Back to Home
Disha - AI Life Navigation

Privacy Policy

Last Updated: October 2026

AI Data Processing Notice

Your personal data is processed by AI systems to generate personalized insights. AI systems may produce inaccurate or biased results. Content is for reflection and personal insight purposes only. These are AI-generated insights; please consult a qualified professional (doctor, lawyer, financial advisor) before acting on them.

1. Introduction

NovaMind Tech LLP ("we," "us," "our") operates Disha, an AI-powered personal insight application ("App"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our App.

We are committed to protecting your privacy and ensuring transparency about our data practices. Please read this Privacy Policy carefully to understand how we handle your information.

2. AI Data Processing Notice

Your personal data may be processed by artificial intelligence systems to generate:

  • Automated analysis of your birth date, time, and location data
  • AI-generated personality insights and perspectives
  • Machine learning algorithms for content personalization
  • Automated pattern recognition in personal profile data
  • Spatial and environmental analysis from uploaded images

Conversational Memory

Disha maintains a persistent memory of your conversations to personalize your experience. This includes topics you discuss, life events, health concerns, relationships, career details, and emotional context you share. This memory is used exclusively to provide you with more relevant, continuity-aware responses. You can request deletion of your conversational memory at any time by contacting us.

Important: AI systems may produce inaccurate or biased results. The AI-generated content should be used for reflection and personal insight purposes only. These are AI-generated insights; please consult a qualified professional (doctor, lawyer, financial advisor) before acting on them.

3. Information We Collect

3.1 Personal Information You Provide

  • Account Information: Name, email address, phone number
  • Profile Data: Birth date, exact birth time, birth location
  • Geographic Data: Latitude and longitude coordinates, timezone information
  • Profile Information: User preferences, settings, and customizations
  • Conversation Data: All messages you send and responses you receive, stored to provide conversation history and continuity
  • Image Data: Photos you upload for spatial or environmental analysis (e.g., room layouts for guidance)
  • Communication Data: Messages sent to customer support

3.2 Automatically Collected Information

  • Usage Data: How you interact with the App, features used, time spent
  • Device Information: Device type, operating system, browser information
  • Log Data: IP address, access times, error logs
  • Session Data: Authentication tokens, session identifiers
  • AI Memory Data: Contextual information extracted from your conversations (life events, preferences, concerns) used to personalize future interactions
  • Analytics Data: Anonymized interaction traces including question types, response latency, and feature usage for service improvement
  • Advertising and Attribution Data: If you reach us by clicking one of our ads, we and our advertising partners may collect ad-click identifiers (such as Google click IDs), advertising cookies, and ad-referral metadata indicating which ad or campaign you came from. For Meta Click-to-WhatsApp Ads, the WhatsApp message you start carries a referral to the originating ad

3.3 WhatsApp Integration

If you interact with Disha via WhatsApp, we additionally collect your WhatsApp phone number and message content. WhatsApp messages are processed through the WhatsApp Business API and are subject to WhatsApp's own terms and privacy policy in addition to ours.

3.4 Payment Information

If you purchase a subscription, payment is processed by third-party payment providers. We do not store your full payment card details. We receive and retain only transaction identifiers, subscription status, and billing history necessary to manage your account.

4. How We Use Your Information

We use your information to:

  • Provide Core Services: Generate personalized insights, create tailored analysis, deliver daily reflections, and provide spatial guidance from uploaded images
  • AI Processing: Process your data through AI models to generate insights; your personal data is not used to train foundational AI models
  • Conversational Memory: Build and maintain a personalized memory of your preferences, life events, and context to improve the relevance and continuity of your experience
  • Account Management: Authenticate users, maintain account security, provide customer support
  • Personalization: Customize content and recommendations based on your personal profile
  • Communication: Send service-related notifications (including push notifications), updates, and educational content
  • Analytics: Analyze usage patterns to improve App functionality and user experience
  • Marketing and Advertising: Measure the effectiveness of our advertising, attribute sign-ups and subscriptions to the campaigns that drove them, and reach similar audiences. This uses limited measurement signals (such as ad-click identifiers and conversion events) shared with our advertising partners — not your birth details, chart data, uploaded images, or conversation content
  • Security: Detect fraud, prevent abuse, and maintain system security
  • Legal Compliance: Comply with applicable laws and regulations

5. Data Sharing and Disclosure

5.1 Third-Party Service Providers

We share data with trusted service providers who help us operate the App:

  • Authentication Services: User login, account management, and security services
  • Cloud Infrastructure: Data storage, hosting, and computational services for AI processing
  • AI Model Providers: Your questions and profile data are sent to large language model providers to generate responses; these providers process data per their own data handling agreements
  • WhatsApp Business API: Message delivery and phone number verification for WhatsApp users
  • Payment Processors: Subscription billing and transaction processing
  • Analytics Providers: Google Analytics (GA4) and internal usage and performance monitoring, used to understand and improve how the App is used
  • Advertising and Measurement Partners: Google (Google Ads) and Meta Platforms (Facebook/Instagram Click-to-WhatsApp Ads) receive limited conversion and attribution signals so we can measure and optimize our advertising. They do not receive your birth details, chart calculations, uploaded images, or conversation content

Processors we use

These are the processors that handle personal data to run Disha. Each one receives only what it needs for the job named here:

  • Google Firebase: Sign-in (Google, Apple, and email/password), device push tokens, and the authentication record for your account
  • Google Gemini: Generating readings from the questions and chart context you send
  • Google Cloud Text-to-Speech: Spoken WhatsApp replies. If that call fails, the same reply is spoken with gTTS
  • Groq: Generating a reading when Gemini is unavailable
  • OpenAI: Text or image analysis only when the reading service is configured to use the OpenAI provider. The usual path is Gemini, then Groq
  • Meta WhatsApp: WhatsApp messages with Disha, and WhatsApp login codes when that channel is on
  • Razorpay: Subscription checkout and renewals. We do not store your full card number
  • Resend: Email we send you, including login codes and payment receipts
  • Railway: Hosting the app, the database, and the services that process your account
  • Langfuse: Quality-monitoring traces of questions and readings, including birth details present in those traces
  • Cloudflare: Connection data (such as IP address) on paths that sit behind Cloudflare, including email delivery through Resend

5.2 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, or to protect our rights, property, or safety.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity, subject to the same privacy protections.

5.4 Advertising and Click-to-WhatsApp Ads

We advertise our service on platforms such as Google and Meta (Facebook and Instagram). To run and measure these campaigns:

  • Google Ads: Our website loads Google's tag (gtag.js), which uses advertising cookies to measure conversions (such as sign-ups and subscriptions) and to build remarketing audiences. This shares standard ad-measurement signals with Google.
  • Meta Click-to-WhatsApp Ads: When you tap one of our ads on Facebook or Instagram, you are taken into a WhatsApp chat with us. Meta receives the ad-click and conversion signals needed to measure and optimize those ads, and the WhatsApp message you start includes a referral identifying the originating ad.

These partners receive only limited advertising and measurement signals. We do not share your birth details, chart calculations, uploaded images, or the content of your conversations with advertising partners. You can limit ad personalization via your Google Ad Settings, your Meta ad preferences, and your browser or device controls. See the Cookies section below for more detail.

Google user data (Limited Use)

If you sign in with Google, Google Sign-In gives us the name, email address, and Google account identifier on that account. We use them to create your Disha account and to sign you in. We do not sell that Google account data, and we do not use it to serve ads.

Disha's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What We Don't Share

  • We never sell your personal information to anyone
  • We never share your birth details, chart calculations, uploaded images, or conversation content with advertisers, marketers, or data brokers
  • Our advertising partners receive only limited conversion and attribution signals (described in 5.4) — never your personal insight data

6. Data Security

We implement appropriate security measures to protect your personal information:

  • Encryption: Data is encrypted in transit and at rest and accessible only after authentication
  • Access Controls: Limited access to personal data on a need-to-know basis
  • Secure Infrastructure: Industry-standard cloud security practices
  • Regular Audits: Periodic security assessments and updates
  • Authentication: Secure user authentication and session management

Note: No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain your information for different periods based on data type:

  • Account Data: Retained while your account is active
  • Profile Information: Stored while your account is active to provide continuous service
  • Conversation History: Retained while your account is active; older conversations may be archived after 12 months
  • AI Memory Data: Retained while your account is active; you may request memory deletion at any time
  • Uploaded Images: Processed in real-time for analysis and not permanently stored on our servers after processing
  • Usage Analytics: Anonymized and aggregated data retained for up to 2 years
  • Communication Records: Retained for 1 year for customer support purposes
  • Security Logs: Retained for 6 months for security monitoring

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

8. Your Rights and Choices

8.1 Access and Control

You have the right to:

  • Access and review your personal information
  • Update or correct inaccurate information
  • Delete your account and associated data
  • Export your personal profile data
  • Opt out of non-essential communications
  • Opt out of advertising personalization (see the Advertising and Cookies sections)
  • Withdraw consent you previously gave (including for advertising cookies) at any time, without affecting processing already carried out before the withdrawal

Account deletion

While you are signed in, open Profile and choose Delete account. That calls DELETE /api/user/delete-account, which removes your profile, conversation history, stored readings, push tokens, and delivery log, deletes the Firebase login, and records a request to erase the Langfuse traces for that account. Payment and invoice records are kept where tax or accounting law requires them.

The same steps are written at disha.space/delete-account. If you cannot sign in, email [email protected] and we will delete the account. The public deletion page states that emailed requests are processed within 30 days.

8.2 Data Portability

You can request a copy of your personal profile data in a portable format. Contact us at [email protected] to make such requests.

8.3 AI Processing Opt-Out

Note: Since AI processing is core to our personal insight services, opting out of AI analysis would prevent us from providing most App features. Account deletion is the primary way to opt out of AI processing.

9. International Data Transfers

Your information may be transferred to and processed in countries outside of India, including the United States, where our cloud service providers operate. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

10. Children's Privacy

Our App is not intended for use by children under 18 years of age, and children may not create an account or use the App on their own. We do not knowingly allow anyone under 18 to register, and if we become aware that a child has created an account we will take steps to delete it promptly.

Readings about a child (parental consent). A parent or legal guardian may ask for a reading about their own child under 18 — for example a baby-naming suggestion or a newborn's chart — by providing the child's birth details. Before we process a child's birth details for such a reading, we ask the adult to confirm that they are the child's parent or legal guardian and that they consent to this use, in keeping with Section 9 of India's Digital Personal Data Protection Act, 2023. We record that consent as proof that it was given.

A child's birth details are used only to generate the reading you request. We never use a child's personal data for advertising, behavioural monitoring, tracking, or profiling, and we do not build marketing profiles of children. A parent or guardian may withdraw consent and have the child's data deleted at any time by contacting us at [email protected].

11. Cookies and Local Storage

We use browser storage technologies to enhance your experience:

  • Session Storage: Authentication tokens and temporary data
  • Local Storage: User preferences and cached insights
  • IndexedDB: Offline message cache so you can view recent conversations without an internet connection
  • Browser Storage: App performance and functionality data
  • Third-Party Analytics Cookies: Google Analytics (GA4) sets cookies (for example, _ga) to measure how visitors use the App. These load only after you consent
  • Third-Party Advertising Cookies: Google Ads (via gtag.js) sets advertising cookies (for example, in the _gcl_ family) to measure ad conversions and support remarketing. These load only after you consent

We ask for your consent before setting non-essential analytics and advertising cookies; until you accept, these stay disabled. You can change or withdraw your choice at any time by clearing this site's data in your browser. You can also clear or block cookies through your browser settings, though this may affect App functionality. To opt out of advertising personalization specifically, use your Google Ad Settings and Meta ad preferences. Where required by the laws of your region, we request your consent before setting non-essential advertising cookies, and you may withdraw that consent at any time.

12. Push Notifications

With your consent, we may send push notifications to your device to inform you when your insight analysis is ready or for important service updates. You can manage or disable push notifications through your browser or device settings at any time.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy in the App and/or sending you an email notification. Changes become effective immediately upon posting.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: [email protected]

Operator: NovaMind Tech LLP

Jurisdiction: India

Include "Privacy Policy" in the subject line for faster processing

Grievance Officer

In accordance with India's Digital Personal Data Protection Act, 2023, you may contact our Grievance Officer with any concern, complaint, or request regarding your personal data or how it is processed. Full contact details: disha.space/grievance.

Name: Gagandeep Singh Bhasin

Email: [email protected]

Entity: NovaMind Tech LLP, India

We do not claim a statutory response SLA until one is published.

15. Legal Basis for Processing

We process your personal information based on the following legal grounds:

  • Consent: You have given clear consent for specific processing activities
  • Contract Performance: Processing necessary to provide our personal insight services
  • Legitimate Interests: App improvement, security, and fraud prevention
  • Legal Obligation: Compliance with applicable laws and regulations

16. Acknowledgment and Consent

BY USING OUR APP, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY AND CONSENT TO THE COLLECTION, USE, AND DISCLOSURE OF YOUR INFORMATION AS DESCRIBED HEREIN, INCLUDING AI PROCESSING OF YOUR PERSONAL DATA FOR PERSONALIZED INSIGHT ANALYSIS.