Last Updated: February 15, 2025
Humrah operates a real-world companion booking platform that enables users to arrange in-person meetups at public locations. This Privacy Policy describes how Humrah collects, uses, stores, shares, and protects personal data, and explains the rights available to users.
Data Fiduciary: Humrah is a Data Fiduciary as defined under the Digital Personal Data Protection Act, 2023 (DPDP Act). This means Humrah determines the purpose and means of processing your personal data and is responsible for ensuring that processing is lawful, fair, and transparent.
By registering an account or using the Humrah platform, you provide your informed and explicit consent to the collection and processing of your personal data as described in this policy. You may withdraw consent at any time as described in Section 11. Withdrawal of consent may limit or terminate your ability to use the platform.
This policy applies to all users accessing Humrah via the mobile application (Android or iOS) or any related service. It is governed primarily by the DPDP Act, 2023 and applicable rules thereunder. Users are encouraged to read this policy in full before using the platform.
Humrah collects personal data that is necessary to provide the service. Data collection is limited to what is required for the purposes described in this policy.
Humrah processes personal data on the basis of explicit, informed consent obtained from each user at the time of registration. Users are presented with a clear description of data collection and processing purposes before they create an account. Consent is recorded and timestamped.
Certain data processing activities are also carried out on the basis of legitimate legal obligations, including compliance with applicable Indian law, court orders, and regulatory directions from competent authorities.
Humrah does not process personal data for purposes beyond those described in this policy without obtaining fresh consent from the user.
Biometric Data: Processing of face embeddings (biometric personal data) is subject to a separate, explicit consent step within the application. Users are informed of the specific purpose, retention period, and their rights before biometric processing begins. Providing biometric data is mandatory to use the platform. Where a user declines, their account cannot be activated, as face verification is a core security mechanism of the platform.
Personal data collected by Humrah is used exclusively for the following defined purposes. Data is not processed in any manner incompatible with these stated purposes.
Humrah does not use personal data for advertising profiling, behavioral marketing, or for sale to third parties.
Notice: Humrah collects and processes biometric personal data in the form of face embeddings. This section explains what is collected, how it is used, how long it is retained, and your rights in relation to this data. You will be asked for explicit consent within the application before any biometric processing begins.
Face embeddings are arrays of numbers produced by a machine-learning model applied to facial geometry. They are not photographs or images. They cannot be converted back into a recognizable image of the user. They are not used to identify users outside the Humrah platform and cannot be used for facial recognition in any external system. Their sole function is to compute a similarity score between two embeddings for the purpose of detecting whether the same person has previously created an account on Humrah.
Face embeddings are used solely for the following purposes:
Face embeddings are not used for age verification, identity authentication beyond the purposes above, marketing, research, or any purpose outside those listed here.
The comparison of face embeddings against the database is performed through an automated process. This process may result in an automated decision to flag or reject an account registration if a duplicate is detected. If your account registration is rejected or suspended as a result of this automated process, you have the right to request human review of that decision.
If you believe that an automated face verification decision has been made in error — for example, if your account has been flagged or rejected incorrectly — you may submit an appeal by contacting the Grievance Officer at the details listed in Section 16. Humrah will conduct a manual review of the flagged decision and respond within 15 business days. During this period, the account will remain suspended pending the outcome of the review.
Before any biometric data is collected, users are presented with a dedicated consent screen within the application that explains: (a) what biometric data will be collected; (b) the specific purpose for which it will be used; (c) the retention period; and (d) the right to withdraw consent and the consequences of doing so. Consent is recorded with a timestamp. If you do not provide this consent, account activation will not be possible, as face verification is a mandatory security requirement of the platform.
Note: Face verification is a mandatory feature of Humrah. If you do not consent to biometric processing, the platform cannot be used. Biometric data is not shared with third parties except as required by law.
What Humrah Does Not Do: Humrah does not track user location continuously or in the background. Humrah does not share precise GPS coordinates publicly or with other users. Humrah does not use location data for advertising, profiling, or any purpose not described in this policy. Users select their own meetup locations; Humrah does not direct users to specific locations.
Humrah is a communication and coordination platform. It enables users to identify potential companions and arrange to meet in person at public locations. Humrah does not organize, supervise, or participate in any offline meeting between users.
The Humrah platform facilitates communication between users and assists in suggesting public places for meetups. Once a booking is confirmed, the actual meeting occurs independently and entirely outside the control of Humrah. Humrah does not verify the real-time identity, location, or conduct of any user during an offline meeting.
Users are solely responsible for their personal safety when meeting another user offline. Users are advised to:
Humrah does not guarantee the behavior, character, or intentions of any user on the platform. The platform's verification mechanisms reduce the risk of fake or duplicate accounts but do not constitute a guarantee of safety. Humrah is not liable for any harm, loss, or injury arising from offline interactions between users.
Users may report concerns about another user's conduct directly within the application using the report function available on any user profile or booking page. Reports are reviewed by the Humrah moderation team. Where a reported user is found to have violated the Community Guidelines or Terms of Service, Humrah may suspend or permanently remove their account. Users may also contact the Grievance Officer at the details listed in Section 16 for urgent safety concerns.
Humrah does not sell, rent, license, or trade personal data to any third party for marketing, advertising, or commercial purposes.
The following information is made visible to other users on the platform for the purpose of enabling the service:
The following information is never shared with other users: email address, phone number, precise GPS coordinates, face embeddings, IP address, and device identifiers.
Humrah engages third-party service providers who process personal data on Humrah's behalf, acting as data processors. These providers are contractually bound to process data only on Humrah's documented instructions and in accordance with applicable data protection law. Humrah does not authorise processors to use personal data for their own purposes.
Current processors include:
Some of Humrah's third-party processors may store or process data on servers located outside India. Where this occurs, Humrah ensures that appropriate contractual safeguards are in place, including standard data protection clauses requiring processors to maintain equivalent levels of protection to those required under Indian law. Users are informed of the possibility of cross-border processing through this policy and consent to it as part of account registration.
Humrah may disclose personal data when required to do so by law. This includes:
Where permitted by law, Humrah will notify affected users of any such disclosure.
Humrah retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:
Upon account deletion, the following deletion schedule applies:
Humrah maintains encrypted system backups for disaster recovery purposes. Backup data is overwritten or purged on a rolling cycle not exceeding 90 days. Deleted personal data will be removed from active systems within the timelines above and from backup systems within the applicable backup cycle.
No Contradictions: In all cases, the more specific retention period in this section governs. Where an account is deleted, backup copies of personal data are purged within the next scheduled backup cycle, not to exceed 90 days from the date of deletion.
Under the Digital Personal Data Protection Act, 2023, and associated regulations, users have the following rights in relation to their personal data processed by Humrah:
You may request a summary of the personal data Humrah holds about you and information about the purposes for which it has been processed. Humrah will respond to access requests within 30 days.
You may request correction of inaccurate or incomplete personal data. You may also request erasure of personal data where it is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent. Humrah will action verified correction and erasure requests within 30 days.
You have the right to submit a grievance to Humrah's Grievance Officer and to receive a response within the timelines described in Section 16. If the grievance is not resolved to your satisfaction, you may escalate the matter to the Data Protection Board of India, once constituted under the DPDP Act.
You may nominate another individual to exercise data rights on your behalf in the event of your death or incapacity, in accordance with the provisions of the DPDP Act, 2023.
You may request a copy of your personal data in a structured, machine-readable format (JSON or CSV), to the extent technically practicable for the categories of data Humrah holds.
Where a significant decision affecting your account — including account suspension or rejection — has been made by automated means (including face embedding comparison), you have the right to request human review of that decision. See Section 5 for the appeal process applicable to face verification decisions.
You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Because Humrah's service is entirely consent-based and relies on the processing described in this policy to function, withdrawal of consent will result in the following:
Withdrawal of consent from biometric data processing specifically will require account termination, as face verification is a mandatory component of the service.
To withdraw consent, you may:
Humrah will process withdrawal requests within 7 business days of verification.
If you are unable to access the application:
Important: Account deletion is permanent and cannot be reversed. All data, matches, and booking history associated with the account will be permanently removed within the timelines listed above. If you re-register after deletion, you will be required to complete the full verification process again.
Security Notice: No security system can guarantee absolute protection against all forms of attack or breach. In the event of a data breach that is likely to result in risk to users, Humrah will notify affected users and, where required, the relevant regulatory authority, in accordance with applicable law.
Age Restriction: The Humrah platform is intended exclusively for persons who are 18 years of age or older. Humrah does not knowingly collect personal data from anyone under the age of 18.
During account registration, users are required to declare that they are 18 years of age or older. This is a declaration-based confirmation. Humrah does not use face verification technology as a means to determine or verify a user's age; face verification is used solely for duplicate detection and fraud prevention as described in Section 5.
If Humrah discovers or receives a credible report that a user is under the age of 18:
If you are a parent or legal guardian and have reason to believe that a minor has created a Humrah account, contact Humrah immediately at support@humrah.in with the subject line "Underage User Report". Include relevant details to assist investigation. Humrah will investigate and respond within 5 business days.
Humrah may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, service features, or data practices. The "Last Updated" date at the top of the policy will be revised with each update.
Where changes are material — meaning they alter how personal data is collected, used, shared, or the rights available to users — Humrah will notify users through the following means:
Non-material changes — such as corrections to language, formatting, or clarifications that do not alter the substance of the policy — will be reflected in the updated document without individual notification. Users are encouraged to review this policy periodically.
If you do not accept a material change to this policy, you may delete your account before the effective date of the change. Continued use of the platform after the effective date of a material change constitutes acceptance of the updated policy.
In accordance with the Digital Personal Data Protection Act, 2023, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Humrah has designated a Grievance Officer to address privacy-related complaints and concerns raised by users.
The Grievance Officer will acknowledge receipt of the complaint within 48 hours and provide a substantive response or resolution within 15 business days of receipt of a complete complaint.
If your grievance is not resolved to your satisfaction within the timelines above, you may escalate the matter to the Data Protection Board of India, once it has been constituted and made operational under the DPDP Act, 2023. Information on how to approach the Board will be published by the Government of India and updated here as applicable.
For general privacy-related questions, data access requests, or support enquiries:
support@humrah.in
Humrah Privacy Team
Delhi, India
General enquiries: Responded to within 7 business days.
Grievances: Submit to grievance@humrah.in — see Section 16.
The following material legal deficiencies were identified and corrected in this revised policy: