1. Who We Are

HEARRT is an AI-powered companion application owned and operated by Ekatva Infotech Private Limited (“Ekatva Infotech”, “HEARRT”, “we”, “us” or “our”). This Privacy Policy explains how we collect, use, store, disclose, protect and delete personal data when you use the HEARRT application, website and related services (collectively, the “Service”). It should be read together with the HEARRT Terms & Conditions and any specific privacy notices or consent screens presented in the App.

2. Our Core Privacy Commitments

We collect and process personal data only for disclosed purposes and to the extent permitted by applicable law.
We do not use your conversations, AI memory or personal information for behavioural advertising, targeted advertising, promotional profiling, product recommendations, cross-selling or upselling.
We do not sell your personal data.
We do not use your conversations or personal data to train or fine-tune AI models unless such use is separately permitted by law and, where required, you have provided the applicable specific consent.
We do not intentionally use private conversations to identify products or services to market to you.
We seek to minimise personal data collection and request device permissions only when needed for a feature.
We provide mechanisms for account deletion and privacy requests, subject to lawful retention requirements.

3. Personal Data We May Collect

The exact data collected depends on the features you use. HEARRT will not collect every category below from every user.

3.1 Account and Registration Data

Depending on the registration method, this may include name or display name, email address, mobile number, date of birth or age/age-band information, authentication identifiers, account ID and account status. If a sign-in provider is used, we may receive information that provider makes available to HEARRT, subject to its permissions and disclosures.

3.2 Conversations and User Content

HEARRT may process text, prompts, messages, questions, instructions and other content you voluntarily submit, together with AI-generated responses associated with your interaction. If HEARRT supports voice, image, video or file features, corresponding content may be processed when you choose to use those features.

3.3 AI Memory and Personalisation

If memory and personalisation are enabled, HEARRT may store selected information derived from conversations or directly provided by you, such as preferences, interests, communication preferences, persona settings and continuity information. Memory may be incomplete or inaccurate.

3.4 Device and Technical Data

Depending on the device and configuration, we may process device type, operating-system version, App version, language, time zone, IP address, network information, identifiers needed for security, crash information and technical logs.

3.5 Usage and Diagnostics

We may process limited information about feature usage, session events, performance, crashes, security events and aggregated usage statistics to operate, secure and improve the Service.

3.6 Subscription and Transaction Data

If you purchase a subscription, payment may be processed by Google Play, Apple App Store or another authorised provider. HEARRT may receive purchase status, subscription status, product, transaction identifier, renewal status and related billing metadata.

3.7 Support and Grievance Data

If you contact us, we may process your contact details, the contents of your request, attachments you choose to provide and information reasonably necessary to investigate and respond.

3.8 Optional Device Permissions

If HEARRT introduces microphone, camera, photos/files, notifications or other device features, the App will request the relevant permission where required. The purpose will be explained through the App or platform permission interface.

4. How We Use Personal Data

Create, authenticate and maintain your HEARRT account.
Provide AI conversations and companionship features.
Process prompts and other content to generate AI responses.
Provide optional memory and personalisation.
Provide voice, image, avatar or other features you actively choose to use.
Operate, maintain, troubleshoot and improve reliability and performance.
Detect, prevent and investigate fraud, abuse, security incidents, jailbreaking, prompt injection and unauthorised access.
Enforce our Terms & Conditions and AI Safety & Content Policy.
Respond to support, privacy and grievance requests.
Process subscriptions, purchases, cancellations and refunds.
Meet legal, regulatory, accounting and security obligations.
Send important service, security, transaction, legal or account-related communications.
Create appropriately de-identified or aggregated analytics where permitted by law.

5. What We Do NOT Use Your Data For

HEARRT is intentionally designed around a privacy-first commercial model. Unless we separately notify you and obtain any consent required by applicable law, we will not use your personal data, conversation history or AI memory for:

Behavioural or targeted advertising.
Building advertising profiles about you.
Selling or renting your personal data.
Third-party product or service recommendations based on private conversations.
Cross-selling financial products, insurance, loans, investments, healthcare products, consumer products or other services.
Upselling based on emotional state, conversation content or inferred personal circumstances.
Promotional profiling based on emotional conversations.
Providing conversation content to advertisers or marketing partners for their own marketing purposes.

We may send operational or transactional communications necessary to operate the Service, including account, security, subscription, billing, legal and support communications. These are not intended to constitute behavioural advertising or third-party promotional targeting.

The legal basis or statutory ground for processing depends on the nature of the processing and applicable law. Where consent is required, HEARRT will request it through clear affirmative action and will not bundle unrelated purposes into a single consent request. Where processing is permitted or required without consent, we may process on that basis. Where consent is the basis, you may withdraw it through an available mechanism, subject to lawful consequences.

7. Privacy Notice

Where applicable, HEARRT will provide a clear, understandable notice describing the personal data collected, purposes of processing, services or uses enabled, and mechanisms for withdrawal, exercising rights and making complaints. Where a materially new purpose or data category is introduced, HEARRT may provide an additional notice and seek additional consent where required.

8. OpenAI / ChatGPT Technology

HEARRT uses OpenAI technology, including OpenAI GPT models through the applicable OpenAI platform/API, to provide AI-generated responses and related AI functionality. When you submit a prompt or other content to an AI feature, information necessary to generate the requested response may be transmitted to OpenAI as an applicable service provider/processor or other applicable third-party processing role.

HEARRT will configure and use the OpenAI service under the commercial/API terms applicable to HEARRT. OpenAI currently states that inputs and outputs from its API/business offerings are not used to train its models by default unless the customer explicitly opts in. OpenAI also describes security and retention controls for qualifying API customers. HEARRT will not intentionally enable optional OpenAI model-improvement/data-sharing mechanisms for HEARRT user conversations unless permitted and, where required, appropriate consent has been obtained.

The exact OpenAI retention configuration, eligible zero-data-retention settings and processing locations applicable to HEARRT will be maintained internally and this Policy will be updated if a material change affects users. The App should use the OpenAI API/commercial service actually contracted by Ekatva Infotech; it should not describe consumer ChatGPT usage if the technical integration is an API integration.

9. Third-Party Service Providers

We may use service providers for cloud hosting, databases, AI processing, authentication, security, analytics, crash reporting, customer support, payments and other infrastructure. Providers may process personal data only for authorised purposes and subject to appropriate contractual or other safeguards.

We will not authorise third-party advertising partners to use HEARRT conversation data or AI memory for behavioural advertising, promotional targeting or cross-selling on our behalf.

10. Google Play and Apple App Store

HEARRT may be distributed through Google Play and the Apple App Store. These platforms may process certain information under their own policies and terms. Subscription transactions may be handled by the relevant store. HEARRT will provide privacy and data-safety/app-privacy disclosures required by the applicable platform and keep them consistent with the actual technical implementation.

11. AI-Generated Content and Safety

HEARRT is a generative-AI application. AI-generated responses may be inaccurate, inappropriate, biased, incomplete or unsafe. HEARRT uses safety controls designed to reduce prohibited or harmful outputs, but automated safeguards are not perfect.

HEARRT may process safety-related signals or content for limited purposes such as detecting abuse, protecting users, enforcing safety rules, investigating security incidents and improving safety systems, subject to applicable law. Safety processing is not used for advertising or cross-selling.

Where platform rules require an in-app mechanism to report or flag AI-generated content, HEARRT will provide an appropriate mechanism.

12. Emotional and Potentially Sensitive Conversations

Users may voluntarily disclose information about relationships, emotions, family matters, work, finances, health, sexuality or other personal circumstances. HEARRT does not require such information merely to use core conversational functionality unless directly relevant to a feature the user chooses. Users should avoid submitting information they do not want processed by an internet-connected AI service.

13. Children's Data

HEARRT is intended for adults and is not directed at children. Users must be at least 18 years old or the applicable higher age of majority. We do not knowingly design the Service to solicit children's personal data. If we become aware that an underage person has created an account contrary to our eligibility requirements, we will take appropriate action in accordance with applicable law, which may include suspension/deletion and deletion of associated data where legally appropriate.

We may disclose personal data only as reasonably necessary for the purposes described in this Policy, including:

OpenAI and other AI/service providers needed to deliver AI functionality.
Cloud hosting, database, security and infrastructure providers.
Payment processors and app stores for purchases and subscriptions.
Customer-support and operational providers.
Professional advisers, auditors or insurers where reasonably necessary and subject to confidentiality obligations.
Government authorities, courts or regulators where required or permitted by law.
A successor entity in a merger, acquisition, restructuring or sale of relevant business assets, subject to applicable law and safeguards.

We do not sell personal data and do not disclose conversation content to advertisers for their independent marketing purposes.

15. International Processing

Because HEARRT may use cloud and AI providers operating across multiple jurisdictions, personal data may be processed or stored outside India where permitted by applicable law. Where required, HEARRT will implement applicable safeguards, contractual measures, notices or other mechanisms.

HEARRT will not represent that all user data is stored exclusively in India unless the actual production configuration provides that guarantee.

16. Data Retention

We retain personal data only as long as reasonably necessary for the purpose for which it was collected, to provide the Service, maintain security, comply with legal obligations, resolve disputes, enforce agreements or protect lawful rights, subject to applicable law.

Retention periods may differ by category. Account information, transaction records, security logs, conversation content, AI memory and support records may have different retention requirements. HEARRT will maintain operational retention schedules and update this Policy if material changes affect users.

When data is no longer required and there is no lawful reason to retain it, we will delete, anonymise or de-identify it as appropriate.

17. Account and Data Deletion

HEARRT will provide a clear mechanism to initiate account deletion. Where required by distribution-platform rules, an external web-based deletion route will also be provided in addition to an in-app option.

Upon account deletion, we will delete or de-identify associated personal data that we are not legally required or otherwise lawfully permitted to retain. Limited data may be retained for legal, tax, accounting, fraud-prevention, security, dispute-resolution or regulatory purposes, subject to appropriate restrictions.

Deleting a HEARRT account does not necessarily cancel an Apple App Store or Google Play subscription; users must separately manage/cancel subscriptions through the applicable billing platform where required.

18. Your Privacy Rights

Subject to applicable law, you may have rights relating to your personal data, including access to information about processing, correction, updating, erasure, withdrawal of consent where consent is the basis, and grievance/complaint mechanisms.

We may verify identity before fulfilling a request. Requests may be submitted to: [privacy@hearrt.ai].

Where processing is based on consent, you may withdraw consent through an available in-App control or designated privacy channel. Withdrawal will not invalidate processing lawfully completed before withdrawal and may affect a feature where the relevant data or consent is necessary.

20. Security

We use reasonable technical and organisational safeguards appropriate to the nature of the data and risks involved. Depending on the architecture, safeguards may include encryption in transit and at rest, access controls, authentication, logging, monitoring, backup controls, vulnerability management and incident response. No internet service can guarantee absolute security.

21. Security, Jailbreaking and Abuse Monitoring

HEARRT may process limited technical information and relevant interaction data to detect and prevent jailbreaking, prompt injection, system-prompt extraction, safety-filter circumvention, automated abuse, fraud, malicious activity, unauthorised access and other security threats. This processing is for security, safety, service integrity and legal compliance and is not used for advertising or cross-selling.

Where an account is suspended or terminated for prohibited activity, relevant records may be retained for a reasonable period necessary to investigate, prevent recurrence, enforce the Terms or comply with law.

22. Cookies and Similar Technologies

The HEARRT website may use cookies or similar technologies necessary for security, authentication, preferences, analytics or website functionality. If non-essential cookies or tracking technologies are introduced, we will provide applicable disclosures and choices. Mobile-app SDKs and identifiers will be disclosed through the applicable platform privacy information.

23. Analytics

We may use analytics or diagnostic tools to understand aggregate service performance, crashes, feature reliability and general usage. Analytics will be configured to minimise personal data and will not be used to build advertising profiles from private HEARRT conversations. Before launch, HEARRT should maintain an internal inventory of all analytics SDKs and reconcile it with Google Play Data Safety and Apple App Privacy disclosures.

24. Payments and Subscriptions

Payments may be processed through Google Play, Apple App Store or authorised payment processors. HEARRT receives and retains only transaction information needed for subscriptions, entitlement, support, accounting, refunds and fraud prevention, subject to the provider's processing model. Payment providers may process data under their own policies. HEARRT does not use payment information or subscription history for unrelated advertising, promotional profiling or cross-selling.

25. User Content and AI Memory

You retain rights in your User Content subject to applicable law and third-party rights. HEARRT processes User Content to provide the features you request. AI memory is a personalisation mechanism and is not intended to create an independent advertising or marketing profile.

If you delete a memory, HEARRT will remove it from the active memory system subject to technical limitations and lawful retention requirements. Deleting a memory does not necessarily delete the underlying conversation history unless the applicable control expressly does so.

26. Third-Party Links

Third-party websites and services linked from HEARRT are governed by their own terms and privacy policies. HEARRT is not responsible for independent third-party privacy practices.

27. Data Breach and Incident Response

If a personal-data breach occurs, HEARRT will assess and respond in accordance with applicable law, including required notifications to users, regulators, the Data Protection Board of India or other competent authorities. Where appropriate, protective measures may include disabling compromised credentials, restricting access or requiring account-security actions.

28. Changes to this Privacy Policy

We may update this Policy to reflect changes in the Service, technology, legal requirements, providers or privacy practices. For material changes, we will provide reasonable notice and update the Last Updated date. Where law requires renewed consent or a new notice, we will provide it before the relevant processing begins.

29. Privacy and Grievance Contact

Privacy Contact: Rahul Jain
Email: info@hearrtai.com
Grievance Officer: Rahul Jain
Grievance Email: info@hearrtai.com
Website: www.hearrtai.com

We will acknowledge and address complaints within the timelines required by applicable law.

30. Governing Law

This Privacy Policy is governed by applicable laws of India, subject to mandatory privacy rights and protections that may apply to you.

31. Platform and Regulatory Alignment

This Policy is drafted with reference to the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and current Google Play and Apple App Store privacy, data-disclosure and account-deletion principles. These requirements may change. Actual compliance depends on the production implementation, SDKs, AI provider configuration, consent screens, permissions, data flows, retention settings and platform disclosures.

32. Production Data Inventory – Must Be Completed Before Publication

The following operational inventory should be completed and verified against the production architecture before the Policy is published:

Account data — exact fields, purpose, provider, retention.
Conversation data — exact storage, OpenAI/API flow, retention and deletion.
AI memory — fields stored, controls, retention and deletion.
Device/technical data — exact identifiers, logs and SDKs.
Analytics/crash tools — exact vendors and data collected.
Subscription data — Apple/Google/payment information received.
Optional voice/image/file data — exact providers and retention.
Support/grievance data — mailbox/ticketing provider and retention.
Exact OpenAI API configuration and contractual/data-processing terms.
Actual countries/regions in which HEARRT or processors store/process user data.

33. Final Publication Checklist

Use the exact legal entity name: Ekatva Infotech Private Limited across the App, Terms, Privacy Policy and store listing.
Confirm whether the technical integration is OpenAI API/GPT technology rather than consumer ChatGPT, and describe it accurately.
Confirm the OpenAI contract, data-processing terms and retention configuration before publication.
Complete Google Play Data Safety disclosures from the actual production data inventory.
Complete Apple App Privacy disclosures from the actual production data inventory.
Implement in-app account deletion and the required external deletion route.
Implement memory review/delete controls if memory is enabled.
Implement consent withdrawal controls wherever consent is used.
Complete privacy and Grievance Officer contact details.
Review every analytics, crash-reporting, authentication, payment and third-party SDK.
Confirm no advertising or marketing SDK receives HEARRT conversations or memory contrary to this Policy.
Confirm the product does not analyse conversations for product recommendations or cross-selling.
Have Indian privacy counsel review and approve the final Policy before launch.

Final Legal Review Notice: This Privacy Policy is a product/privacy drafting version and is not legal advice. Publication should occur only after legal review and reconciliation with the actual production architecture and contractual arrangements.

HEARRT will provide a standalone, understandable privacy notice at or before relevant processing where required by applicable law. The notice is intended to be readable independently of this longer Privacy Policy.

The standalone notice will itemise the personal-data categories relevant to the requested feature, state the specified purpose or purposes and the HEARRT service or functionality enabled, and provide the applicable route for exercising privacy rights, withdrawing consent where consent is used, and raising a grievance.

Consent will not be treated as authorization for unrelated commercial purposes. HEARRT will not use private conversations, AI memory or inferred emotional state for behavioural advertising, promotional profiling, product recommendations, cross-selling or upselling.

Where consent is withdrawn, HEARRT will stop consent-based processing for the relevant purpose, subject to processing otherwise permitted or required by law. Withdrawal does not affect processing lawfully completed before withdrawal.

Operational Privacy Controls

HEARRT will provide an account/data deletion mechanism appropriate to the platforms on which the Service is distributed, including an accessible in-app route and, where required, an external web route.

HEARRT is restricted to adults and is not directed to children. If an underage account is identified, HEARRT may take reasonable steps to restrict or delete the account and associated data, subject to applicable law.

Before publication, this Policy must be reconciled with the actual production inventory of authentication, analytics, crash reporting, payment, AI, cloud, support and other SDKs/providers, including real data flows, retention, international processing and deletion behaviour.

Privacy Policy