Privacy policy

Last updated 3 October 2026.

This policy covers the Ambiful Haq app for iPhone and Android and the website haq.ambiful.com. It says what personal data we collect, why, who else handles it, how long we keep it and what you can do about it. We process personal data under India's Digital Personal Data Protection Act, 2023, and we have written this in plain English so that you can read it.

Who is responsible

Ambiful Solutions Private Limited, House No. 1145, Sector 9, Faridabad, Haryana 121006, India, decides how your data is used (the "data fiduciary" in the Act's words). For any question, request or complaint about your data, write to our Grievance Officer at contact@ambiful.com. We acknowledge a complaint within 24 hours and aim to resolve it within 15 days. Using Haq is also covered by our Terms of Use.

What we store

• Your email address, to sign you in with a one-time code and to reach you about your account.
• Your name and phone number, if you enter them, used to sign the letters Haq drafts for you. Your chosen language.
• Your cases: what kind of problem it is, a one-line title, what you paid, when the problem started, what you want, and what has happened since (for example, the date you sent a complaint or filed with the helpline).
• The company in each case: its name, its grievance officer's name and email, its customer-care email and its registered office address, as you enter them.
• Your drafts: the complaint, the helpline text and the legal notice, every version you save, with the facts you gave for them. A legal notice includes your postal address and any compensation you ask for. A notice PDF is stored with your documents.
• Documents you choose to add: bills, warranty cards, screenshots and photos, with the title, type and date you give them. Images and PDFs only, up to 15 MB each. Photos are re-encoded on your phone before upload, which removes hidden details such as where the photo was taken.
• Emails you send to Haq, if you use your Haq addresses: a company reply you forward to a case address, a complaint you send with that address in BCC, or a bill you forward to your bills address. Haq keeps the email as a PDF or text file with your documents (and, for a case, logs it on the case with its date), plus any PDF or photo attached to it. Only email from your own account address is used; anything else is discarded without keeping its content.
• Your comparisons, if you compare appliances before buying: the figures from each star label as you checked them, the prices and warranties you type, your electricity rate and use, and the summary written from them. Label photos are not kept.
• Haq's shared label catalogue: when you save a comparison, the figures printed on each named model's star label (brand, model, stars, label period, energy, efficiency, capacity) are added to a catalogue every Haq user can search. No price, warranty or anything about you is shared, and other users never see who added a model. We keep a link to your account only so that you count once per model; it is removed when you delete your account. Readings nobody has confirmed for four years are deleted.
• Your WhatsApp number, only if you turn on WhatsApp reminders: the number you sent Haq the connect message from, and when it arrived. Haq reads only the one-time code in that message and keeps nothing else from it. Turning WhatsApp reminders off deletes the number.
• Your Locker: the items you add (for example car insurance or AC service) with their expiry or last-done dates.
• Your RTI requests, if you make any: the government office, what you ask, the request and appeal text, and the dates and registration numbers you log. Haq never files them or holds your RTI Online login; you file each one yourself.
• People you look after, if you add them (for example a parent): a name and, if you choose, the relation, so their Locker items and cases are kept apart from yours. They stay in your account; Haq does not contact them and nobody else can see them. Add someone only if you help them with these matters.
• Notice packs you buy: which case each was used on, when it was bought, and the store's transaction reference.

Collected automatically

• Sign-in and server records: when the app talks to our server, our providers record the time, your IP address and the app making the request. We use these only to keep the service running and secure, for example to stop someone guessing sign-in codes.
• We use no advertising identifiers, no analytics or tracking tools and no crash-reporting service. The website sets no cookies.
• We do not track you across other companies' apps or websites.

Why we use it

Only to give you the service you asked for: to work out your next step and deadlines, write your drafts, keep your cases, documents and Locker in your account, send your sign-in codes, unlock a notice pack you bought, and answer you when you write to us. You give it to us by entering it, and we rely on that consent. You can withdraw it at any time by deleting the item in the app or deleting your account; this does not affect what we did before. We never use your data for advertising, and never to decide anything about you.

Haq never sends anything to a company, the helpline or a commission for you. When you send a complaint, file with the helpline or post a notice, you do it yourself, from your own email, phone or post office.

Where it lives and who can see it

• Your data and documents are stored with Supabase in Mumbai (ap-south-1), and our server runs on Vercel in Mumbai. Each request can only read the data of the account it is signed in as.
• Documents sit in private storage, in a folder only your account can reach. The app uploads and opens them through links our server issues for your account, which expire within minutes (uploads within two hours). They have no public address.
• When you share a document or a notice PDF, your phone's share sheet sends it where you choose. We do not keep a copy of what you share or send it anywhere.

Services that handle some of it for us

• Expo (with Apple or Google) delivers push messages to your phone, if reminders are on: a title and one line naming your case or that a bill was saved, and the screen to open.
• Resend sends emails to your address: the sign-in code, and reminders (on the day something is due, and a summary on the 1st of the month) unless you turn reminder emails off in the app or from the link in any of them. A reminder names the Locker item or your case and its date, nothing more. Resend also receives the emails you send to your Haq addresses and passes them to us.
• MSG91 sends WhatsApp messages, only if you turn WhatsApp reminders on: it passes Haq the connect message you send, and on the days something is due it sends a message naming the Locker item or your case and when it is due. Meta (WhatsApp) delivers them.
• Apple (App Store) or Google (Play) take the payment when you buy a notice pack; we never see your card or payment details. RevenueCat confirms the purchase for us. It knows your purchase and a random account number, not your name or email.
• OpenAI reads the dates on a document, only when you tap "Read the date from it" on a Locker item. We send that one file and nothing else about you. OpenAI does not use it to train its models and keeps it only as long as its API terms allow for running and securing the service. You check the date before anything is saved. When you compare appliances, OpenAI also reads a star-label photo you take (the photo only), and writes the plain-words summary from the comparison's figures (the label figures, prices, warranties, your electricity rate and use; nothing about you).

Drafts are written from fixed templates on our server. Apart from a document you ask Haq to read a date from, and the star labels and figures of a comparison, we do not send anything to AI services, and never your cases.

Outside India

Your account data and documents stay in Mumbai. Resend, Expo (for push messages), MSG91 and Meta (for WhatsApp), RevenueCat and OpenAI, and Apple or Google for payments, may process the parts described above outside India, mainly in the United States, under their own security and privacy commitments. We send each of them only what its job needs.

On your phone

• The app opens your camera, photos or files only when you choose to add a document, and uses only what you pick.
• Reminders are scheduled on your phone, only if you turn them on. While they are on, your phone also gets a short push message when Haq files an email you sent to a Haq address (for example "Company reply logged"). For this we keep a push token for the phone, and Expo and Apple or Google deliver the message; it names the case and what happened, never the email itself. The token is removed when you sign out or turn reminders off.
• We do not read your contacts or your location.

How long we keep it

• Your account data and documents: for as long as you use Haq. Deleting an item in the app deletes it straight away.
• Accounts nobody uses: if you do not open the app for 12 months, we delete your account and everything in it. From about a month before, we email you every week with the date, and once more the day before; opening the app once keeps your account. We never delete an account this way while one of its cases is at the Consumer Commission.
• After you delete your account: nothing, apart from database backups, which are overwritten within 30 days.
• Sign-in and server records: only as long as our providers need them for security and fault-finding.
• Purchase records: Apple, Google and RevenueCat keep their own, as payment and tax rules require.

Your rights

• See your data: everything we hold about you is on the app's screens; ask us and we will send you a summary.
• Take a copy: in the app, open Account and tap Download my data. You get one file with all your data and your documents. We keep the file for at most a day, so you can save it, and then delete it.
• Correct it: edit your cases, the company details, your drafts, your Locker and your account details in the app, or ask us.
• Delete it: delete any case, document or Locker item, or your whole account, in the app, or ask us.
• Nominate someone to exercise these rights for you if you die or cannot do so yourself: tell us who by email.
• Complain: write to support@ambiful.com and we will reply within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

Write from the email address on your account, so that we know the request is yours.

Keeping it safe

Everything travels over encrypted connections (HTTPS). Account isolation, private document storage and short-lived links are described above; only the people who run the service can reach the database, and only to keep it working. No system is perfectly safe: if a breach affects your data, we will tell you and the Data Protection Board of India as the law requires.

Children

Ambiful Haq is meant for people aged 18 and over. If you are under 18, use it only with your parent's or guardian's agreement. A parent or guardian who did not agree can write to us, and we will delete the account.

What we do not do

• We do not sell or share your data with companies, lawyers, agents or advertisers.
• We do not contact the companies in your cases.
• Haq is not a law firm and does not give legal advice.

Deleting your data

Delete your account from inside the app (Account → Delete account). That removes your login, details, cases, drafts, documents, Locker and notice-pack records at once. See how to delete your account. If you cannot get into the app, email support@ambiful.com from the address you signed up with.

Changes to this policy

When we change what we collect or how we use it, we update this page and the date at the top. For a change that matters, we also email you before it applies to data you have already given us.