Privacy Notice

Hereiam is a discovery, ordering and digital loyalty service for local shops. It is operated by Hereiam, with a place of business at Humayunpur, New Delhi, Delhi 110029, India (“Hereiam”, “we”, “us”). For the purposes of the DPDP Act, we are the Data Fiduciary for the personal data described in clause 2.

Individual shops are separate businesses. When you collect stamps or place an order with a shop, that shop also handles your data as an independent business, under its own privacy practices.

We collect only what the service needs. We do not collect your location, and we do not buy data about you.

Location is not collected by us. See clause 5.

We process personal data for the following purposes only:

• to create and secure your account and keep you signed in;
• to issue, record, display and redeem stamps and rewards;
• to accept your order, send it to the shop counter and show you its status;
• to show nearby shops, your wallet, and your favourites;
• to send you the notifications you have allowed;
• to detect and prevent misuse such as duplicate or fabricated stamps;
• to measure, in aggregate, whether campaigns and QR codes work;
• to answer your questions, complaints and data requests; and
• to meet our legal obligations.

We do not use your data for advertising, we do not build advertising profiles, and we do not sell or rent personal data to anyone.

We rely on your consent for the processing described above, and on the performance of the service you ask for. You may withdraw consent at any time by writing to us on WhatsApp +91 70115 28938 or at hereiam@gmail.com. Withdrawal is as easy as giving consent.

If you withdraw consent, we will stop the relevant processing within a reasonable time. Please note that without your mobile number we cannot operate a stamp card or an account for you, so withdrawal usually means deleting your account (clause 11).

If you allow location access in your browser, your device compares your position with the coordinates of shops you already hold stamps at, in order to tell you that you are near one of them. Your coordinates are processed on your device and are never sent to us or stored by us. We send your device the shop coordinates; we never receive yours.

If you decline location access, or turn it off later in your browser or phone settings, nearby alerts simply do not appear. Nothing else in the service depends on location.

If you allow notifications, we store a push subscription for your browser (an endpoint address and two encryption keys) so that we can deliver a message. Browsers deliver these notifications only while the app is open in a tab; alerts that appear with the phone locked require a native mobile application, which we do not currently offer. You can revoke notification permission in your browser settings at any time.

We use one cookie and a small amount of browser storage. We do not use advertising or third-party analytics cookies.

• ln_sid — a session cookie that keeps you signed in. It is HTTP-only, marked secure, restricted to same-site requests, and expires when your session ends.
• Local storage — your active order number (so the status bar can follow your order) and a per-shop timestamp that stops the same nearby alert from repeating for six hours. Both stay on your device.

We share personal data only with the service providers that run the app for us. They act on our instructions as Data Processors and are bound by contract to protect it.

We may also disclose data where we are legally required to do so, or to establish or defend a legal claim. If we are ever merged or sold, your data may transfer to the successor, subject to this notice.

Our service providers may store and process data on servers located outside India. Where data is transferred outside India, we do so in accordance with the DPDP Act and applicable rules, and we do not transfer data to any country restricted by the Central Government.

Account data is kept while your account exists. When you ask us to delete your account, we erase your personal data within 30 days, except:

• stamp, reward and order records that we must keep to resolve disputes, prevent fraud and meet accounting requirements — kept for up to 24 months from the date of the transaction, with your name and phone number replaced by an internal reference;
• records we are required by law to keep for longer; and
• anonymous campaign events, which are not linked to your identity after deletion and are kept in aggregate.

If you have not signed in for 12 months, we may erase your personal data. Where we do, we will give you notice on your registered mobile number or email at least 48 hours in advance, and you can prevent it by signing in.

Subject to the DPDP Act, you may ask us to:

• confirm whether we hold your data and give you a summary of it;
• correct inaccurate or incomplete data, such as your name or email;
• erase your data where it is no longer needed for the purpose it was collected;
• withdraw consent (clause 4);
• nominate another person to exercise your rights in the event of your death or incapacity; and
• complain about how we have handled your data.

Write to us on WhatsApp +91 70115 28938, or email hereiam@gmail.com. We will acknowledge within 48 hours and act within 30 days, and in any case within 90 days. There is no charge.

If you are not satisfied with our response, you may complain to the Data Protection Board of India in the manner prescribed under the DPDP Act and Rules.

Data travels over encrypted (HTTPS) connections and is encrypted at rest by our hosting providers. Session cookies are HTTP-only and secure. Access to customer records is limited to the Operator and to authorised staff of the shop concerned, and every stamp, reversal and reward redemption is logged against the staff member who performed it. If a personal data breach occurs, we will notify the Data Protection Board and affected users within the timelines required by the DPDP Rules, describing what happened, what data was involved and what we have done about it.

Hereiam is intended for people aged 18 and over. We do not knowingly collect personal data of children. If we learn that we have, we will delete it. If you believe a child has created an account, please contact us.

The app links to services we do not control, such as Google Maps, shop pages and WhatsApp. Once you leave Hereiam, the privacy practices of those services apply, not this notice.

If we change how we handle personal data, we will update this page and change the date at the top. For a material change, we will also tell you in the app or on your registered mobile number before it takes effect.

This notice is governed by the laws of India. The courts at Delhi have exclusive jurisdiction over any dispute arising from it, subject to your right to approach the Data Protection Board of India.