Privacy Policy
Version 2026-09-29.1 · Last updated 2026-09-29
This Privacy Policy explains what personal information HamroCircle collects, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It applies to the HamroCircle website and web app.
HamroCircle is a local community and marketplace app. You can read this policy without an account.
1. Who we are
The service is operated by [COMPANY LEGAL NAME] (company registration number [REGISTRATION NUMBER]), with its registered address at [REGISTERED ADDRESS] ("HamroCircle", "we", "us"). We are the controller (the "data fiduciary" or "responsible party" under some laws) of the personal information described in this policy.
Privacy questions and requests: [PRIVACY CONTACT EMAIL]. Data protection officer: [DATA PROTECTION OFFICER].
2. Information we collect and why
We collect only what we need to run the service. The table shows each category, what it covers and what we use it for.
| Category | What it includes | What we use it for |
|---|---|---|
| CategoryAccount identity | What it includesEmail address, phone number (if you add one), name, date of birth, gender, profile photo. | What we use it forCreating and securing your account, signing you in, checking that you are 18 or older, showing your profile to other members, contacting you about your account. |
| CategoryLocation | What it includesYour chosen area or city, and precise GPS coordinates only if you allow your browser to share them. Optional city on your profile. Recent locations you pick. | What we use it forShowing nearby posts and listings, "near me" filters, showing where a listing is, and pre-filling location fields. |
| CategoryContent you create | What it includesPosts, comments, likes, listings, listing photos, ratings and reviews, rating evidence images, reports, blocks. | What we use it forProviding the community and marketplace, moderation, keeping the platform safe. |
| CategoryChats and media | What it includesMessages between you and other members and the images or files you send. | What we use it forDelivering conversations between buyers and sellers, safety and dispute handling. |
| CategoryAnalytics | What it includesWhich screens you open and what you tap, with a random session identifier, page path and timestamps. This data stays with us; it is not sent to an advertising or analytics company. | What we use it forUnderstanding what works, fixing problems, improving the product. Optional: off until you accept. |
| CategoryPush notifications | What it includesA subscription token from your browser's push service, and the name of your browser or device. | What we use it forSending the notifications you have turned on. |
| CategorySign-in (OTP) emails | What it includesYour email address, the one-time code and the time of each sign-in request. | What we use it forVerifying it is you when you sign in and preventing abuse. |
| CategoryTechnical data | What it includesIP address, browser type and request logs, held briefly by our hosting and security systems. | What we use it forKeeping the service running, rate limiting and detecting abuse. |
| CategoryYour messages to us | What it includesReports, appeals and support emails, and our replies. | What we use it forResponding to you and enforcing our rules. |
We do not ask for, and you should not post, sensitive information such as government ID numbers, financial account details, health information or precise home addresses in public content.
3. Legal bases for using your information
Where the law (for example the GDPR or UK GDPR) requires us to have a legal basis, we rely on the following.
- Contract: to create your account, sign you in, and provide the community, chat and marketplace features you ask for.
- Legitimate interests: to keep the platform safe and secure, prevent fraud and abuse, moderate content, and understand and improve the service. We weigh these interests against your rights and you can object (see "Your rights").
- Consent: for optional analytics, for precise location from your browser, and for push notifications. You can withdraw consent at any time; withdrawing does not affect processing that already took place.
- Legal obligation: to comply with law, respond to lawful requests from authorities, and keep records we are required to keep.
5. International transfers
HamroCircle is operated from Nepal and our providers operate globally, so your information can be processed in countries other than your own, including the United States and other countries whose data protection laws differ from yours.
When we transfer personal information out of the EU, UK, Brazil or another country that restricts transfers, we use a lawful mechanism, such as an adequacy decision, standard contractual clauses or your consent, together with contractual and technical safeguards. You can ask us for a copy of the safeguards at [PRIVACY CONTACT EMAIL].
6. How long we keep information
- Account data and your content are kept while your account is active.
- If you delete your account, it is deactivated immediately and your personal information is erased or irreversibly anonymised 30 days after deletion. Until then, signing back in restores it.
- If you deleted your account before this policy took effect, your personal information is instead erased or irreversibly anonymised within 90 days of that deletion, under the earlier policy.
- Messages in a conversation are shown to the other person, so after erasure your messages may remain visible to them without your name. Ratings and reports may be kept in anonymised or aggregate form so that trust and safety records stay accurate.
- Analytics events: [ANALYTICS RETENTION PERIOD]. Sign-in (OTP) records: [OTP RECORD RETENTION PERIOD].
- Moderation and safety records (for example reports and enforcement decisions): [MODERATION RECORD RETENTION PERIOD], or longer if a legal claim or investigation requires it.
- Backups are overwritten on a rolling cycle and deleted data leaves backups within [BACKUP RETENTION PERIOD].
- Content stored only in your browser stays until you clear it or sign out where the app clears it for you.
We may keep limited information for longer where the law requires it, or to establish, exercise or defend legal claims.
7. Your rights and choices
Depending on where you live, you may have the following rights. We apply them to everyone where we reasonably can.
- Access: ask what personal information we hold about you.
- Export (portability): use "Download my data" (on your profile under Account, or in the Edit profile menu on a phone) to get a copy of your information in a machine-readable file.
- Correction: update your profile in the app, or ask us to correct anything you cannot change yourself.
- Erasure: use "Delete Account" in the same place, or ask us at [PRIVACY CONTACT EMAIL].
- Objection and restriction: object to processing based on legitimate interests, or ask us to limit it.
- Withdraw consent: switch off push notifications, optional analytics (in Preferences) or location sharing at any time.
- Complain: you can complain to your local data protection authority (see the regional sections below). We would appreciate the chance to fix the problem first.
We will not discriminate against you for using these rights. We may need to verify your identity, normally by asking you to sign in, and we reply within the time the law sets (usually within 30 days).
9. Age: 18 and over only
HamroCircle is for adults. You must be at least 18 to create an account and we do not knowingly collect information from anyone younger. If you believe a person under 18 has an account, tell us at [PRIVACY CONTACT EMAIL] and we will remove it.
10. Security
We protect your information with encryption in transit, access controls that limit staff to what their job requires, sign-in by one-time codes instead of passwords, and monitoring for abuse. No system is perfectly secure. If a breach affects your rights, we will notify you and the authorities as the law requires.
Please choose who you meet and what you share with care, and keep your email account secure, as it is the key to your HamroCircle account.
11. People in the EU and UK
Our legal bases are set out above. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. You may lodge a complaint with your local supervisory authority, for example the data protection authority of your EU country or the Information Commissioner's Office in the UK.
Data protection officer: [DATA PROTECTION OFFICER]. EU representative (Article 27 GDPR): [EU REPRESENTATIVE]. UK representative: [UK REPRESENTATIVE]. Transfers outside the EU and UK are described in "International transfers".
12. California (CCPA/CPRA)
In the last 12 months we collected these categories of personal information: identifiers (name, email, phone), personal information in customer records, characteristics such as age and gender, geolocation data (including precise geolocation if you allow it), internet or app activity, audio-visual content (photos), and content you send in chats and posts. We collect them from you and from your use of the service, for the purposes described above, and disclose them to service providers (processors) that act on our instructions, to other members where a feature is designed to show your information, and to authorities where the law requires it, as described in "Who we share information with".
We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We use precise geolocation only to provide the location features you request, so we do not offer a "limit the use of sensitive personal information" link. We honour the Global Privacy Control signal.
California residents can ask to know, access, delete and correct their information, and can appoint an authorised agent, by using "Download my data" and "Delete Account" on their profile or writing to [PRIVACY CONTACT EMAIL]. We will not retaliate against you for exercising these rights.
13. India (DPDP Act 2023)
We process your personal data for the purposes described in this policy, based on your consent or on the legitimate uses the Act allows. You have the right to access information about your data, to correct and erase it, to grievance redressal, and to nominate another person to exercise your rights if you die or become incapacitated. You can withdraw consent as easily as you gave it.
Grievance officer: [GRIEVANCE OFFICER], [PRIVACY CONTACT EMAIL]. If we do not resolve your complaint you may complain to the Data Protection Board of India.
14. Brazil (LGPD)
Under the Lei Geral de Proteção de Dados you have the right to confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about who we share data with, information about the consequences of refusing consent, and revocation of consent. You can complain to the Autoridade Nacional de Proteção de Dados (ANPD).
Encarregado (data protection officer): [BRAZIL DATA PROTECTION OFFICER], [PRIVACY CONTACT EMAIL].
15. Canada (PIPEDA)
We collect, use and disclose personal information with your knowledge and consent for the purposes described in this policy, and we are accountable for the information we hold. You may access and challenge the accuracy of your information and withdraw consent, subject to legal or contractual limits. You can complain to the Office of the Privacy Commissioner of Canada or your provincial privacy authority.
Privacy officer: [CANADA PRIVACY OFFICER], [PRIVACY CONTACT EMAIL].
16. Nepal (Individual Privacy Act, 2075)
We collect and use personal information with your consent and for the purposes stated in this policy, keep it secure, and disclose it to others only as described here or as the law requires. You may ask to view, correct or delete your information, and to withdraw consent.
Contact us at [PRIVACY CONTACT EMAIL]. You may also seek remedies through the authorities and courts of Nepal as the Act provides.
17. Changes to this policy
We may update this policy as the service or the law changes. We will change the date and version at the top of this page and, for material changes, tell you in the app or by email before they take effect. If we need your consent for a change, we will ask for it.
18. Contact us
[COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Email: [PRIVACY CONTACT EMAIL].