Privacy Policy

1. Who we are and what this notice covers

Sunbots Innovations LLP, 13 Hariharashray Bungalows, Thaltej, Ahmedabad, Gujarat 380059, India, makes the SMARTON mobile app, the SMARTON smart glasses (“the Device”), the MIRA assistant and the website getsmartonai.com (together, “the Services”). This notice explains what personal data we collect through the Services, why, who we share it with, how long we keep it and the rights you have.

For India we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act). For people in the European Economic Area and the United Kingdom we are the controller under the GDPR and UK GDPR. For California residents we are a business under the California Consumer Privacy Act as amended by the CPRA. Where a partner such as Swiggy provides its own service to you, that partner is an independent data fiduciary or controller and its notice applies.

This notice is layered: the summary above gives the essentials, and the sections below give the detail. Our Cookie Policy and Sub-processors list form part of it.

2. What we collect, where it comes from and why

The table lists each category of personal data, typical examples, where it comes from, what we use it for and the lawful basis. Under the DPDP Act we rely on your consent unless the Act allows a “legitimate use” (for example, data you volunteer for a stated purpose, or compliance with law). Under the GDPR the Article 6 basis is shown, with Article 9 explicit consent for health, disability and sexual-orientation data. We do not use personal data for purposes incompatible with those listed without asking you first.

We do not sell personal data, and we do not use it for automated decisions with legal or similarly significant effects except the dating-verification check described in section 7, which always includes human review.

3. Camera and smart-glasses capture

SmartEye, object, currency and text recognition, Document AI and MIRA's visual questions all use your phone camera or the camera in the SMARTON smart glasses. The camera is used only when you start a feature that needs it, and the app announces audibly when a camera feature starts and stops. The smart glasses show a visible capture indicator light while the camera is active so that people around you can see it.

On-device first, cloud when needed

Where a feature supports it, recognition runs on your device and the image never leaves your phone. When a feature needs cloud processing (for example detailed scene description, multi-page documents or a question to MIRA), frames are sent over an encrypted connection to our servers in India and to the AI providers listed in section 11, used only to generate the answer, and not stored beyond the request unless the result is part of a MIRA conversation you keep. We do not use captured images to build biometric or facial-recognition profiles of people around you.

People who appear in your camera view (bystander notice)

Cameras on your phone or glasses may capture other people incidentally. Please use SMARTON respectfully and lawfully: do not point it at people in places where they would reasonably expect privacy (changing rooms, medical settings, other people's homes without permission) and comply with any local rule on recording. Images of bystanders are processed solely to answer your request and are never used to identify them, shared for advertising, or sold. If you believe you were captured by a SMARTON user and want to raise a concern, contact our Grievance Officer, Ravi Jadav, at ravi.jadav@sunbots.in (section 18).

4. Voice, MIRA and AI processing

SMARTON is built around voice. Your speech is converted to text (on-device where available, otherwise by the speech providers in section 11), interpreted by MIRA and answered with synthetic speech. MIRA's responses are generated by Google Gemini models and by open Gemma models that we run on our own servers in India. Spoken replies are produced by your device's built-in text-to-speech engine or by our own internal speech service; these are computer-generated voices, not recordings of real people. Scripts and narration for SMARTON audio series, books and news are produced with Anthropic (Claude) and ElevenLabs.

• You are talking to an AI. MIRA is an artificial-intelligence assistant, not a human. It can misread, mishear or be wrong. Always verify anything important — medication labels, currency, traffic, contracts — with a trusted person or the original source.
• No training on your data. Our contracts with AI providers prohibit them from using your content to train or improve their general models, and require them to delete it after the request except for limited abuse-monitoring under their API terms.
• Conversation history. MIRA conversations are stored so you can return to them, for up to 12 months or until you delete them in the app.
• Human review. Sunbots staff may review a conversation only when you report a problem, when required to investigate abuse, or with your permission to improve accessibility. We never review conversations for advertising.

5. Location

Location is off until you grant the permission on your phone, and we use it only while the app is in use. It powers navigation, “what is around me”, nearby places, and suggesting a delivery address for food orders. Precise location is sent to our servers and to Google Maps Platform to answer your request and is not kept as a location history. Withdraw the permission at any time in your phone settings; features that need it will ask again when you use them.

6. Contacts

If you allow the contacts permission, SMARTON can call people by name (“call Priya”). Contact names and numbers are used only to place the calls you ask for. We do not use your contacts for marketing, we do not share them with anyone, and we do not sell them. You can withdraw the permission in your phone settings at any time.

7. Dating and disability verification

SMARTON Dating is a community for adults with visual impairment and is strictly for people aged 18 or over. Because it involves health, disability and, potentially, sexual-orientation information, it is entirely optional and works only with your explicit consent, which you give in a separate step before creating a profile and can withdraw at any time by deleting the profile.

Verification

To keep the community genuine we ask you to upload a disability certificate or UDID card. The document is read by an automated OCR step (Google Gemini) to extract the certificate details, then reviewed by a trained Sunbots reviewer before any decision is made. Certificates are encrypted at rest with separate keys, visible only to reviewers, never shown to other members, and deleted when your dating profile is deleted. If verification is refused you can ask for a second human review and give more context by emailing our Grievance Officer, Ravi Jadav, at ravi.jadav@sunbots.in; no decision is made by automation alone.

Profiles, matching and chat

Your profile, photos, age, gender, the genders you would like to meet and your preferences are shown to other members according to your settings. Chat messages are private between you and the other member but are screened by an AI moderation model for harassment, scams and illegal content; flagged messages are reviewed by a human before any action. We keep reports you make and the outcome so that repeat behaviour can be addressed. We never use dating data for advertising or share it with data brokers.

8. Food ordering with Swiggy

You can order food by voice through Swiggy. When you link your Swiggy account, Swiggy provides the ordering service under its own terms and privacy policy and is an independent data fiduciary / controller. To place an order we pass Swiggy your name, phone number, delivery address and the order you dictate, and we receive order status back so MIRA can read it to you. We do not receive your Swiggy payment details. You can unlink Swiggy at any time in Settings.

9. Payments and subscriptions

Subscriptions and in-app purchases are processed by Apple (App Store), Google (Play Billing) or Razorpay depending on where you buy. These processors handle your card, UPI or bank details under their own PCI-DSS-compliant systems; we receive only transaction identifiers, the plan purchased, amount, and the billing name and country needed for invoices. We keep payment and invoice records for 8 years because Indian tax law requires it. Refunds follow our Refund Policy.

10. Analytics and crash reporting

App analytics — opt-in

Usage analytics in the app is off by default. If you switch it on under Settings → Privacy and data, we record which screens and features you use, with a pseudonymous ID, in PostHog (hosted by Sunbots in India at analytics.sunbots.in) and Firebase Analytics. Switch it off in the same place at any time; earlier events are deleted within 24 months on the normal schedule or sooner if you delete your account.

Crash and performance reports

Firebase Crashlytics and Performance Monitoring collect crash traces, device model, OS and app version so that we can fix bugs. These contain no content from your camera, voice or messages and are deleted after 90 days.

Website

The website loads Google Analytics 4 and Hotjar (analytics) and the Meta Pixel (marketing) only after you accept those categories in the cookie banner, and honours the Global Privacy Control signal. Details and durations are in the Cookie Policy. Change your choice any time with the Cookie settings control.

11. Who we share data with (sub-processors)

We share personal data only with providers that process it on our instructions under written contracts, with partners you choose to connect, and where the law requires. We never sell it. The main providers are summarised below; the full, current list with what each one receives is on our Sub-processors page.

We may also disclose personal data to comply with law or a lawful government request, to enforce our Terms, to protect the safety of a person, or as part of a merger or acquisition (in which case this notice continues to apply and you will be told).

12. International transfers

Our main servers and databases are in Amazon Web Services' Mumbai region (India), and our self-hosted AI models run on Webyne servers in India. Some providers — in particular the AI, email and SMS services in section 11 — process data in the United States or other countries.

• India: the DPDP Act permits transfers outside India except to countries restricted by the Central Government; we do not transfer data to any restricted country.
• EU / UK: transfers to India and the United States rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), supplemented by encryption in transit and at rest and vendor security assessments. You can request a copy of the relevant clauses from us.
• Everywhere: every provider is bound to at least the protections described in this notice.

13. How long we keep data

We keep personal data only as long as needed for the purpose it was collected for, or as the law requires, and then delete or anonymise it.

When you delete your account (section 15) all of the above is deleted on the stated schedule; backups are overwritten within their normal cycle.

14. Security

We protect personal data with encryption in transit (TLS 1.2 or higher) and at rest, separate encryption keys for verification documents, role-based access with multi-factor authentication for staff, audit logging, secure development practices, and regular vulnerability testing. No system is perfectly secure: keep your sign-in details private, use the latest app version, and tell us immediately if you suspect misuse. If a personal-data breach affects you we will notify you and the relevant authority as the DPDP Act, GDPR (within 72 hours) and other applicable laws require.

15. Your rights and how to use them

India — DPDP Act, 2023

• Access a summary of the personal data we process and who we have shared it with (s.11).
• Correction, completion, updating and erasure of your personal data (s.12).
• Withdraw consent at any time, as easily as you gave it (s.6(4)); we then stop the processing that relied on it.
• Grievance redressal through our Grievance Officer, Ravi Jadav (ravi.jadav@sunbots.in), under s.13, and if unsatisfied, a complaint to the Data Protection Board of India.
• Nominate a person to exercise your rights if you are incapacitated or pass away (s.14) — email us with the nominee's details.

EU and UK — GDPR Articles 15 to 22

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability in a machine-readable format (Art. 20).
• Object (Art. 21) to processing based on legitimate interests, and at any time to direct marketing.
• Not to be subject to a decision based solely on automated processing that has legal or similarly significant effects (Art. 22). Our dating-verification check always includes human review, and you may contest any outcome and express your point of view.
• Withdraw consent at any time without affecting earlier processing (Art. 7(3)).
• Lodge a complaint with your national supervisory authority or the UK Information Commissioner's Office. Where required, we will appoint a representative in the EU or UK under Article 27 and publish their details here.

California — CCPA / CPRA

• Right to know the categories and specific pieces of personal information we collect, the sources, purposes and third parties (this notice; and a copy via the export tool below).
• Right to delete and right to correct.
• Right to opt out of sale or sharing. We do not sell personal information for money. Our website's Meta Pixel may count as “sharing” for cross-context behavioural advertising; it loads only with your consent, and you can opt out through the Do Not Sell or Share My Personal Information link or by enabling Global Privacy Control in your browser, which we honour automatically.
• Right to limit use of sensitive personal information (precise location, health and disability data, sexual orientation, message contents, account credentials). We use sensitive information only to provide the service you asked for and for security, and never to infer characteristics for advertising.
• Right to non-discrimination: we will not deny you service, charge different prices or provide a different quality because you exercised your rights.
• You may use an authorised agent; we will ask the agent for proof of authority and may verify your identity directly. In the past 12 months we have not sold personal information and have shared only the cookie identifiers described in the Cookie Policy, with consent.

How to exercise your rights

• Export your data: in the app, Settings → Privacy and data → Download my data (JSON).
• Delete your account: in the app, Settings → Support → Delete account, or use the web form at getsmartonai.com/delete-account. Completed within 7 days with a confirmation.
• Analytics opt-out: Settings → Privacy and data → analytics toggle. Website cookies: Cookie settings in the footer.
• Everything else (access, correction, objection, nomination, complaints): email support@sunbots.in with the subject “Privacy request”, or write to our Grievance Officer, Ravi Jadav, at ravi.jadav@sunbots.in (section 18).
• We verify requests using your account contact details and respond within 30 days (45 days for California requests, extendable once where the law allows). There is no charge unless a request is clearly unfounded or excessive.

16. Children

SMARTON is not directed at children under 13 (the age used by the US Children's Online Privacy Protection Act) and we do not knowingly collect their data. Under the DPDP Act anyone under 18 is a child: if you are under 18 in India, a parent or lawful guardian must give verifiable consent before an account is created, and we do not track, behaviourally monitor or target advertising at children. The dating feature is strictly for adults aged 18 or over and is verified. If you believe we hold data about a child without appropriate consent, contact us and we will delete it promptly.

17. Changes to this notice

We update this notice when the Services, the law or our providers change. Material changes are announced in the app, on this page and by email at least 15 days before they take effect wherever practicable; where a change needs new consent, we will ask for it. Continued use after the effective date means the updated notice applies.

Change log

• Version 2.0 — 29 September 2026. Rewritten as a layered notice. Added: camera and smart-glasses capture with bystander notice; voice and AI transparency; location and contacts; dating and disability verification; food ordering with Swiggy; payments; opt-in analytics and crash reporting; sub-processors table and page; international transfers; retention schedule; GDPR and CPRA rights alongside DPDP; children; web account-deletion form; consent-based website cookies.
• Version 1.0 — 01 September 2025. Initial DPDP Act notice.

18. Contact and Grievance Officer

The Grievance Officer is also our contact for GDPR and CPRA requests and for any question about this notice. We acknowledge grievances within 7 days and aim to resolve them within 30 days. If you are not satisfied you may approach the Data Protection Board of India, your EU/UK supervisory authority, or the California Privacy Protection Agency, as applicable.