Privacy Policy

Meshly Technologies Pvt. Ltd. ("Shabash", "we", "us") operates the Shabash mobile application and this website. You can reach us at help@maya.pro.

For the purposes of applicable data protection law, including India's Digital Personal Data Protection Act, 2023, we act as the data fiduciary for the personal data described in this policy.

We collect only what is needed to build your plan, run your coaching, and keep the service working.

• Account details: your mobile number, name, age and preferred language.
• Health information you choose to share: goals, symptoms, conditions, medications, dietary preferences, activity levels and any reports you upload.
• Coaching content: your messages, voice notes and the responses from your coaching team.
• Plan activity: which steps you completed, water logged, habits tracked and plan changes you requested.
• Device and technical data: device model, operating system version, app version, IP address, crash logs and diagnostic events.
• Usage data: screens visited, features used and time spent, in aggregate form.

We do not collect precise location, contacts, photos or microphone data except where you explicitly grant permission for a specific feature — for example recording a voice note.

• To build, deliver and adapt your daily plan.
• To let your coaching team answer your questions with the right context.
• To flag potential interactions between a suggested remedy and medication you have told us about.
• To send you reminders and service notifications you have opted into.
• To provide customer support and investigate issues you report.
• To detect fraud, abuse and security incidents.
• To improve the product using aggregated, de-identified analytics.
• To meet legal, regulatory and tax obligations.

We do not use your health data for advertising, and we do not sell personal data to anyone, ever.

We process your personal data on the basis of the consent you give during onboarding and, where applicable, on the basis of legitimate uses recognised under law, such as responding to a request you initiate or complying with a legal obligation.

Health data is treated as sensitive. We ask for it separately, explain why it is needed, and you can decline — some features will simply be unavailable if you do.

You may withdraw consent at any time from Profile → Settings → Privacy, or by writing to us. Withdrawing consent does not affect processing already carried out lawfully.

We share the minimum necessary, with the following categories of recipients:

• Your coaching team — the coaches you are matched with see your plan, history and messages.
• Infrastructure providers — cloud hosting, database, storage and push notification services, under contract and bound to confidentiality.
• Analytics and crash reporting providers — receiving de-identified or pseudonymised data only.
• Payment processors — for paid plans; they receive transaction data, never health data.
• Legal and regulatory authorities — where we are legally compelled to disclose.

We never share your health data with advertisers, data brokers, insurers or employers.

We keep your account and health data for as long as your account is active, and for a limited period afterwards where required for legal, tax or dispute-resolution purposes.

When you delete your account, we begin erasure within 7 days and complete it within 30 days, except for records we are legally obliged to retain — for example transaction records under tax law — which are retained in isolated, access-restricted storage.

Backups are rotated on a rolling schedule; deleted data ages out of backups within 90 days.

• Encryption in transit using TLS 1.3 and at rest using AES-256.
• Role-based access control — coaches see only the users assigned to them.
• Access logging and periodic review of privileged access.
• Secrets management, dependency scanning and regular security review.
• Staff training on health data handling, with confidentiality obligations in every contract.

No system is perfectly secure. If a breach affecting your personal data occurs, we will notify you and the relevant authority as required by law and without undue delay.

Subject to applicable law, you have the right to:

• Access a copy of the personal data we hold about you.
• Correct data that is inaccurate, incomplete or out of date.
• Erase your data and close your account.
• Withdraw consent for specific processing.
• Nominate another individual to exercise your rights in the event of death or incapacity.
• Raise a grievance with our Grievance Officer, and escalate to the Data Protection Board of India if unsatisfied.

To exercise any of these, use the in-app controls or write to help@maya.pro. We respond within 30 days.

Shabash is not intended for anyone under 18. We do not knowingly collect data from children. If we learn that we have, we delete it promptly. A parent or guardian who believes their child has created an account should contact us immediately.

Your data is primarily stored on servers located in India. Where a service provider processes data outside India, we ensure comparable protection through contractual safeguards and restrict transfers to jurisdictions permitted under applicable law.

We may update this policy as the product changes. Material changes are announced in the app and by email at least 14 days before they take effect. The date at the top of this page always reflects the current version.