Privacy Policy

We collect information you provide directly and information generated through your use of the Hibnus Find platform.

1.1 Information You Provide

• Account information: mobile phone number (verified via OTP), full name, and profile photo.
• Provider profile: business name, professional bio, service areas (localities and pincodes), and identity verification documents (government-issued ID such as Aadhaar or PAN) for KYC.
• Supplier profile: business name, product listings, and identity documents.
• Booking data: service requests, customer addresses, and booking history.
• Communications: messages sent through the in-app chat between customers and providers.
• Reviews and ratings: feedback you submit about services or suppliers.

1.2 Information We Collect Automatically

• Location data: with your permission, precise GPS location to match you with nearby providers. You can disable this in your device settings at any time.
• Device information: device model, operating system version, unique device identifiers, and app version.
• Usage and analytics data: screens visited, features used, button taps, session duration, and interaction patterns — collected via PostHog (see Section 4).
• Log data: IP address, timestamps, and error logs for security and debugging purposes.

1.3 Information from Third Parties

• Google Maps / Places API: locality names, addresses, and geocoding when you search for or set service areas.
• MSG91: OTP delivery confirmation for phone number verification.

We use the information we collect to:

• Create and manage your account and verify your identity via OTP.
• Connect customers with verified service providers in their area.
• Facilitate service bookings and communicate job status updates.
• Send transactional notifications (booking confirmations, OTPs, job alerts).
• Verify provider and supplier identities through KYC document review.
• Improve the platform using product analytics (PostHog).
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Comply with legal obligations under Indian law.
• Respond to support requests and resolve disputes between users.

We do not use your data for automated profiling that produces legal or similarly significant effects without human review. We do not sell your personal data.

3.1 Within the Platform

• Customers ↔ Providers: when a booking is confirmed, relevant contact details (name, phone number) and service location are shared between the customer and assigned provider.
• Providers ↔ Suppliers: order details are shared when a provider places a supply order through the platform.

3.2 Service Providers (Data Processors)

We engage the following third-party services that process data on our behalf:

• Cloudflare — CDN, security, and object storage (R2) for KYC documents. Documents are stored in a private bucket not accessible to the public.
• MSG91 — SMS OTP delivery.
• Google Maps Platform — location search, geocoding, and map display.
• PostHog — product analytics and usage tracking (see Section 4).
• PostgreSQL / Supabase — database infrastructure for storing application data.

3.3 Legal Requirements

We may disclose your information if required by Indian law, court order, or a request from a government authority, or to protect the rights, property, or safety of Shaiksaif (Sole Proprietorship), our users, or the public.

3.4 Business Transfers

If Shaiksaif (Sole Proprietorship) undergoes a merger, acquisition, or sale of assets, your data may transfer as part of that transaction. We will notify you via email or in-app notice before your data is subject to a different privacy policy.

We use PostHog (posthog.com) for product analytics. PostHog helps us understand how the app is used so we can improve it. PostHog may collect:

• Screen views and navigation paths within the app.
• Button taps and feature interactions.
• Session duration and frequency of use.
• Device type, operating system, and app version.
• Anonymised IP address and approximate location (country/city level).

We configure PostHog to not record session replays or capture sensitive form inputs. PostHog data is processed under PostHog's own privacy policy available at posthog.com/privacy.

We do not use third-party advertising trackers, Facebook Pixel, Google Ads tags, or any cross-site tracking technologies.

• Active account data: retained for as long as your account is active.
• Deleted accounts: when you delete your account (in the app, or through a deletion request we match to your registered mobile number), it is deactivated immediately: you are signed out, your profile and services are hidden, and open bookings and orders are cancelled. You can ask us to restore it within 30 days. After 30days the account is permanently deleted together with your profile, services and products, bookings and orders (they also disappear from the other party's history), reviews you wrote or received, saved addresses and professionals, notifications and identity-verification records.
• Not yet removed automatically: chat messages you exchanged and files you uploaded (identity documents and photos) are not deleted by the automatic purge. Email [email protected] and we will delete them.
• Usage analytics: product analytics events are kept by PostHog under its data retention settings (see Section 4).

Under the Digital Personal Data Protection Act, 2023 (DPDPA), you have the following rights:

• Access: request a summary of the personal data we hold about you.
• Correction: update inaccurate data through app settings or by contacting us.
• Erasure (Right to be Forgotten): request deletion of your account and associated personal data.
• Withdraw consent: withdraw consent for optional processing (e.g., analytics) at any time without affecting prior lawful processing.
• Grievance redressal: raise concerns with our Grievance Officer (Section 11).
• Nomination: nominate someone to exercise your rights in the event of death or incapacity.

• All data is transmitted over TLS/HTTPS encryption.
• KYC documents are stored in a private Cloudflare R2 bucket — not publicly accessible. Retrieval requires a valid, authenticated backend request.
• Authentication is OTP-only — no passwords are stored, reducing credential exposure risk.
• Database access is restricted to backend services in a secured environment.
• We conduct periodic security reviews and remediate vulnerabilities promptly.

No system is 100% secure. If you suspect unauthorised access to your account, contact us immediately at [email protected].

Hibnus Find is not directed at children under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, please contact us at [email protected] and we will delete the account promptly.

The Hibnus Find platform may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party services you use.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date and notify you via in-app notification or email at least 15 days before the change takes effect. Continued use of Hibnus Find after that date constitutes acceptance.

Hibnus Find is operated by Shaiksaif (Sole Proprietorship). For privacy queries, data requests, or complaints, contact our Grievance Officer: