Privacy Policy
Last updated 25 September 2026
How TODO Legal Entity Name Pvt Ltd collects, uses and protects your information, in line with India's Digital Personal Data Protection Act, 2023.
What we collect
- Your mobile number, to verify your identity and secure your account.
- Your first name, if you choose to give it, to personalise readings.
- Your email address, given at signup, used for payment receipts and to reach you about your account. We do not send marketing to it.
- Your palm photograph, at the moment you take it, solely in order to generate a reading.
- The text of the readings we generate for you.
- Payment status from our gateway. We never see or store your card number, UPI PIN or bank credentials.
- Basic technical logs such as IP address and timestamps, used for security and abuse prevention.
- If you accept analytics cookies: which pages you visit and which steps you complete, via Google Analytics and the Meta (Facebook) Pixel.
Your palm photograph
This is the part people ask about most, so we are explicit: your palm photograph is transmitted to our AI provider over an encrypted connection, analysed, and then discarded. It is not written to our database or object storage, and it is not used to train any model by us.
Only the written reading is retained, attached to your account, so you can read it again later.
Why we are allowed to use it
We process your data on the basis of the consent you give when you sign up and upload a photograph, and to perform the contract between us. Analytics and advertising cookies are processed only on the separate, specific consent you give in the cookie banner. You may withdraw either consent at any time.
Who we share it with
- Our SMS provider, to deliver your one-time verification code.
- Our payment gateway, to set up and collect your subscription. It receives your name and email so it can issue receipts.
- Our AI provider, which receives the palm image in order to produce the reading.
- Law enforcement or regulators, where we are legally compelled.
We do not sell your personal data, and we never send your phone number, your name or the text of your readings to an advertising network.
Analytics and advertising cookies
If you accept them, we use Google Analytics 4 and the Meta (Facebook) Pixel to measure how people find the site and which steps they complete. These set cookies in your browser and share a pseudonymous identifier, your approximate location and the pages you viewed with Google and Meta, who may use it to measure and target advertising.
- Nothing loads until you choose. Both tools start with consent denied and are only enabled if you press Accept.
- Declining is remembered and costs you nothing — the site works identically either way.
- We never pass your phone number, name, or any part of a reading to either provider.
- Purchase events record only the amount charged and an order reference, never who you are.
You can change your mind at any time by clearing this site’s data in your browser, which makes the choice appear again.
How long we keep it
Readings are kept until you delete them or close your account. Your mobile number and email address are kept while your account is open. Verification codes expire within minutes. Technical logs are kept for up to 90 days.
Your rights
You may request access to, correction of, or deletion of your personal data, and you may nominate someone to exercise these rights on your behalf. Write to [email protected] and we will respond within 30 days.
Security
Traffic is encrypted in transit. Sessions use signed, HTTP-only cookies. Verification codes are stored only as salted hashes and are single-use. No system is perfectly secure, so please use a device only you can access.
Children
PalmZer is not intended for anyone under 18 and we do not knowingly collect their data.
Grievance officer
As required by Indian law you may contact our grievance officer at [email protected], or by post at TODO Street, City, State, PIN, India.