Vinay E Patil is hereinafter referred to as the "Service Provider". By downloading, accessing, or using the Application, you agree to the collection and use of information in accordance with this Privacy Policy.
Data Controller Information
Vinay E Patil acts as the Data Controller (referred to as the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023) responsible for the processing of your personal data.
For data protection inquiries and to exercise your GDPR or California privacy rights, please contact the Data Controller using the contact information above.
Grievance Officer (India — DPDP Act, 2023)
In accordance with India's Digital Personal Data Protection Act, 2023 and its Rules, the following Grievance Officer is appointed to address complaints regarding the processing of your personal data:
Grievances submitted to the Grievance Officer will be acknowledged within 72 hours and, wherever reasonably possible, resolved within 30 days of receipt. If you are not satisfied with the resolution, you may escalate your complaint to the Data Protection Board of India.
What information does the Application obtain and how is it used?
The Application and related services acquire the information you supply when you download, access, or register for the service. Registration with the Service Provider is not mandatory. However, you might not be able to use some of the features offered by the service unless you register.
The Service Provider may also use the information you provide to send important information, required notices, and, where permitted by law, marketing communications.
Legal basis for processing your personal data
Where the GDPR applies, the Service Provider relies on one or more lawful bases to process your personal data, including:
- Contract performance: processing necessary to provide the Application or fulfil a contract with you.
- Consent: where you have given explicit consent to processing, including for marketing, analytics, or optional features. You may withdraw consent at any time without affecting processing that occurred before withdrawal.
- Legitimate interests: where processing is necessary for the Service Provider's specific legitimate interests, such as maintaining network and information security, preventing fraud and abuse, or improving the Application's core functionality through analytics, provided those interests are not overridden by your data protection rights or fundamental freedoms.
- Legal obligation: to comply with laws or government requests.
The table below sets out the specific lawful basis relied upon for each core processing activity within the Application:
- Account Registration & Vault Access: Performance of Contract (GDPR Art. 6(1)(b)) to authenticate users and store asset inventories.
- Smart Scan AI Extraction (Gemini API): Performance of Contract (GDPR Art. 6(1)(b)) and Explicit User Consent (Art. 6(1)(a)) when initiating document/receipt scans.
- Maintenance Reminders & Push Notifications: Explicit User Consent (GDPR Art. 6(1)(a)) and Legitimate Interests (Art. 6(1)(f)).
- Security, App Check & Crash Reporting (Firebase Crashlytics): Legitimate Interests (GDPR Art. 6(1)(f)) to secure backend services and prevent app crashes.
- Pro Subscriptions & Payment History: Performance of Contract (Art. 6(1)(b)) and Legal Obligation (Art. 6(1)(c)) for statutory accounting compliance.
Automated decision-making and profiling
If the Application uses automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, you have the right to request human review, express your point of view, and contest the decision. Information about the logic involved and the likely consequences of that processing will be provided where required by law.
What information does the Application collect automatically?
In addition, the Application may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device's unique device ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browsers you use, and information about the way you use the Application.
Does the Application collect precise real time location information of the device?
This Application does not gather precise information about the location of your mobile device.
Does the Application use Artificial Intelligence (AI) technologies?
Yes. AI-powered "Smart Scan" is a core feature of the Application, not just a personalization layer. When you photograph or upload a receipt, invoice, warranty card, insurance document, service bill, or a photo of an appliance/vehicle, that image is sent to Google's Gemini API (a third-party generative AI service operated by Google) to automatically extract structured details such as brand, model, purchase date, price, warranty period, service costs, and similar fields, which are then saved to your account.
- What is sent: The image or document you choose to scan, and the text/fields Gemini extracts from it.
- What is not sent: Gemini only receives the specific document you submit for scanning — not your full account data, other assets, or unrelated app usage.
- Retention by Google: Processing is governed by Google's Gemini API terms and privacy policy (linked below). We do not control how long Google's systems internally process the request beyond returning a response to the Application.
- Accuracy: AI-extracted data (prices, dates, warranty periods, etc.) may occasionally be inaccurate. You should review and correct any auto-filled field before saving it.
- AI Model Training: Your uploaded documents, receipts, invoices, images, and extracted text are processed via Google's enterprise developer APIs solely to return structured asset data to your account. They are never used by the Service Provider or Google to train, retrain, or fine-tune public artificial intelligence foundation models.
- Other AI uses: AI may also be used to personalize reminders, suggest maintenance schedules, or improve in-app recommendations based on your own data within the Application.
All AI processing is performed in accordance with this privacy policy and applicable law, and is subject to the same security safeguards described in this policy.
Subscriptions and Payments
The Application offers an optional paid "Pro" subscription. All payments are processed exclusively by Google Play Billing — the Application and the Service Provider never receive, see, or store your card number, UPI ID, or other payment credentials.
- What we receive from Google Play: A purchase token and subscription status (active, cancelled, expired, in a billing grace period, etc.), which our servers use only to grant or remove access to Pro features.
- Billing data such as your card details, billing address, and transaction history is held by Google, governed by the Google Payments Privacy Notice.
- Managing or cancelling: Subscriptions auto-renew unless cancelled at least 24 hours before the renewal date, and can be managed or cancelled at any time from the Google Play Store app (Menu → Subscriptions) or from within the Application.
- Account deletion: Deleting your Application account does not automatically cancel an active Google Play subscription — you must cancel it separately through Google Play, or you will continue to be billed.
Do third parties see and/or have access to information obtained by the Application?
Only aggregated, anonymized data is periodically transmitted to external services to aid the Service Provider in improving the Application and their service. The Service Provider may share your information with third parties in the ways that are described in this privacy statement.
Please note that the Application utilizes third-party services that have their own Privacy Policy about handling data. Below are the links to the Privacy Policy of the third-party service providers used by the Application:
The Service Provider may disclose User Provided and Automatically Collected Information:
- as required by law, such as to comply with a subpoena, or similar legal process;
- when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
- with their trusted services providers who work on their behalf, do not have an independent use of the information the Service Provider discloses to them, and have agreed to adhere to the rules set forth in this privacy statement.
Where the GDPR applies, the Service Provider enters into Data Processing Agreements (DPAs) with third-party service providers that process personal data on its behalf, as required by Article 28 of the GDPR. These DPAs impose the same data protection obligations on those service providers as described in this Privacy Policy.
International Data Transfers
The Service Provider or its third-party service providers may transfer personal data outside the European Economic Area (EEA). Where such transfers occur, the Service Provider will use an appropriate transfer mechanism required by GDPR Chapter V.
- Adequacy decisions by the European Commission
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Other safeguards or derogations recognized under GDPR Chapter V, including consent where legally permitted
Countries outside the EEA may not provide the same level of data protection as the EEA. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.
What are my opt-out rights?
You can stop further collection of information from your mobile device by uninstalling the Application. Uninstalling will stop the Application from collecting data from your device, but it does not automatically delete information that has already been transmitted to the Service Provider or to third parties.
You can withdraw consent, correct your data, or permanently delete your account and all associated data at any time directly within the Application — go to Profile → Delete Account. Withdrawing consent or deleting your account is designed to be at least as easy as granting it, with no additional steps required.
Web-Based Deletion Request: In accordance with Google Play's User Data & Account Deletion policies, you may also request the deletion of your account and associated personal data outside of the Application without having the app installed. Visit our dedicated Account & Data Deletion Page or email support@homeassetai.com from your registered email account.
What is the data retention policy and how can you manage your information?
The Service Provider retains personal data based on its necessity for the stated purposes:
- User Provided Data: Retained for the duration of your use of the Application plus 12 months thereafter, unless longer retention is required by law.
- Automatically Collected Data: Retained for up to 24 months from collection, unless longer retention is required for legal compliance or security purposes.
- Aggregated and Anonymized Data: Retained indefinitely as it no longer identifies you.
- Data required for legal compliance: Retained as long as required by applicable law.
You have the right to request deletion of your personal data at any time, except where retention is required by law. If you'd like the Service Provider to delete User Provided Data that you have provided via the Application, please contact them at support@homeassetai.com and they will respond within the time required by applicable law. Please note that some User Provided Data may be required in order for the Application to function properly.
How does the Application address children's privacy?
The Application is not intended for, or directed at, individuals under 18 years of age. This threshold is set to comply with India's Digital Personal Data Protection Act, 2023 (which treats anyone under 18 as a child requiring verifiable parental/guardian consent), and exceeds the minimum age requirements of the GDPR (13–16, depending on EU member state) and the U.S. COPPA (13). The Service Provider does not knowingly solicit data from, or market the Application to, anyone under 18.
The Service Provider does not knowingly collect personally identifiable information from anyone under 18 years of age. If you are a parent or guardian and believe your child has created an account or provided personal information, please contact the Service Provider immediately.
In the event the Service Provider discovers that a child under 18 has provided personal information, the Service Provider will promptly delete that data from its servers. Requests can be made via support@homeassetai.com, or directly within the Application under Profile → Delete Account, which permanently and immediately erases the account's data.
How is your information kept secure?
The Service Provider is committed to safeguarding the confidentiality of your information. The Service Provider implements physical, electronic, and procedural safeguards to protect information it processes and maintains. For example, access is limited to authorized employees and contractors who need to know that information to operate, develop, or improve the Application. However, no security system can prevent all potential security breaches.
Data Backups and Disaster Recovery
In accordance with data protection standards (including GDPR Article 32), the Service Provider maintains automated daily backups of the Application's database, retained for 7 days, together with delete-protection safeguards designed to prevent accidental or unauthorized deletion of the underlying database. These measures are designed to preserve data availability and allow for restoration in the event of a technical incident.
While we make our best administrative and technical efforts to protect and restore your data when necessary, no system is entirely immune to catastrophic loss. We encourage you to review our Terms of Service regarding your responsibility to maintain independent records of vital documents.
Where you delete an item, your account, or otherwise request erasure of your data, it is removed from our live production systems immediately. A residual copy may nonetheless persist in our encrypted backups for up to 7 days until it is overwritten in the ordinary course of our backup rotation cycle.
Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, the Service Provider will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law. Where the breach is likely to result in a high risk to your rights and freedoms, the Service Provider will also notify you without undue delay, providing information about the nature of the breach, the categories of data affected, and the measures taken or proposed to address the breach.
How will you be informed of changes to this Privacy Policy?
The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.
Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at support@homeassetai.com.
What are your GDPR data protection rights?
Under the GDPR, you have the following rights:
- Right of Access: You can request access to your personal data.
- Right to Rectification: You can request correction of inaccurate data.
- Right to Erasure: You can request deletion of your personal data (the "right to be forgotten").
- Right to Restrict Processing: You can request that the Data Controller limits how they use your data.
- Right to Data Portability: You can request a copy of your data in a structured, commonly used, machine-readable format.
- Right to Object: You can object to processing based on legitimate interests. You have an absolute right to object to processing for direct marketing purposes at any time.
- Right to Withdraw Consent: Where processing is based on your consent, you can withdraw it at any time. Withdrawal is as simple as toggling preferences in the Application's settings or contacting the Data Controller.
- Rights Regarding Automated Decision-Making: You have rights related to automated decisions that affect you.
If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority. Contact details for each country's Data Protection Authority can be found at: https://edpb.ec.europa.eu/about-edpb/members_en
If you are located in the United Kingdom, you may contact the Information Commissioner's Office at https://ico.org.uk
What are your California privacy rights (CCPA/CPRA)?
If you are a resident of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:
- Right to Know: You can request disclosure of the categories and specific pieces of personal information the Service Provider has collected about you.
- Right to Delete: You can request deletion of personal information the Service Provider has collected from you, subject to certain exceptions.
- Right to Correct: You can request correction of inaccurate personal information.
- Right to Opt-Out: You can opt out of the sale or sharing of your personal information for cross-context behavioral advertising.
- Right to Limit Use of Sensitive Personal Information: You can limit the use of your sensitive personal information to essential purposes.
- Right to Non-Discrimination: The Service Provider will not discriminate against you for exercising any of your CCPA/CPRA rights.
Statutory 12-Month Lookback Notice: In the preceding 12 months, the Service Provider has not sold, rented, or shared any personal information with third parties for cross-context behavioral advertising, nor do we sell or share the personal information of consumers under 18 years of age.
To exercise any of these rights, please contact the Service Provider at support@homeassetai.com. The Service Provider will verify your request using the information you provide and respond within the timeframes required by law. You may designate an authorized agent to make a request on your behalf.
What are your rights under India's DPDP Act, 2023?
If you are located in India, the Digital Personal Data Protection Act, 2023 provides you with the following rights as a Data Principal:
- Right to Access: A summary of your personal data being processed and the processing activities undertaken.
- Right to Correction and Erasure: Correction of inaccurate or incomplete data, and erasure of data that is no longer necessary for the purpose it was collected.
- Right to Grievance Redressal: You may file a complaint with our Grievance Officer (see above) before approaching the Data Protection Board of India.
- Right to Nominate: You may nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
- Right to Withdraw Consent: You may withdraw consent at any time, as easily as it was given, via Profile → Delete Account in the Application or by emailing the Grievance Officer.
In accordance with the DPDP Act 2023, Data Principals may request this notice or lodge complaints in any language specified in the Eighth Schedule to the Constitution of India by contacting the Grievance Officer.
To exercise any of these rights, contact the Grievance Officer at support@homeassetai.com.
Governing Law and Jurisdiction
This Privacy Policy, and any dispute arising from or relating to it or your use of the Application, is governed by the laws of India, without regard to its conflict-of-law provisions. Subject to the mandatory consumer-protection and data-protection rights available to you under the law of your own country of residence (including the EEA, UK, and California provisions described above, which continue to apply to those users), the courts located in Bengaluru, Karnataka, India shall have exclusive jurisdiction over any dispute not otherwise resolved through the grievance process described in this policy.
How do you give your consent?
Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases, including contract performance, legitimate interests, or legal obligations, is carried out as described above.
How can you contact the Data Controller?
If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at support@homeassetai.com.
To request deletion of your personal data or to exercise any of your rights, contact the Service Provider using the details provided above. The Service Provider will respond within one month of receiving your request, extendable by up to two months where necessary due to the complexity or volume of requests, as permitted by applicable law.