Privacy notice

Who we are

Palm Mystery is run by Puran Concepts ("we", "us"). We decide why and how your personal data is used, so under the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary. Our contact details and our Grievance Officer are at the end of this notice and on the Contact page.

At the kiosk

The kiosk never asks for your name, phone number or an account. It knows only a session number and the code printed on your slip.

• Palm reading: after you agree on screen, the kiosk camera takes a few photos of your palm. They are used only to write your reading and to print a drawing of your hand on your slip. They are sent, in memory, to the language model service that writes the reading. They are never saved on the kiosk, in our database, in our logs or in any storage.
• From the same photos the kiosk measures the shape of your hand (palm and finger proportions) to choose your hand type. We do not use these measurements, or your photos, to identify you or to recognise you on a later visit.
• Tarot needs no personal data. Anyone who would rather not share a palm photo, and anyone under 18, can choose tarot.
• Payment is by UPI through our payment gateway, Razorpay. We keep the payment reference, the amount and the time. We do not keep your UPI ID, your name or your bank details, even when the gateway sends them to us, and we never see your UPI PIN.

On this website

You give us details only when you ask for something:

With each of these we also record the language you used, that you told us you are 18 or older, and how you reached us (for example a campaign link or the QR on your slip), so we know which places and campaigns work.

What we do not do

• No cookies for analytics or advertising, and no third-party trackers or ad pixels on this website.
• We do not sell or rent your data, or share it for anyone else’s marketing.
• We do not track your location, read your contacts or build an advertising profile of you.
• We count visits on our own server with a visitor code that changes every day, and we do not keep your IP address. Our hosting provider sees your IP address and browser details only to deliver pages and protect the website from attacks.

How long we keep it

Erased data also leaves our backups within 30 days, as old backups roll over.

Who else sees it

Only the services that help us run Palm Mystery, and only what each one needs for its job:

• Our hosting and database provider runs this website and our servers.
• Razorpay, our payment gateway, takes your payment.
• Meta’s WhatsApp service delivers your report link, your daily colour and sign-in codes.
• An email delivery service, only if you give us an email address.
• Language model services from Anthropic, OpenAI, Google and xAI write palm readings and reports. They receive the palm photos or details needed for that one reading. We use them under terms that do not let them train their models on it; some keep requests for a short time to check for abuse, and then delete them.

Some of these services process data outside India, which Indian law currently allows. We disclose data to a government authority only when the law requires it.

Your consent, and taking it back

We use your details only after you agree, by tapping the button under the short notice where we ask for them. Each purpose stands on its own: saying no to offers never affects your report or your plan. Nothing is ever ticked for you.

You can withdraw at any time, as easily as you agreed: reply STOP to any of our WhatsApp messages, message us, or write to our Grievance Officer. Withdrawal stops any further use. It does not undo what was done before it, and withdrawing from the lucky colour plan ends the plan (see the Refund policy).

Your rights

• Get a summary of the data we hold about you, what we do with it, and who we shared it with.
• Have it corrected, completed or updated.
• Have it erased, unless the law makes us keep it (for example payment records).
• Nominate someone to use these rights for you if you die or cannot act.
• Complain to us, and then to the Data Protection Board of India.

To use any of these rights, message us or write to our Grievance Officer. We may ask you to confirm the WhatsApp number we hold, so that nobody else gets your data. We acknowledge within 48 hours and resolve within one month.

Children

Palm readings, reports and the lucky colour plan are for adults. If a birth date shows someone is under 18, the website stops before anything is sent, and the kiosk offers tarot, which needs no personal data. We do not knowingly process a child’s data, and we never track anyone or target advertising at them.

How we protect it

• Names, numbers and birth details are encrypted in our database (AES-256), and your number is looked up through a keyed hash, so reading the database does not reveal them.
• Report and account links are long random codes, and search engines are told not to index those pages.
• Our logs never hold palm photos, names or phone numbers.
• If a breach affects your data, we will tell you and the Data Protection Board without delay, as the law requires.

Changes to this notice

When this notice changes, the date and version at the top change too. If a change affects something you agreed to, we ask you again before using your data in the new way.

Questions and complaints

Write to our Grievance Officer with any question or complaint about your data, using the details below. If our answer does not settle it, you can complain to the Data Protection Board of India. Most duties under the Digital Personal Data Protection Rules, 2025 apply in full from 13 May 2027; we follow them already.