Privacy Policy

This Privacy Policy is our notice to you under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, and under the Information Technology Act, 2000 and its rules. It explains, in plain words, what personal data we collect, why, who sees it, how long we keep it, and how you can control it.

1. Who we are

1.1 Palmyst is run by Aumadi Globals Pvt Ltd, registered office Jodhpur, Rajasthan - 342005, India ("Palmyst", "we", "us"). We are the Data Fiduciary for the personal data described here.

1.2 This policy covers the Palmyst Android and iOS apps, the web app at web.palmyst.com, the website palmyst.com, the embeddable Palmyst widget, our WhatsApp and email channels, and the Solutions and Palmyst Ratna features.

2. The short version

We do not sell your personal data. We do not use your palm photo to identify you, and we do not show it to advertisers.

3. What we collect

3.1 Palm photos. Photos you take or upload for a reading, including photos of another person's palm that you upload with their permission.

3.2 Reading details. Details you enter for a reading, such as name, age or date of birth, gender, and which hand is shown. Some of these are optional.

3.3 Solutions information. The problem you describe and your answers to the 5 Solutions questions, and the plan or suggestion we create from them. What you write here can be very personal. Please share only what is needed and avoid adding details about other people, health records, ID numbers or financial account details.

3.4 Account data. Email address, phone number, or the ID from the sign-in provider you choose (such as Google or Apple), and your profile settings.

3.5 Readings and history. The readings, reports, plans and results created for you, and the tools you have used or unlocked.

3.6 Purchase data. For web payments, Razorpay tells us the payment ID, amount, status and method type (for example UPI or card). For in-app purchases, Google Play or the Apple App Store tells us the purchase status. We never receive or store your full card number, CVV, UPI PIN or net banking password.

3.7 Ratna waitlist data. Your WhatsApp number and pincode, and the gray areas and stone count shown to you.

3.8 Messages. Emails, WhatsApp messages and support requests you send us, and our replies.

3.9 Device and usage data. Device model, operating system, app version, language, approximate location from IP address (city level, not GPS), crash logs, screens viewed, buttons tapped and session times.

3.10 Advertising and measurement data. In the mobile app, your device's advertising ID and ad interaction data, used by Google AdMob for rewarded ads and by our analytics and advertising providers to measure our own ad campaigns. See section 9.

3.11 How you found us. The website or campaign that brought you to palmyst.com (for example a search engine, a social app or a campaign tag in the link). This is passed to the web app or app store when you tap through, so we know which channels work.

3.12 Cookies. On our website and web app, cookies and similar tools. See our Cookies Policy.

We do not collect your GPS location, contacts, camera roll (beyond the photo you pick), microphone, Aadhaar, PAN or any government ID.

4. Why we use your data

We process your data on the basis of the consent you give when you create an account, upload a palm photo or otherwise share your data with Palmyst, except where the law allows processing without consent (for example, to meet a legal duty).

We will ask for fresh consent before using your data for a purpose not listed here.

5. Palm photos: how we protect them

5.1 Your palm photo is used to read the visible features of your palm. We do not use it to identify you, verify your identity, unlock devices, or match you against any other database.

5.2 Palm images can count as biometric information under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. We treat them with the extra care those rules require.

5.3 Your palm photo is stored with your account so you can revisit your reading. You can ask us to delete your account, which removes your photos (see section 14).

5.4 Your palm photos and reading details may be used to train and improve the AI models and tools behind Palmyst.

5.5 Palm photos are never sold, never shared with advertisers, and never made public by us.

6. AI processing

6.1 To create your reading, your palm photo and reading details are sent to third-party AI model providers that process them for us.

6.2 These providers act as our data processors. The data sent to them may be used for training and improving AI models.

6.3 Readings are generated automatically. No decision with legal or similar effect on you (such as a loan, job or insurance decision) is made by us using your data.

7. Who can see your data inside Palmyst

7.1 Most readings are generated by software and are not seen by any person.

7.2 Solution Plans and Ratna suggestions are prepared by our team. Authorised team members can see your problem, your 5 answers, your palm photo and your palm analysis for this purpose only.

7.3 Support staff may see your account and purchase details when you contact us or ask for a refund.

7.4 Everyone with access is bound by confidentiality, gets access only to what their job needs, and all access is logged.

8. Who we share data with

We share personal data only with:

• Hosting, database and storage providers that keep your account, photos and readings on servers in multiple regions.
• AI model providers listed in section 6.
• Razorpay, Google Play and the Apple App Store, to process payments and refunds.
• Sign-in providers such as Google and Apple, when you choose to sign in with them.
• Messaging providers such as Meta (WhatsApp Cloud API) and an external email provider, to send messages you agreed to receive.
• Analytics and advertising providers listed in section 9.
• Government or law enforcement authorities, when we are legally required to share.
• A buyer or successor, if Palmyst is merged, acquired or restructured. This policy will continue to protect your data.

Every provider is bound by a contract to protect your data and to use it only for the service it gives us.

9. Ads and measurement

9.1 The mobile app uses Google AdMob to show rewarded ads that unlock free tools. AdMob may use your device's advertising ID. Read how Google uses information from apps that use its services at policies.google.com/technologies/partner-sites.

9.2 We use Google AdMob, Firebase Analytics, Google Analytics 4, Google Ads conversion tracking, the Meta SDK or Pixel, and Microsoft Clarity to understand app use and to measure whether our own ads lead to installs and purchases. Microsoft Clarity records how people interact with our pages and screens, such as clicks, taps and scrolling.

9.3 You can limit ad personalisation at any time. Android: Settings > Google > Ads > Delete advertising ID. iOS: Settings > Privacy & Security > Tracking. On iOS we ask your permission before tracking.

9.4 We do not share your palm photos, readings or Solutions information with any ad or analytics provider.

10. Cookies

Our website and web app use cookies that are needed to make them work, and, with your consent, analytics cookies. You can manage these through the cookie banner or your browser. See our Cookies Policy.

11. Children

11.1 Palmyst is only for people aged 18 and over. We do not knowingly collect data from anyone under 18, and we do not offer parental-consent accounts.

11.2 Please do not upload a child's palm. If we find that we hold a child's data, we will delete it. Parents can write to hello@palmyst.com.

12. How long we keep data

12.1 Your palm photos, readings, Solutions information, plans and account data are kept for as long as your account exists, because we show them back to you in your history. We do not set a fixed period after which they are removed.

12.2 We may keep other data, such as purchase and tax records, security logs, support messages and waitlist details, for as long as we need it for the purposes in this policy or as the law requires.

12.3 You can ask us to delete your account and data at any time (see section 14). After a deletion request we keep only what the law requires us to keep.

13. Security and data breaches

13.1 We use encryption in transit (HTTPS/TLS), encryption at rest for stored photos and data, access controls, role-based permissions, access logging and regular reviews.

13.2 No system is completely secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires, explain what happened, and tell you what you can do to protect yourself.

14. Your rights

Under the DPDP Act you have the right to:

• Know what personal data we hold about you, how we use it and who we share it with.
• Correct, complete or update your data.
• Erase your data, unless the law requires us to keep it.
• Withdraw consent at any time by emailing us. Once you withdraw, we stop processing and delete the data unless the law requires us to keep it. Processing done before you withdrew stays lawful. Without consent we cannot make new readings for you.
• Raise a grievance with our Grievance Officer (section 19).
• Nominate a person to use these rights on your behalf if you die or become unable to act.
• Complain to the Data Protection Board of India if you are not satisfied with our answer.

To use any right, email hello@palmyst.com from your registered email or with your registered phone number. We may ask you to confirm your identity. To delete your account, use palmyst.com/request-account-deletion. We confirm within 48 hours and finish deletion within 30 days.

Your duties: please give true information, do not upload anyone's data without permission, and do not file false or frivolous complaints.

15. Where your data is stored

Our hosting and database providers store and process your data in multiple regions, in India and in other countries. We transfer data only to countries the Government of India has not restricted, and we use contracts that require the same level of protection.

16. Users outside India

If you use Palmyst from the European Union, the United Kingdom or another region with its own data law, you have the rights that law gives you, including access, correction, deletion, objection, data portability and the right to complain to your local data protection authority. Our legal basis is your consent, and our legitimate interests in keeping the Service secure.

17. Language

This policy is in English. Readings can be generated in other languages, which you choose when you generate a report. If you need help understanding this policy, write to hello@palmyst.com.

18. Changes to this policy

We will update this policy when our practices change and change the "Last updated" date. For important changes, we will tell you in the app or by email before they apply and, where needed, ask for your consent again.

19. Grievance Officer and contact

• Grievance Officer: Piyush Jain, Co-founder
• Email: hello@palmyst.com
• Address: Aumadi Globals Pvt Ltd, Jodhpur, Rajasthan - 342005, India

We acknowledge every grievance within 48 hours and resolve it within 1 month. Support is by email only. General questions: hello@palmyst.com.