Privacy Policy

AyalonPlus Technologies Private Limited ("AyalonPlus", "we", "our", or "us") operates the Haybi loyalty rewards platform, available as a mobile application and through our website at ayalonplus.com (collectively, the "Platform" or "Service").

We respect your privacy and recognize the fundamental importance of protecting your personal information. This Privacy Policy describes how we collect, receive, store, use, share, and otherwise process personal information — including sensitive personal data — when you access or use the Haybi Platform.

By visiting, registering on, or using our Platform, you expressly agree to the terms of this Privacy Policy and our Terms of Service. If you do not agree, please do not access or use the Platform.

This policy applies to all parties who interact with the Haybi platform:

1. All users who download, install, register on, or otherwise access the Haybi mobile application, m-site, or website
2. Partner Merchants and their representatives who interact with our platform
3. Administrators who access the Haybi Admin Panel
4. Third-party vendors, service providers, contractors, and partners who act on behalf of AyalonPlus
5. All employees and officials of AyalonPlus with access to personal data

This policy does not apply to third-party websites or services linked from our Platform. We encourage you to review their privacy policies separately.

AyalonPlus collects and processes certain personal information to deliver, improve, and secure the Haybi Service. This policy is designed to:

1. Inform you clearly about categories of personal information collected, means of collection, purposes of processing, and parties with whom information may be shared
2. Describe the rights available to you as a data principal and mechanisms for exercising them
3. Ensure compliance with applicable Indian data protection laws and globally recognized best practices
4. Establish accountability and transparency in our data governance practices
5. Protect the rights and interests of users, employees, merchants, and third parties whose data we process

D.1 — Information You Provide Directly

a) Account & Identity

• Full name and display name
• Mobile phone number (primary identifier for OTP verification)
• Email address (optional, for communications and account recovery)
• Profile photograph (optional)
• Date of birth (for age verification)
• Gender (optional)

b) Payment & Reward Redemption

• UPI ID or bank account details (account number, IFSC code)
• Beneficiary name as registered with bank
• Transaction reference numbers

c) OTP Verification

OTPs are time-limited, not stored after validation, and never shared externally.

d) User-Generated Content

• Short video uploads ("Shorts"): video files, captions, hashtags, merchant tags
• Comments, replies, and reactions on Shorts and Merchant Stories
• Reviews and ratings
• Profile bio or description text

e) Social & Friends Data

• Friend requests sent and received
• Friendship status (active, pending, blocked)
• Block/unblock actions and optional reason for blocking

f) Support & Communications

• Messages sent to our customer support team
• Feedback via in-app surveys
• Content of complaints or grievance submissions

D.2 — Information Collected Automatically

a) Location Information

• Precise GPS coordinates: At check-in initiation (within 100m geofence radius)
• Approximate location: For surfacing nearby merchants
• Check-in history: Merchant location and timestamp per check-in

b) Device Information

• Device type, brand, model, OS version (Android/iOS)
• Unique device identifiers (IMEI, Android ID, IDFA/IDFV)
• Mobile network operator and connection type
• IP address and app version

c) Usage & Behavioral Data

• Features accessed and actions taken
• Game sessions, scores, and outcomes
• Points earned, redeemed, and current balance
• Daily challenge participation and streak data
• Videos watched, liked, commented on, shared, bookmarked, or reported
• Time spent on individual features and screens

d) Technical & Error Data

• App crash logs and error reports
• Session identifiers and timestamps
• API response times and failure events

D.3 — Information from Third Parties

• SMS OTP gateways: Message delivery status only
• Payment processors: Transaction confirmation and status
• Analytics providers: Aggregated and anonymized behavioral analytics
• Partner merchants: Confirmation of merchant-side redemption events

Summary Table

• Background location data or continuous movement tracking
• OTP codes stored after validation
• Full payment card numbers (credit/debit card data)
• Your mobile contacts, address book, or SMS inbox (without explicit permission)
• Personally identifiable information sold to third-party advertisers
• Personal data from children under 13 without verifiable parental consent
• Biometric data (fingerprints, facial recognition) of any kind
• Historical, continuous location traces or movement patterns

F.1 — Service Delivery

• Creating, authenticating, and managing your Haybi account
• Verifying identity through OTP-based mobile authentication
• Validating geofenced check-ins at partner merchants
• Crediting, tracking, and displaying your points balance
• Operating game sessions (Scratch Card, Trivia, Memory Match, Spin Wheel)
• Processing reward redemptions and coordinating with payment processors
• Displaying personalized feeds (Shorts For-You, Merchant Stories)
• Enabling social features: friend requests, acceptances, and blocking

F.2 — Fraud Prevention & Security

• Detecting, investigating, and preventing fraudulent check-ins or points manipulation
• AI-assisted fraud detection on anomalous check-in patterns
• Monitoring for account takeover or unauthorized access attempts
• Enforcing platform abuse prevention rules

F.3 — Communications & Notifications

• OTP messages for account verification
• Push notifications for points, challenges, rewards, and friend activity
• Marketing communications (only with explicit consent; opt-out anytime)

F.4 — Personalization

• Curating your Shorts "For You" feed based on viewing behavior
• Surfacing nearby merchants relevant to your location
• Recommending challenges and games based on activity patterns
• Adapting AI chat responses to your account context and loyalty tier

F.5 — Product Improvement & Analytics

• Analyzing feature usage to prioritize improvements
• A/B testing of new features
• Diagnosing technical issues using crash and error logs
• Generating aggregate, anonymized reports for internal business planning

F.6 — Legal & Compliance

• Maintaining immutable transaction audit logs as required by financial regulations
• Responding to valid legal process and government requests
• Enforcing our Terms of Service

F.7 — AI-Powered Features

• Providing context-aware AI chat assistance personalized to your loyalty activity
• Running AI-assisted content moderation checks on uploaded Shorts and comments
• Supporting fraud detection using AI analysis of check-in patterns

AyalonPlus processes personal data on the following lawful grounds, consistent with the SPDI Rules 2011 and DPDPA 2023:

1. Consent — Where you have expressly agreed to a specific processing purpose (e.g., marketing communications, AI chat, location-based check-ins)
2. Contractual Necessity — Where processing is necessary to deliver requested services (account management, points tracking, reward redemption)
3. Legal Obligation — Where processing is required by applicable Indian laws (financial transaction records, lawful authority requests)
4. Legitimate Interests — For fraud prevention, security monitoring, and product analytics, balanced against your rights
5. Vital Interests — In exceptional circumstances to protect life, health, or safety
6. Public Interest — Where required for functions of government or public authority

H.1 — Partner Merchants

• Anonymized confirmation that a check-in event occurred
• Aggregate check-in statistics for merchant analytics (no individual identification)
• Your name and contact details only if you explicitly redeem a merchant-specific reward

Merchants do not receive your raw GPS coordinates, device data, or game history.

H.2 — Trusted Service Providers

H.3 — User-to-User Visibility

• Your display name and profile photo on leaderboards
• Public Shorts content you upload (visible to all users)
• Comments you post on Shorts or Stories

You control the privacy of your profile through in-app settings.

H.4 — Legal Requirements & Safety

We may disclose information without prior consent when required by a valid court order, demanded by government/law enforcement, necessary to prevent fraud, or to protect rights, property, or safety of AyalonPlus, users, or the public.

H.5 — Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will notify you in advance and the data will remain subject to equivalent privacy protections.

H.6 — Aggregated & Anonymized Data

We may share de-identified aggregate data with business partners and researchers. This data is not personal information and cannot identify any individual.

AyalonPlus is an Indian company and primarily processes your data within India. In cases where we engage cloud infrastructure or AI providers with servers outside India, we ensure:

• The transfer is necessary for the performance of the service you requested
• The recipient country or provider offers data protection substantially equivalent to Indian standards
• Appropriate contractual safeguards (standard contractual clauses or equivalent) are in place
• Your explicit consent is obtained where required under applicable law

We will not transfer your sensitive personal data outside India except under the conditions above or as mandated by applicable regulatory requirements.

We retain your personal information for as long as necessary to fulfill the purposes described in this policy, comply with legal obligations, and resolve disputes.

*Except legally required records, retained in isolated access-controlled environment.

After the applicable retention period, data is either securely deleted or anonymized for aggregate analytical use.

L.1 — How We Obtain Consent

• Registration flow (explicit tick-box acceptance of this policy and Terms of Service)
• In-app permission dialogs before accessing device capabilities (camera, location, notifications)
• Feature-specific consent dialogs (AI chat, background data sync)

Consent is recorded with a timestamp and the version of the policy in effect at the time.

L.2 — Granular Consent Options

Manage consent via Profile → Settings → Privacy:

• Location access (precise GPS)
• Push notification categories (points alerts, marketing, friend requests, game reminders)
• AI chat feature activation
• Data sharing for personalization
• Marketing communications by email and SMS

L.3 — Withdrawing Consent

Withdraw via in-app settings or by contacting privacy@ayalonplus.com. We process your request within 7 business days.

L.4 — Consequences of Withdrawal

We will inform you which features will become unavailable before you withdraw consent. We will not penalize you beyond the necessary functional limitations.

L.5 — Marketing Opt-Out

• Toggle off Promotional Notifications in app settings
• Click "Unsubscribe" in any marketing email
• SMS STOP to our registered sender ID

M.1 — Technical Safeguards

• Encryption in transit: TLS 1.2+ (HTTPS/SSL) for all data transmission
• Encryption at rest: AES-256 for sensitive database fields
• Password security: All admin passwords hashed with bcrypt; user accounts use OTP (no stored passwords)
• Token security: JWT tokens include type-checking to prevent confusion attacks; refresh tokens stored hashed
• API security: Rate limiting, input validation, and parameterized queries against injection attacks
• File upload security: Validation for type, size, and malicious content before processing

M.2 — Organizational Safeguards

• Strict role-based access controls (RBAC): SUPER_ADMIN, MANAGER, and SUPPORT roles
• All staff with access to personal data bound by confidentiality obligations
• Regular security awareness training
• Immutable Admin Audit Log for all administrative actions
• Vendor agreements require equivalent security standards

M.3 — Infrastructure Safeguards

• Hosting on SOC 2 Type II compliant cloud providers
• Regular vulnerability assessments and penetration testing
• Automated backups with tested restoration procedures
• Incident response plan with defined escalation procedures

M.4 — Data Breach Response

1. Contain the breach and notify our security incident response team immediately
2. Notify affected users within 72 hours of becoming aware, where required by law
3. Report to competent authorities with: nature of breach, categories and volume of data, likely consequences, and remediation measures
4. Maintain a record of all breaches and response actions

We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided personal information, we will take immediate steps to delete such data.

If you are a parent or guardian and believe your child under 13 has created a Haybi account, please contact us immediately at privacy@ayalonplus.com. We will verify and, where confirmed, delete the information.

We use the date of birth provided at registration to verify age eligibility and process data of minor users (13–18) in a manner that prioritizes their best interests.

O.1 — Mobile Application

We do not use mobile advertising identifiers (IDFA/GAID) for cross-app advertising tracking without your explicit consent.

O.2 — Website (ayalonplus.com)

Haybi includes AI-powered features to enhance your experience. Your data may be processed by our AI systems as follows:

Q.1 — Privacy by Design

• Data minimization: we collect only the minimum data necessary for each function
• Privacy settings default to the most protective configuration
• Privacy impact assessments conducted before launching features with new data categories
• Data processing pipelines documented and reviewed by our privacy team

Q.2 — Transparency Reports

We are committed to publishing information about: categories of personal data collected, processing purposes and legal bases, government data requests (where legally permissible), and security incidents affecting users.

Q.3 — Security Audits

We commission independent security audits at least annually. Audit findings are reviewed by senior management and remediation tracked to closure.

Q.4 — Data Protection Impact Assessments (DPIA)

Before introducing processing activities that may create material privacy risks, we conduct a DPIA and document our findings and mitigation measures.

Q.5 — Record Keeping

We maintain accurate records of: key data processing activities, consent records (user ID, timestamp, policy version), security incidents and responses, data subject rights requests, and third-party vendor agreements.

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or new features. When we make changes:

• The "Last Updated" date at the top will be revised
• The version number will be incremented

For material changes (new categories of data collected, new processing purposes, or changes to your rights), we will notify you via:

• In-app notification at least 15 days before the change takes effect
• Email to your registered address (if provided)
• A prominent notice on our website

In accordance with the Information Technology Act, 2000, SPDI Rules 2011, and DPDPA 2023, AyalonPlus has designated a Grievance Officer to address privacy-related concerns:

Escalation Process

1. Submit your grievance to the Grievance Officer with a detailed written description of your concern
2. If not acknowledged within 48 hours or resolved within 30 days, escalate to senior management at support@ayalonplus.com with subject "Escalation – Unresolved Privacy Complaint"
3. If still dissatisfied, approach the appropriate authority under applicable Indian data protection law

For any questions, requests, or concerns about this Privacy Policy or our data practices:

We are committed to responding to all privacy-related inquiries within 30 days.