1. Who we are and what this policy covers
1.1 This Privacy Policy explains how My Humdum Private Limited, a company incorporated under the Companies Act, 2013, having CIN U63122MH2026PTC474555 and its registered office at 6th Floor, WeWork Spectrum Tower, Building No. 11, Chincholi Bunder Road, Malad (West), Mumbai 400064, Maharashtra, India (“My Humdum”, “we”, “us” or “our”), collects, uses, stores, shares and deletes personal data when you use the My Humdum website at www.myhumdum.com, any application we publish, and the services offered through them (together, the “Platform”).
1.2 My Humdum is a verification first matrimony platform for adults in India who are seeking marriage. We are the Data Fiduciary in respect of the personal data described in this policy. You are the Data Principal.
1.3 This policy is published in accordance with the Digital Personal Data Protection Act, 2023 and the rules made under it, the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. It is an electronic record and does not require a physical or digital signature.
1.4 This policy forms part of our Terms of Use and Service Agreement (the “Terms”). Words defined in the Terms have the same meaning here. Where this policy and the Terms conflict on a question of personal data, this policy prevails.
1.5 Please read this policy together with our Cookie Policy, our Safety Guidelines and the consent notice shown to you at registration. If you do not agree with this policy, please do not register on or use the Platform.
2. Our privacy promises, in short
This section is a summary written in plain language. It does not replace the detail that follows.
- We do not sell your personal data. Ever, to anyone, for any price.
- We do not share your contact details with advertisers, data brokers, marriage bureaus, agents or telecallers.
- We do not run outbound sales or telemarketing calls, and we do not override your registration on the Do Not Disturb register.
- Your phone number is never shown automatically. You choose who may reveal it, paying Members or only Members you have accepted, and every viewer has a small daily reveal limit.
- You control who sees your photographs.
- Identity document images are deleted as soon as the check is completed. We keep the result, not the document.
- We do not use your caste, community, religion or astrological details for advertising or targeting.
- Blocking is one way. The person you block is never told.
- We show activity at day level only. We do not show live presence.
- We do not read your private messages as a matter of routine.
3. The personal data we collect
3.1 Data you give us directly
Account and identity data. Your name, mobile number, email address, date of birth, gender and password free login credentials. Your mobile number is confirmed by a one time password.
Profile data. Photographs, marital status, whether you have children and whether they live with you, height, city, permanent location, mother tongue, religion, community or caste (optional), highest education, college or institute, profession, employer name, industry, income band, family details, lifestyle answers, your written description of yourself, and your answers to our questionnaire.
Partner preference data. The criteria you set for the people you wish to be introduced to, and the importance you attach to each.
Verification data. A government issued identity document, a live selfie, and where you choose to display the relevant badge, education and employment proof. Where you opt in to astrological matching, your birth time, birth place and manglik status.
Communications data. Connection requests, the short note attached to a request, private messages, Community posts and reactions, reports you file, and correspondence with our support, safety, billing and grievance teams.
Payment data. The plan you purchase, the amount, the transaction reference, the invoice details and your billing name. Card, account and UPI credentials are collected and processed by our payment gateway. We do not receive or store them.
Managed Profile data. Where a Profile Manager operates a profile on behalf of a Member, we collect the Profile Manager’s name, relationship and contact details, and the Member’s written consent.
Optional data. Testimonials and success stories, survey responses, referral information, and anything else you choose to send us.
3.2 Data generated when you use the Platform
Usage data. Log in times, pages viewed, searches run, filters applied, profiles viewed, requests sent and received, features used, and the time and date of your last activity.
Device and technical data. IP address, device type, operating system, browser type and version, screen size, language setting, and identifiers associated with cookies and similar technologies.
Safety and integrity data. Records of reports made by or about you, moderation actions, blocks, automated safety flags, and records of any account we have closed.
3.3 Data we receive from others
Verification providers. Where we use a third party to confirm an identity, education or employment record, we receive the result of that check and, where applicable, a masked reference.
Payment gateways. Transaction status, the last four digits of an instrument, and failure or chargeback information.
Reports about you. Information another Member gives us when they report you.
Public sources and law enforcement. Information lawfully provided to us by a court, a police authority or a regulator.
3.4 Sensitive personal data
3.4.1 Some of what you give us is sensitive personal data or information under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and personal data of a sensitive character in ordinary use. This includes your identity documents, your financial transaction records, and, where you choose to provide them, your religion, community or caste and your astrological details.
3.4.2 We collect sensitive personal data only where it is necessary for the purpose we describe, only with your consent, and only for as long as that purpose requires.
3.4.3 We do not ask for your HIV status and you are not required to disclose it. Consistent with the Human Immunodeficiency Virus and Acquired Immune Deficiency Syndrome (Prevention and Control) Act, 2017, we will not require such disclosure and will not act adversely on it if it is volunteered.
3.4.4 We do not collect biometric data. A live selfie is used to compare against your identity document at the time of review and is handled as described in clause 8.
4. Why we use your personal data
We use personal data only for the purposes below, each of which is notified to you before or at the time of collection.
| Purpose | Data used |
|---|---|
| Creating your account and letting you log in | Account and identity data, device data |
| Verifying that you are a real, eligible person | Verification data, identity data |
| Building and displaying your profile to other Members according to your privacy settings | Profile data, photographs |
| Producing your daily introductions, match list and search results | Profile data, preference data, usage data, verification status |
| Producing a Match Score or a Kundali indication where your Membership and both Members’ choices allow | Profile data, preference data, astrological data |
| Enabling requests, messages and consent based number sharing between Members | Communications data |
| Keeping the Platform safe: detecting fraud, impersonation, harassment, solicitation and prohibited content, and enforcing our Terms | All categories |
| Handling reports, grievances and appeals | Communications data, safety data |
| Processing payments, issuing invoices and handling refunds | Payment data, identity data |
| Sending you service communications | Contact data |
| Sending you marketing communications, only where you have separately consented | Contact data |
| Measuring in aggregate how the Platform is used and improving it | Usage data, device data |
| Complying with law, responding to lawful requests, and establishing, exercising or defending a legal claim | All categories |
We do not use your personal data for automated decision making that produces a legal effect on you. Match Scores, introductions and search ordering are suggestions for your consideration and are not decisions about you.
5. Our legal basis
5.1 We process your personal data on the basis of the consent you give at registration, in response to the itemised notice presented to you at that time, and any further consent you give for a specific purpose such as marketing or a success story.
5.2 We also process personal data for certain legitimate uses recognised under the Digital Personal Data Protection Act, 2023, including where you have voluntarily provided data for a specified purpose and have not indicated that you object, and where processing is necessary to comply with a law, a judgment, an order or a direction of a court or authority in India.
5.3 Where you withhold or withdraw consent for data that is necessary to provide the Services, we will not be able to provide the Services to you.
6. What other Members can see, and what they can never see
6.1 Always visible to eligible Members. Your first name, age, city, profession, highest education, verification badges, and the parts of your profile you have chosen to make visible.
6.2 Visible according to your settings. Your photographs, your full name, your detailed profile fields, and your call window preference.
6.3 Never visible to any Member. Your mobile number and email address unless you have expressly agreed to share your number through the consent flow in the Platform, your date of birth as an exact date, your identity or verification document images, your document numbers, your payment details, your password free login credentials, the identity of anyone you have blocked, the identity of anyone who has reported you, your private messages with any other Member, and the reasons you gave when you passed on someone.
6.4 Number sharing is on your terms. Your number is never shown automatically. Your privacy setting says who may reveal it, paying Members or only Members whose request you have accepted, and each paying Member has a small daily limit on the contact details they may reveal. A paid Membership does not entitle anyone to a number your settings do not allow. You can change the setting at any time, and it applies from that moment. We cannot recover a number the other person has already seen, saved, written down or memorised.
6.5 The Community. Anything you post in the Community is visible to every Member who can read the Community. A Community byline carries only a first name and a relative date. It links to a profile only where the two of you already have an accepted connection.
7. Who we share your personal data with
7.1 Other Members, to the extent your profile and privacy settings allow, as described in clause 6.
7.2 Service providers acting for us under contract. These are:
- cloud hosting and storage providers;
- identity, education and employment verification agencies;
- payment gateways and payment processors;
- email, SMS and one time password delivery providers;
- customer support and ticketing tools;
- aggregate analytics and error monitoring tools;
- security, anti fraud and content moderation tools; and
- professional advisers, including lawyers, auditors and accountants.
Each of them may use your personal data only to provide that specific service to us, must protect it to a standard no lower than this policy, and must not use it for their own purposes. A current list of the categories of our processors is available on request from privacy@myhumdum.com.
7.3 Law enforcement, courts and regulators, where we are required to disclose under a lawful order or a valid request from an authorised agency, or where disclosure is necessary to prevent or investigate an offence, to protect the safety of a person, or to establish, exercise or defend a legal claim. Where the law permits us to do so, we will tell you that your information has been requested.
7.4 A successor entity, in the event of a merger, restructuring, acquisition or sale of all or part of the business, on notice to you and on terms no less protective than this policy.
7.5 We do not sell, rent, licence or trade your personal data. We do not share your contact details with advertisers, data brokers, marriage bureaus, brokers, agents or any third party for their own marketing purposes.
8. Verification documents
8.1 Verification is the core of this Platform and it cannot be done without processing the documents you upload.
8.2 Document images are deleted as soon as the review is completed, whether the check succeeds or fails, and in no case are they retained for more than 90 days from upload. What we keep afterwards is the outcome of the check, the category verified, the date of verification, and where applicable a masked reference.
8.3 Where identity verification involves Aadhaar, we do so only by a route permitted by the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and the rules and regulations made under it, being offline verification with your consent or a document you yourself fetch and share through DigiLocker. We never require Aadhaar, we never store a full Aadhaar number, and we never display an Aadhaar number to anyone. We store only the last four digits, the verification result and the date. You may complete identity verification using a passport, driving licence, voter identity card or other accepted document instead.
8.4 A verification badge confirms only that a specified document or check was completed. It is not a character certificate, a criminal record check, a credit check, a health check or an assurance of any person’s honesty, intentions, finances, family circumstances or suitability for you. We do not conduct criminal record checks unless we have expressly said so.
8.5 We take reasonable care in reviewing documents, but we are not a forensic document examiner, an investigation agency or a background screening agency. We do not accept legal responsibility for a document that is forged, altered or obtained by fraud and that passes a reasonable review, or for any statement a Member makes about themselves that we have not expressly verified. Where we discover a forgery we close the account, retain the evidence and may report the matter to the police.
9. How long we keep your personal data
We keep personal data only for as long as the purpose requires, and then delete or irreversibly anonymise it. Where the law requires a longer period, the law prevails.
| Category | Retention period |
|---|---|
| Profile data, preference data, photographs | While your account is active. Removed from view immediately on deletion, and deleted or anonymised within 30 days |
| Registration records (name, mobile number, email, account identifiers) | 180 days after your account is closed, as required by Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 |
| Verification document images | Deleted on completion of review, and in no case later than 90 days from upload |
| Verification results, badge category and date, masked references | While your account is active, and 180 days after closure |
| Requests, notes and private messages | While your account is active, and deleted within 180 days after your account is closed |
| Content that has been reported, flagged or moderated, and the associated records | 3 years from the date of the report, or until any investigation, grievance or proceeding relating to it concludes, whichever is later |
| Enforcement records for an account we have closed for breach: a hashed reference to the mobile number and email, the date, and the reason | Retained for as long as necessary to prevent a person we have removed from returning to the Platform, and for the defence of any claim |
| Grievance and support records | 3 years from closure of the grievance |
| Payment, invoice, GST and accounting records | 8 years, as required by section 128 of the Companies Act, 2013 and applicable tax law |
| Consent records, including the version of the notice you accepted, the date, the time and the IP address | 5 years from withdrawal or account closure, for the purpose of demonstrating compliance |
| Server logs, security logs and cookie data | 12 months |
| Backups | Overwritten in the ordinary backup cycle, within 30 days |
Personal data preserved for an ongoing investigation, a grievance, a regulatory request, or a legal or contractual claim is retained until that matter concludes, notwithstanding the periods above.
10. Where your personal data is stored and transferred
10.1 We store personal data on servers located in India wherever practicable.
10.2 Some of our service providers process data outside India. Where we transfer personal data outside India, we do so only to the extent permitted by the Digital Personal Data Protection Act, 2023 and any restriction notified by the Central Government, and only under contractual terms that require the recipient to protect the data to a standard no lower than this policy.
10.3 We do not transfer personal data to any country or territory that the Central Government has restricted.
11. How we protect your personal data
11.1 We implement reasonable security safeguards, consistent with section 8(5) of the Digital Personal Data Protection Act, 2023 and Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. These include encryption of data in transit, access controls limiting who on our team can see what, role based administrative access, logging of administrative actions, secure session handling, prompt deletion of document images, and periodic review of our security practices.
11.2 We restrict access to personal data to those of our personnel who need it to do their work, and they are bound by confidentiality obligations.
11.3 No system, and no transmission over the internet or a mobile network, can be guaranteed to be completely secure. While we take the measures described above, we do not warrant absolute security, and we are not liable for unauthorised access, disclosure, loss or alteration that occurs despite reasonable security safeguards, or that is caused by an event outside our reasonable control, including a failure of a telecommunications network, an internet service provider, your own device, or a third party service.
11.4 You are responsible for keeping your own device, email account and mobile number secure, and for the activity carried out through your account. Tell us immediately at security@myhumdum.com if you believe your account has been accessed without your permission.
12. Your rights
12.1 As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the right:
- to information. To obtain a summary of the personal data we process about you and of the processing activities we carry out;
- to correction and erasure. To have inaccurate or misleading data corrected, incomplete data completed, data updated, and data erased where it is no longer needed for the purpose it was collected for and where we are not required by law to retain it;
- to nominate. To nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
- to grievance redressal. To a readily available means of raising a grievance with us, which we must answer;
- to withdraw consent at any time, as described in clause 13.
12.2 You can exercise most of these rights directly from your account settings. You may also write to our Data Protection contact at privacy@myhumdum.com from your registered email address. We may ask you for information sufficient to confirm your identity before we act, in order to protect you from someone impersonating you.
12.3 We will respond to a request within 30 days. Where a request is manifestly unfounded, repetitive, or would infringe another person’s rights or privacy, we may decline it and will tell you why. In particular, we will not disclose the identity of a person who has reported you, the identity of a person who has blocked you, another Member’s personal data, or our internal safety and moderation reasoning, because doing so would expose another person to risk or assist a person in evading enforcement.
12.4 If you are not satisfied with our response, you may escalate to our Grievance Officer under clause 17, and after that to the Data Protection Board of India.
13. Withdrawing your consent
13.1 You may withdraw your consent at any time, and it must be as easy to withdraw as it was to give.
13.2 You can withdraw consent for a specific optional purpose, such as marketing communications, astrological matching, or the use of a success story, without affecting your account.
13.3 Because the Services cannot be provided without processing your account, profile and verification data, withdrawing consent for those purposes means closing your account. We will tell you this before we act on the withdrawal.
13.4 Withdrawal does not affect the lawfulness of processing carried out before the withdrawal, and it does not affect data we are required by law to retain or data we must keep to defend a legal claim or to enforce a safety decision.
14. Your duties as a Data Principal
14.1 Section 15 of the Digital Personal Data Protection Act, 2023 places duties on you. You must:
- comply with applicable law when exercising your rights;
- not impersonate another person while providing your personal data for a specified purpose;
- not suppress any material information while providing your personal data for any document, unique identifier, proof of identity or proof of address issued by the State;
- not register a false or frivolous grievance or complaint; and
- furnish only information that is verifiably authentic when exercising the right to correction or erasure.
14.2 A breach of these duties is punishable with a penalty of up to Rupees 10,000 under the Act. A breach of these duties is also a breach of our Terms, and we may close your account.
15. Children
15.1 The Platform is for adults only. Under the Digital Personal Data Protection Act, 2023 a child is a person below 18 years of age, and we do not knowingly collect or process the personal data of any child.
15.2 Our minimum age to register is 21 years for men and 18 years for women, consistent with the Prohibition of Child Marriage Act, 2006. We verify age against a government issued identity document.
15.3 If we discover that a person below the applicable minimum age has registered, we close the account and delete the data, other than the minimum record we must keep to prevent re registration.
15.4 We do not carry out tracking, behavioural monitoring or targeted advertising directed at children.
15.5 If you believe a person below the applicable minimum age has registered, tell us at safety@myhumdum.com and we will act promptly.
16. Cookies and similar technologies
16.1 We use cookies, local storage and similar technologies to keep you logged in, keep your session secure, remember your preferences, and understand in aggregate how the Platform is used.
16.2 We do not use advertising cookies and we do not permit third party advertising trackers on the Platform.
16.3 Our Cookie Policy at www.myhumdum.com/cookies describes each category, its purpose and its duration, and explains how you can accept or refuse non essential cookies from the notice shown on your first visit and from your browser settings.
17. Communications and marketing
17.1 Service communications are part of the Service and you cannot opt out of them while your account is active. These include one time passwords, request and message notifications, payment receipts, safety notices and notices of changes to our terms.
17.2 Marketing communications require your separate consent, and every one of them carries a one click unsubscribe. Unsubscribing from marketing does not affect service communications.
17.3 We do not make outbound sales or telemarketing calls, and we will not ask you to override your registration on the Do Not Disturb register or the National Customer Preference Register. We may call you only for identity or safety verification, to answer a support request you raised, or where a payment or account issue requires it, and only at reasonable hours.
17.4 We may communicate by email, in app notification, SMS, and, where you have opted in, WhatsApp.
18. Important limitations and your responsibilities
This clause is important. Please read it.
18.1 The accuracy of what a Member says about themselves is that Member’s responsibility. We verify identity, and such other categories as we state on a profile, by the checks described in clause 8. We do not, and cannot, verify the truth of every statement any Member makes about their family, intentions, health, finances, character or circumstances. We accept no legal responsibility or risk arising from information that is wrong, incomplete, out of date or misleading and that has been presented by a Member. You must use your own judgement, ask your own questions and make your own enquiries before taking any decision, including a decision to meet, to introduce families, or to marry.
18.2 Information you choose to show another Member can be copied by that Member. Our Terms prohibit screenshotting, downloading, copying, scraping and republishing another Member’s photographs, details or messages, and we act on reports of it. But the prohibition is a rule, not a technical impossibility, and we cannot guarantee that another person will obey it. Please share only what you are comfortable sharing, and understand that a number, a photograph or a detail you have shown to someone cannot be unshared from that person’s memory or their own device.
18.3 Information you make public is outside our control. Where you have yourself placed information in the public domain, on a social media platform or elsewhere, and a third party finds and misuses it, that misuse is not attributable to us.
18.4 Third party platforms have their own policies. Where you use a social login, a payment gateway, a messaging application or any other third party service in connection with the Platform, that provider’s own privacy policy governs what it does with your data. We are not bound by it and we are not responsible for it.
18.5 Links to other websites are provided for convenience only. We do not endorse them and we are not responsible for their content or their handling of your data.
18.6 Profile Managers. If you operate a Managed Profile, you are responsible for having obtained the Member’s informed written consent, for keeping it, and for producing it to us on request. The Member remains the Data Principal and holds all rights in respect of their data.
18.7 Our liability in connection with this policy is subject to the disclaimers and the limitation of liability in our Terms, other than any liability that cannot be excluded or limited under applicable law, including liability for fraud, wilful misconduct, gross negligence, and your rights as a consumer under the Consumer Protection Act, 2019.
19. If there is a personal data breach
19.1 If a personal data breach occurs, we will intimate each affected Data Principal without delay, in clear and plain language, describing the nature and extent of the breach, its likely consequences, the measures we are taking, and what you can do to protect yourself.
19.2 We will notify the Data Protection Board of India within the time and in the manner required by the Digital Personal Data Protection Act, 2023 and the rules made under it.
19.3 We maintain an internal breach response process, and we log every breach, the remedial measures taken and the outcome.
20. Changes to this policy
20.1 We may update this policy to reflect a change in the Platform, in our practices, or in the law. The version number and effective date at the top of this document are updated with every change.
20.2 Where a change materially affects how we use personal data you have already given us, we will tell you before the change takes effect, and where the law requires it, we will ask for your consent again.
20.3 Continued use of the Platform after a change takes effect means you accept the updated policy, save where fresh consent is required by law.
21. How to reach us
| Purpose | Contact |
|---|---|
| Privacy and data protection, and all Data Principal rights | privacy@myhumdum.com |
| Grievance Officer, appointed under Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and section 13 of the Digital Personal Data Protection Act, 2023 | Name: Sourabh Surage. Email: grievance@myhumdum.com. Telephone: +91 70213 95589, available Monday to Friday, 10:00 to 18:00 IST. Address: 6th Floor, WeWork Spectrum Tower, Building No. 11, Chincholi Bunder Road, Malad (West), Mumbai 400064, Maharashtra, India |
| Safety, fraud and abuse | safety@myhumdum.com |
| Account security | security@myhumdum.com |
| General support | support@myhumdum.com |
| Billing and refunds | billing@myhumdum.com |
21.1 We acknowledge every grievance within 24 hours and dispose of it within 15 days of receipt.
21.2 If you are not satisfied with the outcome of a grievance relating to your personal data, you may complain to the Data Protection Board of India. If your grievance relates to content or conduct on the Platform, you may appeal to the Grievance Appellate Committee constituted under Rule 3A of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, at gac.gov.in, within 30 days of receiving our decision.