Act, 2023.

13. Regional Language Availability

In compliance with the Digital Personal Data Protection Act, 2023, this Privacy Policy is available in any of the 22 (twenty-two) languages listed in the Eighth Schedule of the Constitution of India, upon written request to our Grievance Officer at Admin@palmaestro.com. We will provide the requested translation within 7 business days of receipt of the request.

14. Changes to This Privacy Policy

14.1 We may update this Privacy Policy at any time. Material changes will be notified via: (a) in-app notification when you next open the Application; and (b) email notification to your registered address at least 15 days before the change takes effect.

14.2 Continued use of the Application after the effective date of the updated Policy constitutes acknowledgment of and agreement to the updated Policy. If you disagree with the updated Policy, you may delete your account before the effective date by following the steps in Section 6.3.

15. Grievance Officer and Contact Details

In accordance with the DPDP Act, 2023, the Consumer Protection (E-Commerce) Rules, 2020, and the IT (Intermediary Guidelines) Rules, 2021, the Company has designated the following Grievance Officer and Data Protection Contact:

• Grievance Officer: Mr. Harinder Singh
• Designation: Grievance Officer & Data Protection Contact
• Email: Admin@palmaestro.com
• Address: R/o 3027-I, Gurdev Nagar, Bharat Nagar Chowk, Ludhiana, Punjab - 141001, India
• Acknowledgement SLA: Within 48 hours of receipt of complaint
• Resolution SLA: Within 30 days of receipt of complaint
• Privacy Requests: Data access, correction, erasure: fulfilled within 72 hours of identity verification

If you believe your data protection rights have been violated and your grievance has not been resolved satisfactorily, you have the right to lodge a complaint with the Data Protection Board of India (www.dataprotection.gov.in) once operationally established under the DPDP Act, 2023.

16. Miscellaneous

16.1 Entire Policy. This Privacy Policy, together with the Terms and Conditions and any feature-specific privacy notices in the Application, constitutes the complete privacy framework governing your personal data.

16.2 Governing Law. This Policy is governed by the laws of the Republic of India. Disputes arising from this Policy are subject to the exclusive jurisdiction of the courts in Ludhiana, Punjab, subject to the arbitration provisions in the Terms and Conditions.

16.3 Severability. If any provision is held invalid, the remaining provisions shall remain in full force and effect.

16.4 Language. This Policy is provided in English. The English version shall prevail in case of any inconsistency with translated versions. Translations into Scheduled Languages are available on request (see Section 13).