Privacy Policy

1. Who we are

Vasooly is an app that helps a person (the organizer) collect money from friends (the payers) over UPI, and keep track of who has paid. It is run by Vasooly Private Limited, A2-145 Asmita Jyoti CHS, Malad, Mumbai 400095, India ("we", "us").

For anything about your data, write to taher@vasooly.com.

2. How payments work (and what we don't see)

Vasooly is not a bank, wallet, payment aggregator or payment app. When you pay, you use your own payment app: a UPI app (such as Google Pay, PhonePe or Paytm), or outside India a service such as Venmo, Cash App, PayPal, Revolut, or your bank's Zelle, Interac, PayID, PayNow or Pix. A Vasooly link shows you the organizer's details and the amount, as a QR code and a UPI ID (or a link for apps such as Venmo), and you pay in your own app; the money moves between your account and the organizer's. Vasooly is not part of that transaction and never sees it.

We never receive, hold or move money, and we never see your bank account, UPI PIN, OTP, card details or the transaction itself. Whether someone has paid is recorded only because the payer taps "I've paid" or the organizer marks it, not because we can see the payment.

3. Data about organizers

If you use the app to collect money, we store:

• Account: a user ID; if you sign in with email, the email address you verify; if you sign in with Apple, the email address Apple gives us (this may be an Apple private relay address); and the display name you choose. If you enter it, your own phone number. Where SMS verification is available, you may verify it to find shares that list that number. An unverified number is shown only to you and is not used for matching. You can also start as a guest, with no email, and secure that account later with email on Android or Sign in with Apple on iPhone.
• Ways to get paid: the UPI IDs (VPAs), payment handles (such as a Venmo username or PayPal.Me name) and payee names you add, so payers know where to pay.
• Contacts you add: the names and, if you enter them, phone numbers of people you collect from. We don't upload your address book; we only store the people you add.
• Your address book, on your phone only: if you allow Contacts on iPhone or Android, Vasooly reads it on the device to recognise names you type, so "dinner with Rohan" finds the right Rohan and their number. It is never uploaded. Only a person you actually split with is saved, as above. You can turn Contacts off at any time in your phone's Settings, and Vasooly keeps working with names you type.
• Groups: group names and members, and amounts and schedules for recurring collections.
• Khatas (shared tabs): each expense added to a group's khata: what it was for, the amount, who paid, who shared it, and, if someone adds it from the web page, the name they type. To limit abuse we keep a one-way hash of the web visitor's IP address, not the address itself. Anyone with a khata link can see its entries and balances.
• Saving: a random request identifier prevents duplicate splits when a save is retried. It is not used for advertising or tracking.
• Collections: title, note, category, total, each member's name, phone number (as you entered it), share, amount paid and payment status, with dates and times.
• Automatic collections: a log of when a recurring group raised (or skipped) a collection and why.
• Activity: a feed of what happened on your collections (for example, that someone marked a share paid, or a reminder you sent), and when you last read it.
• Notifications: if you allow them, your device's push notification token, so we can send you those updates through Apple on iPhone. On Android, the app periodically checks your account activity and schedules reminders locally; Android may delay background delivery. Your payment-notification preference is saved to your account.
• Links sent to you: if someone collects from you and you add their link to your account ("Add to my Vasooly"), we link those shares to your account so you can see and pay them under "You owe".

Your profile photo, country, language and local reminder settings stay on your phone. Bill photos, speech recognition and smart-entry interpretation are processed on your phone; we do not upload your receipt image or audio. When you save a split, its title, note, people and amounts are sent to your account as described above.

On Android, bill recognition uses Google ML Kit. Your image and the recognized text are processed on your phone and are not sent to Google. The SDK sends Google device and app information, per-installation identifiers, and performance and usage metrics for diagnostics and usage analytics. See Google’s ML Kit data disclosure for the SDK data categories. Vasooly does not use this for advertising.

We use this only to run the app for you: to show your collections, create payer links, raise recurring collections and update statuses live.

4. Data about payers

Payers don't create an account or sign in. The organizer adds a payer's name, and optionally a phone number, to a collection. When a payer opens a Vasooly link:

• The page shows the collection's title, the organizer's UPI ID and payee name, and the list of members with each one's name, share, what's left to pay and status. It never shows phone numbers, and never shows anyone else's personal link.
• If the payer taps "I've paid", we record that status and the time.
• On group links, the page remembers which name you picked, in your own browser's local storage, so you don't have to choose again. It isn't sent to us, and you can clear it from your browser.

Payer links contain long random codes that can't be guessed. But anyone a link is forwarded to can see what that link shows, so please share links only with the people they're meant for.

If a payer also uses the Vasooly app and adds a link to their account, their shares in that organizer's collections are linked to their account, and they may get notifications about them (for example, a new collection or a reminder). The organizer doesn't see the payer's account details.

If you're a payer and want your name or number removed, ask the organizer, who can edit or delete it, or contact us.

5. The vasooly.com waitlist

If you join the waitlist on vasooly.com, we store the name, email address and (if you give it) phone number you enter, and when you joined. We use them only to tell you when Vasooly is available, and never share them. To limit abuse we keep a one-way hash of your IP address, not the address itself. To be removed, write to taher@vasooly.com.

6. Who processes the data

We don't sell or rent personal data, and we don't share it with advertisers. We use these service providers to run Vasooly:

AI and on-device processing

Vasooly's "AI" is the reading of what you type, say or photograph into a draft split: the amount, the people and the group. On iOS this is done by Apple's Vision (text in bill photos), Speech (your voice) and Foundation Models (typed and spoken lines) frameworks, running on your phone. On Android it is done by a parser built into the app and Google ML Kit text recognition, also on your phone.

Your typed lines, bill photos and audio are not sent to Vasooly's servers and are not sent to any third-party AI service: no OpenAI, Google Gemini, Anthropic or similar provider receives them. The app shows you this before smart entry is first used, and asks you to continue. The one exception: when you choose Hindi voice and your phone cannot recognise Hindi on its own, iOS sends the audio to Apple's speech service to transcribe it, under Apple's terms; the app says so on screen at the time, and typing always works instead.

Only the split you review and approve (title, note, people and amounts) is saved to your account, as described in section 3. The photo and audio are discarded once the draft is made.

Like most web services, these providers keep short-lived technical logs (such as IP address, browser type and time of request) for security and reliability.

When an organizer shares a link through WhatsApp or another app, the message is sent by that app from the organizer's phone, under that app's own privacy policy. Vasooly doesn't send messages for you.

We may disclose data if Indian law requires it.

7. How long we keep it, and deleting your account

We keep an organizer's data for as long as the account exists. Organizers can delete their account at any time from the app. This immediately deletes the account and everything stored with it (UPI IDs, contacts, groups, collections, payer statuses and logs), and all payer links for those collections stop working.

Copies may remain in our providers' backups for a short period until those backups expire, which takes up to 7 days.

To delete your Vasooly account in the app: open Vasooly, choose Profile, then Delete account, and confirm.

To ask without the app: email taher@vasooly.com with the subject "Vasooly account deletion", from the email linked to your account, with your display name. We may need to confirm it's you. Never send a password, sign-in code or bank details. More detail is on the account deletion page.

8. Security

Data is encrypted in transit. Each organizer can reach only their own data, which is enforced inside the database. Payers can reach only what their link shows, through a few narrow functions. No method is perfectly secure, but we work to protect your data and will tell you about a breach that affects you as the law requires.

9. Your rights

Under India's Digital Personal Data Protection Act, 2023, you can ask to access, correct or erase your personal data, and to nominate someone to act for you. Organizers can do most of this directly in the app. For anything else, or to raise a grievance, contact taher@vasooly.com. Our grievance officer is Taher Master (taher@vasooly.com).

Vasooly is meant for organizers aged 18 and over.

10. Changes

If we change this policy, we'll update this page and the date at the top, and tell organizers in the app about important changes.