Privacy Policy

This section, together with sections 16–20, is our privacy notice under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. TaskHeroes is the Data Fiduciary for the personal data described here and you are the Data Principal. We collect only what we need to run the Platform:

• Account details — your email address (used to send sign-in codes), your name, an optional phone number and profile photo, and your language preference. Purpose: to create and secure your account and to show other users who they are dealing with.
• Task details — what you post or bid on: descriptions, photos, budget, schedule, the task address, and your service categories, service area and radius if you are a Hero. Purpose: to match customers with nearby Heroes and let them agree on a task.
• Location — the address you type, and your device’s precise location only when you tap “use my current location” or open the nearby map, and only while the app is in use. Purpose: to fill in addresses and show tasks and Heroes near you. You can refuse or revoke this permission in your phone settings at any time.
• Messages, offers, reviews, reports and blocks between users. Purpose: to let users communicate, to show ratings, and to keep the community safe.
• Hero verification (KYC) — if you choose to verify as a Hero: your legal name, the type and number of a government ID, and photos of that ID. Purpose: to confirm that a Hero is a real person before enabling verified-only features. This is optional; you can use TaskHeroes without it.
• Device and technical data — a push-notification token, device identifier, app version, IP address and server logs, plus a record of when you accepted these Terms. Purpose: to deliver notifications, prevent abuse and fraud, keep the service secure, and meet our legal obligations.
• Support requests — what you tell us when you contact support, report a problem or raise a grievance. Purpose: to help you and to keep a record of how it was resolved.

We do not sell your personal data, we do not use it for advertising, and we do not use it to build profiles for any purpose other than running the Platform. We do not track you across other apps or websites.

We process your personal data on the basis of your consent, which you give by accepting these Terms when you create your account, and — for location, camera, photos and notifications — through the permission prompts on your phone. Where the DPDP Act allows it, we also process data for the purpose you voluntarily provided it for (for example, to carry out a task you posted) and to comply with the law.

You can withdraw consent as easily as you gave it, at any time:

• turn off location, camera, photo or notification access in your phone’s settings;
• turn off location use or push notifications in Profile → Privacy & data, which records the withdrawal;
• remove your phone number, photo or addresses from your profile;
• delete your account from Profile → Delete account, which withdraws consent for everything; or
• write to our Grievance Officer (section 20) and tell us what you want withdrawn.

Withdrawing consent does not affect processing that happened before you withdrew it. If you withdraw consent for data we need to run the service — such as your email address — we will not be able to keep your account open, and will close it as described in section 18.

As a Data Principal you have the following rights. To exercise any of them, use the in-app options where they exist or write to our Grievance Officer (section 20). We will respond within 30 days and never charge you for it.

• Access — ask for a summary of the personal data we hold about you, what we do with it, and who we have shared it with. Use Download my data in Profile → Privacy & data to get a copy at any time.
• Correction and updating — fix inaccurate or incomplete data. You can edit your profile, addresses and tasks in the app yourself.
• Erasure — ask us to delete your personal data. Deleting your account in the app does this; we will also erase data when the purpose it was collected for is over, unless the law requires us to keep it.
• Grievance redressal — complain to our Grievance Officer about anything we do with your data, and get a response within the time stated above.
• Nomination — name another person who may exercise these rights for you if you die or become unable to do so. Write to the Grievance Officer to record a nominee.
• Complain to the Data Protection Board of India — if you are not satisfied with how we handle your grievance, you may approach the Board set up under the DPDP Act.

You also have duties under the DPDP Act: give us accurate information, do not impersonate anyone, and do not raise false or frivolous complaints.

We keep your personal data only for as long as we need it for the purposes above:

• Account and profile data — for as long as your account is open.
• After you delete your account — your account is closed immediately and your profile, addresses, open tasks, offers, chats, reviews and photos are erased within 30 days, unless we must keep specific records longer by law (for example to respond to a lawful request from a government authority, or to defend a legal claim).
• Hero verification documents — deleted once a verification decision is made and you no longer need verified status, or when you delete your account, whichever is earlier.
• Sign-in codes — expire within minutes and are not kept afterwards.
• Security and access logs — kept for up to 180 days, as Indian cyber-security directions require, then deleted.
• Inactive accounts — if you do not use TaskHeroes for 3 years we will remind you by email and then erase your data, as the DPDP Rules require.

We protect your data with reasonable security safeguards: encrypted connections (HTTPS), one-time sign-in codes instead of passwords, access controls and audit logs on our servers, and limits on who in our team can see personal data. If a personal data breach affects you, we will inform you and the Data Protection Board of India without delay, as the DPDP Act requires, and tell you what you can do to protect yourself.

We share personal data only where it is needed to run the Platform, and only with parties who are bound to protect it:

• Other users — the parts of your profile, tasks, offers, reviews and messages that the Platform is designed to show them. Your email address, phone number, exact address and ID documents are never shown to other users unless you share them yourself.
• Service providers (Data Processors) who act on our instructions — our hosting provider ([hosting provider and data-centre region]); a cloud storage service for photos; an email delivery service for sign-in codes; Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) to deliver notifications; and OpenStreetMap / Nominatim to show map tiles and look up addresses (they receive your device’s IP address and the area or text you search).
• Authorities — where the law requires it, or to respond to a lawful order from a court or government authority in India.
• A new owner — if TaskHeroes is sold or merged, under the same protections as these Terms, and we will tell you before this happens.

Some of these providers process data on servers outside India. We transfer personal data outside India only where the DPDP Act permits it and never to a country or territory the Central Government has restricted. Each processor is contractually bound to use your data only for the service it provides to us.

We have appointed a Grievance Officer under the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Contact them for any question, request or complaint about your personal data. We acknowledge every complaint within 48 hours and resolve it within 30 days.

This notice is available in English and Hindi in the app — switch languages in Profile → Preferences. If you would like it in another language listed in the Eighth Schedule to the Constitution of India, write to the Grievance Officer and we will provide it on request.