Privacy Policy

1. Introduction and scope

Dream Circle (“we”, “us”, “our”) respects your privacy and treats your personal data as something we are looking after on your behalf rather than something we own. This Privacy Policy explains what we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

This policy applies to:

• our website at www.dreamcircle.in and all of its pages;
• every mobile application we publish on Google Play and the Apple App Store under the Dream Circle developer account;
• software, platforms and services we build and operate for our clients, where we act on their instructions; and
• our business communications — enquiries, proposals, support requests and recruitment.

It is written to meet the requirements of the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Where you are in the European Economic Area, the United Kingdom or California, the additional sections below also apply to you.

If you do not agree with this policy, please do not use our website, our applications or our services. Continuing to use them means you accept the practices described here.

2. Who we are

For the purposes of the DPDP Act we are the Data Fiduciary for personal data we collect about our own visitors, enquirers, candidates and app users. Under the GDPR the equivalent term is data controller.

Where we build or operate software for a client, that client is usually the Data Fiduciary and we act as a Data Processor on their documented instructions. In that case their privacy policy governs how your data is used, and we will tell you who they are if you ask.

3. Key terms

• Personal data — any data about an individual who is identifiable by or in relation to that data.
• Data Principal — the individual the personal data relates to. That is you.
• Data Fiduciary — the entity that decides why and how personal data is processed.
• Data Processor — an entity that processes personal data on behalf of a Data Fiduciary.
• Sensitive personal data or information (SPDI) — under the IT Rules 2011, this includes passwords, financial information such as bank account or card details, health data, biometric information and sexual orientation.
• Processing — any operation performed on personal data, including collecting, storing, using, sharing, erasing and anonymising it.
• Consent Manager — a person registered with the Data Protection Board of India through whom you may give, manage, review and withdraw consent.

4. Personal data we collect

We practise data minimisation: we collect what a feature genuinely needs and nothing more. We do not sell your personal data, and we do not buy contact lists.

4.1 Data you give us directly

We never see or store full card numbers, CVVs or UPI PINs. Card and UPI payments are handled entirely by PCI-DSS compliant gateways such as Razorpay. We receive only a transaction reference, the amount, the status and a masked identifier.

4.2 Data collected automatically

• Device and technical data — device model, operating system and version, app version, screen size, language, time zone, mobile network and carrier.
• Identifiers — an installation identifier, and where applicable the Android Advertising ID or Apple Identifier for Advertisers. These are only used for advertising where you have given consent.
• Log data — IP address, request timestamps, pages or screens viewed, referring URL and user agent.
• Usage data — features opened, buttons tapped, session length, and the navigation path through a screen flow.
• Diagnostics — crash stack traces, error messages and performance traces.
• Approximate location — a city-level estimate derived from your IP address. Precise GPS location is only ever collected when a specific app feature needs it and you have granted the permission at the operating-system level.

4.3 Data we do not collect

• We do not collect special-category or sensitive data such as health, biometric, religious or sexual-orientation information unless a specific client project requires it, in which case you will be told separately and asked for explicit consent.
• We do not read your contacts, messages, photos or files unless you actively choose to share a specific item with a feature.
• We do not record audio or video in the background.

5. How we collect it

• Directly from you — when you fill in a form, email us, call us, message us on WhatsApp, register in one of our apps, or apply for a job.
• Automatically — through cookies, SDKs and server logs as you use our website or applications. See section 10.
• From third parties — such as app stores (aggregated install and crash statistics), analytics and crash reporting providers, payment gateways (transaction status) and, where you have a business relationship with us, publicly available company information.
• From our clients — where we operate a system on their behalf, they may provide us with end-user data to process on their documented instructions.

6. How we use your data

We will not use your personal data for a materially different purpose without telling you first and, where the law requires it, obtaining fresh consent.

7. Consent and lawful basis

Under the DPDP Act, we process personal data on the basis of your consent or for certain legitimate uses permitted by the Act.

7.1 Consent

Where we rely on consent, it is asked for in plain language, is specific to a stated purpose, is freely given, and is never bundled with unrelated terms. A notice telling you what is collected and why is given at or before the point of collection.

7.2 Withdrawing consent

You can withdraw consent at any time, and it must be as easy to withdraw as it was to give. You can do so by:

• emailing support@dreamcircle.in with the word “withdraw” and what you want stopped;
• changing the relevant setting inside the app, where one is provided;
• using the “Necessary only” option in our cookie banner, or clearing cookies in your browser; or
• using the unsubscribe link in any marketing email.

Withdrawing consent does not make earlier processing unlawful, and we may still need to retain certain records where the law requires it — see section 13. Some features may stop working if the data they depend on is withdrawn.

7.3 Legitimate uses

We may process personal data without separate consent where the DPDP Act permits it — for example where you have voluntarily provided data for a specified purpose, to comply with a legal obligation or court order, or to respond to a medical emergency or a threat to public safety.

7.4 For EU and UK users

Where the GDPR applies, our lawful bases are: consent (Art. 6(1)(a)) for marketing, analytics and advertising cookies; contract (Art. 6(1)(b)) for providing services you have asked for; legal obligation (Art. 6(1)(c)) for tax and accounting records; and legitimate interests (Art. 6(1)(f)) for security, fraud prevention and basic service improvement, where those interests are not overridden by your rights.

8. Our mobile applications

This section covers every Android and iOS application published under the Dream Circle developer account, and is the policy referenced in our Google Play Data Safety declarations and Apple App Privacy labels.

8.1 Permissions we may request

Permissions are requested in context, at the moment the feature needs them, with an explanation of why. You can refuse any of them, and you can revoke them later in your device settings. Only the feature that depends on a permission stops working.

8.2 Data stored on your device

Our apps store data locally so they keep working on a poor connection: a session token, cached content, your preferences and a queue of actions waiting to sync. Clearing the app's storage or uninstalling it removes all of this from your device, but does not by itself delete data already stored on our servers. To delete that, follow section 19.

8.3 In-app purchases

Purchases made inside our apps are processed by Google Play Billing or the Apple App Store. Those platforms handle your payment details; we receive only a purchase token, the product identifier and the transaction status. Refunds for in-app purchases are governed by the relevant store's policy and by our Refund & Cancellation Policy.

8.4 Deleting your account from inside an app

Every app we publish that supports accounts provides an in-app deletion route at Settings → Account → Delete Account, as Google Play requires. You can also use our online deletion form.

9. Third-party services

We use a small number of established providers to run our products. Each receives only the data it needs, under a written agreement that limits what it may do with that data.

These providers have their own privacy policies, which govern what they do with data once it reaches them. We recommend reading Google's Privacy Policy, Apple's Privacy Policy and Razorpay's Privacy Policy.

Where an app is ad-supported, advertising identifiers are only shared after you consent, and you can reset or limit the identifier at any time in your device settings (Settings → Privacy → Ads on Android, Settings → Privacy & Security → Tracking on iOS).

10. Cookies and similar technologies

Our website uses a small number of cookies and browser storage keys. Strictly necessary ones are set automatically because the site cannot function without them; everything else is only set after you choose “Accept all” in our consent banner.

Our Cookie Policy lists every cookie we use, what it does and how long it lasts, and explains how to change your mind.

11. When we share data

We share personal data only in these situations:

• Service providers — the processors listed in section 9, each bound by contract to process data only on our instructions.
• Our clients — where we built or operate a product for them and you are their end user.
• Professional advisers — our accountants, auditors and lawyers, under a duty of confidentiality.
• Legal and regulatory — where we are required to disclose data by law, by a court order, or by a lawful request from a government or law-enforcement agency under the IT Act, 2000 or the Code of Criminal Procedure.
• Protecting rights and safety — where disclosure is necessary to investigate fraud, enforce our Terms, or protect the rights, property or safety of any person.
• Business transfer — if we are involved in a merger, acquisition or sale of assets, in which case you will be notified before your data becomes subject to a different privacy policy.

We do not sell personal data, and we do not share it with data brokers.

12. International transfers

Our primary infrastructure is in India. Some of our processors — notably Google, Apple and our email providers — operate globally, so your data may be processed outside India.

Transfers are made only to countries not restricted by the Central Government under section 16 of the DPDP Act, and are protected by contractual safeguards. Where personal data of EEA or UK residents is transferred, we rely on the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, together with appropriate technical measures such as encryption in transit and at rest.

13. How long we keep data

We keep personal data only for as long as the purpose it was collected for requires, plus any period the law obliges us to retain it. Once no purpose and no legal duty remains, data is deleted or irreversibly anonymised.

14. How we protect your data

We implement reasonable security practices and procedures as required by section 43A of the IT Act, 2000 and rule 8 of the IT Rules, 2011, aligned with the ISO/IEC 27001 control set. These include:

• TLS 1.2 or higher for all data in transit, with HSTS enforced on our websites;
• encryption at rest for databases, file storage and backups;
• passwords stored only as salted one-way hashes — we cannot read them, and nor can our staff;
• role-based access control, with access granted on a least-privilege basis and reviewed quarterly;
• multi-factor authentication on every administrative and cloud account;
• network isolation, firewalls, rate limiting and automated abuse detection;
• CSRF protection, parameterised database queries, input validation and security headers across our applications;
• automated dependency and vulnerability scanning, with a defined patching window; and
• audit logging of administrative actions, and encrypted off-site backups with periodic restore drills.

No system can be guaranteed completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and every affected Data Principal without undue delay, in the form and manner prescribed under the DPDP Act, and will report to CERT-In within six hours where the CERT-In directions apply. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours.

Please help us protect your account: use a unique password, enable multi-factor authentication where offered, and tell us immediately at support@dreamcircle.in if you suspect unauthorised access.

15. Children's privacy

Our website and services are not directed at children. Under the DPDP Act a child is anyone under 18 years of age.

• We do not knowingly collect personal data of a child without verifiable consent from a parent or lawful guardian.
• We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.
• Where an app is intended for a general audience, we rely on store age ratings and on the account holder confirming they meet the minimum age.

If you believe a child has given us personal data without the required consent, write to support@dreamcircle.in and we will delete it promptly. For users in the United States, we comply with COPPA in respect of children under 13.

16. Your rights under the DPDP Act

As a Data Principal you have the following rights, and we will never charge you for exercising them.

16.1 Right to access information

You may ask for a summary of the personal data we process about you, the processing activities involved, and the identities of other Data Fiduciaries and Processors it has been shared with.

16.2 Right to correction and erasure

You may ask us to correct inaccurate or misleading data, complete incomplete data, update data that has changed, and erase data that is no longer needed for the purpose it was collected for — unless retention is required by law.

16.3 Right of grievance redressal

You may raise a grievance with our Grievance Officer about any act or omission regarding your personal data. We will respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

16.4 Right to nominate

You may nominate another individual to exercise your rights on your behalf in the event of your death or incapacity. Email us the nominee's name and contact details and we will record the nomination against your account.

16.5 Right to withdraw consent

See section 7.2. Withdrawing consent is as easy as giving it.

16.6 How to exercise your rights

Email support@dreamcircle.in from the address registered with us, stating which right you wish to exercise and, where relevant, which app or service it concerns. We acknowledge requests within 48 hours and complete them within 30 days. We may need to verify your identity first — this protects you from someone else making a request in your name.

16.7 Your duties

The DPDP Act also places duties on Data Principals. You must not impersonate another person when providing data, must not suppress material information, must not register a false or frivolous grievance, and must provide only authentic information when exercising the right to correction.

17. Additional rights (EU / UK)

If you are in the EEA, Switzerland or the UK, you also have the right to:

• receive a copy of your personal data in a structured, commonly used, machine-readable format, and have it transmitted to another controller (data portability);
• ask us to restrict processing while a dispute about accuracy or legitimate interests is resolved;
• object to processing based on legitimate interests, and to object to direct marketing at any time, with no exceptions; and
• lodge a complaint with your local supervisory authority, or with the Information Commissioner's Office in the UK.

We have no establishment in the EEA or UK. Enquiries about our GDPR compliance should be sent to support@dreamcircle.in.

18. Additional rights (California)

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and why, to request deletion or correction of it, to opt out of any sale or sharing of it, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these rights.

We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. To exercise your rights, email support@dreamcircle.in with “California privacy request” in the subject line. An authorised agent may submit a request on your behalf with written proof of authorisation.

19. Account and data deletion

You can delete your account and personal data at any time, using any of these routes:

• In the app — Settings → Account → Delete Account.
• Online — complete the form on our Account & Data Deletion page.
• By email — write to support@dreamcircle.in from your registered address.

We acknowledge within 48 hours, verify ownership of the account, deactivate it within 7 days and erase personal data from live systems within 30 days. Encrypted backups expire on their normal rotation within 90 days. Records we are legally required to keep are listed in section 13. We confirm completion in writing.

20. Automated decisions and profiling

We do not make decisions that produce legal or similarly significant effects about you using automated processing alone. Where we use automated systems — for example to detect fraudulent or abusive activity — a human reviews any outcome that would restrict your access, and you may contest that outcome by writing to us.

21. Links to other websites

Our website and apps may link to services we do not control. Following such a link means that site's privacy policy applies, not ours. We are not responsible for the content or the privacy practices of third-party sites, and we encourage you to read their policies before sharing anything with them.

22. Changes to this policy

We may update this policy to reflect changes in our services, our providers or the law. The “Last updated” date at the top of this page always shows the current version.

For material changes — a new purpose, a new category of data, or a new class of recipient — we will give prominent notice on our website and, where we hold your email address and the law requires it, notify you directly and seek fresh consent before the change takes effect. Continuing to use our services after a change takes effect means you accept the updated policy.

23. Grievance Officer

In accordance with the DPDP Act, 2023, the IT Act, 2000 and rule 5(9) of the IT Rules, 2011, we have appointed a Grievance Officer. You can contact them about anything in this policy, any data-rights request, or any concern about how your personal data has been handled.

If your grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India in the manner prescribed under the DPDP Act, 2023.

24. How to contact us

For any question about this policy or about your personal data:

• Email: support@dreamcircle.in
• Phone: +91 80700 66644
• Post: Dream Circle, 320, 3rd Floor, G-Block, Bandra Kurla Complex, Bandra (East), Mumbai, Maharashtra 400051, India
• Online: Contact form · Support centre

This policy is governed by the laws of India, and any dispute arising from it is subject to the exclusive jurisdiction of the courts of Mumbai, Maharashtra, India.