Legal

Privacy Policy

Last updated: 11 October 2026

This policy explains what personal data SaAHa collects, why we collect it, who it is shared with, how long we keep it and the choices you have. It covers the SaAHa mobile app for Android, iPhone and iPad, and this website.

SaAHa is operated by Vanshikara Solutions Private Limited, M201, Pbel City, Appa Junction, Hyderabad 500091, Telangana, India (“SaAHa”, “we”, “us”). We are the data fiduciary for the personal data described here, under India's Digital Personal Data Protection Act, 2023.

1. What we collect

Information you give us:

• Account details: your name, mobile number, date of birth and gender, and an email address if you add one.
• Profile photo: optional.
• Celebrity profile: if you join as a celebrity, your bio, categories, city and state, social media handles, services, prices, availability and any NGO you choose to support. This profile is visible to signed-in users, because it is how fans find you.
• Booking details: the message you write to a celebrity and, for some services, a recipient's name, an occasion or a topic.
• Ratings and feedback: the stars and written feedback you give after a call. Fans rate celebrities and celebrities rate fans.
• Payout details: celebrities only. Your bank account holder name, account number, IFSC, bank and branch, or a UPI ID.
• Verification: celebrities only. Your verification call booking and outcome, and anything you submit if you appeal a decision, such as a message, a portfolio link or links that show who you are.
• Reports and blocks: the reason and any note you give when you report someone, and the list of people you have blocked.
• Support messages: anything you send us at our support address.

Information created as you use SaAHa:

• Booking records: who booked whom, the service, date, time and duration, the amount, the GST and the booking's status.
• Payment records: order, payment and refund reference numbers from our payment processor, and the refund status.
• Call records: that a call took place and when each participant joined it. We do not record calls.
• Safety records: if our on-device safety check flags content on a call, a single still image from that moment, the detection result and the related report. See section 3.
• Consent record: the date you accepted our terms and the version you accepted.
• Notification tokens: a device identifier that lets us send you booking updates and call reminders.
• Crash reports: technical details when the app crashes. See section 2.
• Usage data: which screens you open and the actions you take in the app, such as viewing a profile, starting a payment or joining a call, together with your account ID, your role, the app version and your device type. See section 2.

2. Analytics, and what we do not collect

We use Google Analytics for Firebase to understand how the app is used and to improve it. It records the screens you open and actions such as signing in, viewing a profile, starting or completing a payment, joining a call or leaving a rating. This usage data is linked to your account ID. It never includes your name, phone number, email address, the messages you write, anything said or shown on a call, or your payment or payout details. You can switch it off at any time in Profile → Settings → Privacy & Security → Usage analytics.

We do not use advertising or cross-app tracking software. The app does not collect an advertising identifier. We do not build advertising profiles, we do not sell personal data, and we do not track you across other apps or websites.

We do use Firebase Crashlytics to find and fix crashes. When the app crashes, it sends a crash report containing technical details such as the error, your device model, operating system version, app version and a random installation identifier. We do not attach your name, phone number or account ID to crash reports.

We never see or store your card number, UPI PIN or bank login details; see section 4. We do not access your location, contacts, calendar or SMS messages.

Razorpay's payment component can see which UPI payment apps are installed on your device so it can offer them at checkout. That check happens inside Razorpay's component, and the result is not sent to us.

3. Video calls and safety monitoring

Calls are carried over Agora's real-time network. Access to each call is protected: only the two people on the booking receive a key to join it, and only during the booking's time window. Call audio and video are encrypted with a key created for that call, which Agora does not hold. Calls are not recorded, stored or transcribed, by us or by Agora on our behalf.

Safety monitoring. To protect both people on a call, each phone runs an automated check on the other participant's video to detect nudity and sexually explicit content. It works as follows:

• About once per second, the app takes a still image of the video you are receiving and analyses it on your device, using a model built into the app. The image is deleted from the device straight after the check.
• Nothing is sent to us unless content is flagged. When it is, that single image, the detection scores, the time and the two participants' account IDs are uploaded to our secure storage, and a safety report is created.
• Flagged images and safety reports are accessible only to authorised members of our safety team, who review them to protect users and enforce our Terms of Service.
• The video you send is checked by the other person's phone in the same way. Celebrity verification calls with our team are not monitored.
• We do not analyse call audio, and we do not use call images for advertising, profiling or training models.

We carry out this monitoring because it is necessary to keep users safe and to meet our legal obligations to act against unlawful content.

While a call is on screen, the app also asks your operating system to block screenshots and screen recording. This protection is provided by the operating system and cannot defeat every capture method, such as photographing the screen with another device.

4. Payments and payouts

Payments are processed by Razorpay. You enter your card, UPI, net-banking or wallet details in Razorpay's own secure checkout, and those details never reach our systems. We store the order, payment and refund reference numbers Razorpay returns, the amount and the GST. We do not store your card number, the last four digits or any other payment instrument detail.

To run checkout and match each payment to its booking, we send Razorpay your name, email address and mobile number (to fill in the payment form), and order details: the booking reference, the service, the date and time, the amounts, and the names and account IDs of the fan and the celebrity. Razorpay handles this data under its own privacy policy.

For celebrities, we store the bank or UPI details you enter so that we can pay you. Each payout record keeps a copy of the account it was paid to, as proof of payment. If you delete your account, the account number on completed payout records is reduced to its last four digits.

5. Who can see your information

• The celebrity you book sees your name, profile photo and booking details, and any rating and feedback you give them. They do not see your mobile number, email address or date of birth.
• A fan who books you sees your name, photo and public celebrity profile, and any rating and feedback you give them. They do not see your mobile number, email address or payout details.
• Other signed-in users can see celebrity profiles, services, prices, available slots, average ratings and profile photos. Booked slots appear to others only as unavailable times; the booking itself, including who made it, is visible only to the fan, the celebrity and our team.
• Our team can access account, booking, payment, payout and safety records where needed to run the service, verify celebrities, process payouts, handle reports, resolve disputes or meet a legal obligation.

When you report someone, we do not tell them who made the report.

6. Service providers, and where your data is stored

We share personal data only with the providers we need to run SaAHa:

• Google Firebase (Google LLC): sign-in, database, file storage, server functions, push notifications, crash reporting and usage analytics. Phone sign-in is protected by Google reCAPTCHA and, on Android, Google Play Integrity, which check that requests come from a genuine app.
• Razorpay (Razorpay Software Private Limited): payments and refunds.
• Agora: carries live audio and video during calls.
• Google Sign-In: only if you choose to sign in with Google.
• Google Fonts: this website loads its fonts from Google, which receives your IP address when you visit.
• NGOs: an NGO receives donated amounts, not your personal details.

Your account, booking and safety records are stored on Google Cloud servers in India (Mumbai). Some providers, including Agora's call network and Firebase's crash reporting, usage analytics and push notification services, may process data outside India. Where they do, the transfer is made in line with the Digital Personal Data Protection Act, 2023 and any restrictions notified under it.

We may also disclose information where the law requires it, for example to comply with a valid order from a court or a government authority.

7. Permissions the app asks for

• Camera and microphone: for video calls, and the camera for taking a profile photo. The app shows you a preview before you join a call.
• Photos: to choose a profile photo, and on iPhone and iPad to save an image you choose to save.
• Notifications: booking updates and call reminders.
• Face ID, Touch ID, fingerprint or device PIN: only if you turn on App Lock, and when you confirm account deletion. Biometric data stays on your device; we never receive it.
• Bluetooth: to route call audio to a connected headset.

You can refuse or withdraw any of these in your device settings, although some features will not work without them.

The calling, notification and payment components also use some standard permissions that do not ask you: network and Wi-Fi state, keeping the device awake during a call, vibration, restoring reminders after the phone restarts, and, for Razorpay, NFC, basic phone state and the ability to see which UPI apps are installed. We do not use these to identify or track you.

8. What is stored on your device

The app keeps a small amount of data in its private storage on your device: your theme preference, whether you have seen the introduction, your App Lock setting, a partly completed sign-up form so you do not lose your answers if the app closes, and a copy of your profile so the app opens quickly. Passwords are never saved in the sign-up form, and the form is cleared when you finish signing up or sign out. Your payout details are not kept in the saved profile.

Like most apps, SaAHa's database component also keeps an offline copy of information you have recently viewed, so the app works on a weak connection. This copy stays inside the app's private storage, which other apps cannot read, and is removed when you uninstall the app.

9. How long we keep your data

• Your account and profile: for as long as you have an account. Deleting your account removes them immediately, as described below.
• Booking, payment, payout and donation records: 8 years from the end of the financial year they relate to, as required by Indian tax and company law.
• Safety records (reports, flagged images and detection results): up to 3 years from the incident, or longer if they are needed for a legal claim, an investigation or a request from law enforcement.
• Call records: for as long as the booking record they relate to.
• Crash reports: kept by Firebase Crashlytics for up to 90 days.
• Usage data: kept by Google Analytics for up to 14 months.

10. Deleting your account

You can delete your account at any time from Profile → Settings → Delete account. Your sign-in, name, contact details, date of birth, gender, photos, bio, social links, payout details, notification tokens, availability, appeals and block list are deleted immediately. Your written feedback and booking messages are removed from your bookings. We also ask Google Analytics to delete the usage data linked to your account; Google removes it from our reports within a few days and from its systems within about two months.

Some records are kept for the periods in section 9, because they are also the other person's records, because the law requires them, or for safety. On booking, payout and donation records your name is replaced with “Deleted user” and payout account numbers are masked. Safety reports and flagged images are kept as they are. The payment records we keep for each order, including the booking details sent at checkout, are kept for the financial records period, and Razorpay holds its own copy under its own policy. Full details are here.

11. Age

SaAHa is only for people aged 18 and over. We check your date of birth at sign-up and do not open accounts for anyone younger. We do not knowingly process the personal data of children. If you believe a child is using SaAHa, contact us and we will close the account.

12. Your rights

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• get a summary of the personal data we hold about you and how we use it;
• have inaccurate or incomplete data corrected, and outdated data updated;
• have your data erased, subject to the records we must keep by law;
• withdraw your consent at any time, which you can do by deleting your account, or for usage analytics alone by switching it off in the app;
• nominate another person to exercise these rights if you die or become unable to; and
• have your complaints about how we handle your data addressed.

You can view and correct most of your details in the app under Profile → Edit Profile. For anything else, email admin@vanshikara.com. We may need to confirm your identity before acting on a request, and we will respond within 30 days.

13. Grievance Officer

If you have a complaint about SaAHa or how we handle your personal data, you can contact our Grievance Officer, appointed under the Information Technology Act, 2000, its rules and the Digital Personal Data Protection Act, 2023:

Chandana Paruchuri
Grievance Officer, Vanshikara Solutions Private Limited
M201, Pbel City, Appa Junction, Hyderabad 500091, Telangana, India
admin@vanshikara.com

We will acknowledge your complaint within 24 hours and aim to resolve it within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

14. Changes to this policy

If we change this policy, we will update the date at the top and, where the change is significant, tell you in the app before it takes effect.

15. Contact

admin@vanshikara.com
Vanshikara Solutions Private Limited, M201, Pbel City, Appa Junction, Hyderabad 500091, Telangana, India

Terms of Service · Account deletion · Cancellation and refunds · Contact us