Privacy Policy

1. Introduction

Kalash, Inc. ("we," "us," or "our") operates the HapyTap mobile application and website at hapytap.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. Please read this policy carefully. If you disagree with its terms, please discontinue use of the app.

2. Information We Collect

2.1 Information You Provide Directly

• Name and email address (when joining the waitlist or registering)
• Phone number (for OTP-based authentication)
• Notes and messages you write within the app (up to 120 characters)
• Artifact and moment type selections you make when sending a gesture

2.2 Information Collected Automatically

• Device identifiers (device type, operating system, unique device ID)
• App usage events (screens viewed, gestures sent, ceremony completions)
• IP address and approximate location (country and region level only)
• Cookies and similar tracking technologies when you visit hapytap.com

2.3 Information from Your Device (With Permission)

• Phone contacts — only if you explicitly grant permission. We use this to let you select recipients easily. We do not upload your full contact list to our servers; we only store identifiers for contacts you actively choose to gift.

3. How We Use Your Information

We use the information we collect to:

• Operate and deliver the HapyTap service
• Authenticate your identity via OTP
• Generate and deliver your symbolic gesture to the recipient
• Send transactional emails (waitlist confirmation, welcome message) via Brevo
• Analyze usage patterns to improve the product (via Google Analytics)
• Comply with legal obligations

We do not use your information for advertising. We do not sell your data to third parties.

4. Third-Party Services

We work with the following third-party services that may process your data:

• Google Analytics — usage analytics (anonymized)
• Brevo — transactional email delivery
• Google Firebase and Google Cloud Platform — database, authentication, and hosting infrastructure

Each of these providers has their own privacy policy governing their use of your data.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. If you request deletion of your account, we will delete your personal data within 30 days, except where we are required by law to retain it.

Gift notes and artifact selections are retained to enable the recipient to view their gesture. Notes are deleted upon account deletion or upon user request.

6. Your Rights

6.1 United States (CCPA — California Residents)

• Right to know what personal information we collect and how it is used
• Right to request deletion of your personal information
• Right to opt out of the sale of personal information (we do not sell data)

6.2 European Union / EEA (GDPR)

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing

To exercise any of these rights, contact us at privacy@hapytap.com.

6.3 India

We handle your data in accordance with applicable Indian data protection laws. You may contact us to request access to, correction of, or deletion of your personal data.

6.4 Southeast Asia

We comply with applicable data protection laws in Singapore, Malaysia, Thailand, Indonesia, and the Philippines where relevant. Users in these regions may contact us to exercise applicable rights.

7. Children's Privacy

HapyTap is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately at privacy@hapytap.com.

8. Data Security

We implement reasonable technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encrypted data transmission (HTTPS), access controls, and secure cloud infrastructure via Google Cloud Platform. However, no method of transmission over the internet is 100% secure.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States, where our infrastructure is hosted. We take steps to ensure that appropriate safeguards are in place for such transfers in accordance with applicable law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the date at the top of this page. For material changes, we will notify you via email or a notice within the app. Your continued use of HapyTap after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

Ram Kishan Paikaray
Kalash, Inc.
privacy@hapytap.com
hapytap.com