Privacy Policy

HSTLE is a product of An Obvious Name Private Limited (CIN U62011MH2026PTC474273), Mumbai, India. We are the data fiduciary for the personal data described in this policy.

1. Who we are

HSTLE ("we", "us") operates a task marketplace in Mumbai, India, on iOS, Android and the web. Questions about this policy go to hello@hstle.in, or to the Grievance Officer named in section 15.

2. What we collect

• Account: name, phone number (verified by one-time password), email if you give one, language preference, and whether you use HSTLE to post, to work, or both.
• Identity verification: to keep the marketplace real, users scan a government photo ID and a short selfie video through our verification partner. The partner extracts the document details, checks the document is genuine and matches you, and reads your date of birth so we can enforce our 18+ rule. We store the verification outcome, your date of birth, a one-way cryptographic fingerprint of the ID number and at most its last few digits. We never store the raw ID number or the document image on our servers.
• Location: your device location, with your permission, to show nearby tasks and to set task locations. During an active task, the working Hustler's live location is shared with the Poster while they are on the way, so the Poster can see progress on a map. The app tells the Hustler when this is on. We keep only the most recent position for the duration of the task. When you open the feed with location on, we keep a rounded (about 500 m) last-known location so posters can see that people are free nearby. Never your exact position.
• Tasks, chats and photos: task descriptions, chat messages between matched users, ratings, and photos uploaded as proof of work or receipts.
• Payments: payment status, amounts, commission, refund and payout records, and the UPI ID you choose for receiving payouts. Card numbers, UPI PINs and bank credentials are handled entirely by our regulated payment partners and never reach us.
• Calls: in-app calls run through private, randomly named rooms on an audio-video service. We do not record calls and phone numbers are never revealed to the other side.
• Device and notifications: a push notification token, app version, and basic device type, so the app works and can notify you.
• Website analytics: when you visit hstle.in we count the page view on our own server, derive an approximate city from your IP address, and then keep only a one-way hash of the IP, never the address itself.

3. Where it comes from

Directly from you, from your device with permissions you grant, and from our verification and payment partners reporting the outcome of a check or a transaction you started.

4. Why we use it

• To run the marketplace: matching tasks, holding and releasing money, showing profiles and ratings, delivering chat, calls and notifications.
• To keep people safe: identity verification, the 18+ rule, moderation of what gets posted, a strike system for no-shows and abuse, and fraud prevention.
• To improve wording and pricing: task text you type or speak may be processed by AI services to suggest clearer descriptions, fair prices, and to screen for unsafe or prohibited content. Voice notes are transcribed by an AI transcription service.
• To support you: responding to complaints and in-app support messages.
• To meet legal duties: tax, accounting and lawful requests from authorities.

5. Consent and choice

We process your data on the basis of your consent, given when you accept these policies in the app, and for certain uses on legitimate grounds recognised by law, such as fraud prevention and compliance. You can withdraw consent at any time by deleting your account in the app. Some things simply stop working without certain data: no location means no nearby tasks, and no verification means no posting or working.

6. Who we share it with

We share personal data only with processors who help us run HSTLE, each bound to use it solely for that purpose:

• Identity verification: a regulated KYC provider processes your ID scan and selfie.
• Payments and payouts: RBI-regulated payment aggregators process pay-ins, refunds and payouts.
• Sign-in: Google Firebase delivers the phone one-time password.
• Infrastructure: our servers, database and encrypted backups run on cloud providers.
• Notifications: the push service that delivers alerts to your phone.
• AI processing: task text and voice notes may be processed by large language model providers for the purposes in section 4. These providers do not use your data to train their models under our agreements with them.
• Calls: an audio-video conferencing service carries in-app calls.

Beyond processors, we disclose data only when the law requires it or to protect users from fraud or harm. We do not sell personal data, and we do not share it with advertisers.

7. Where your data lives

Our primary servers and database are hosted in Singapore, with encrypted backups on international cloud storage. Verification, payment, AI and call partners may process data in their own regions. These transfers are made under the DPDP Act's provisions for cross-border processing.

8. How we protect it

All traffic is encrypted in transit. ID numbers exist only as one-way hashes. Money sits with regulated payment partners, not with us. Access to production data is restricted to the founder and is logged. No system is perfect, which is why section 11 exists.

9. How long we keep it

• Account data: until you delete your account.
• On deletion: your account and personal data are removed. Your messages in other people's task threads are anonymised rather than deleted, so the other side's record and any dispute evidence stays intact without your identity attached.
• Website analytics: hashed page-view rows are deleted after 30 days.
• Backups: rotated and deleted after 30 days.
• Live location: only the latest position is kept, for the duration of the active task.
• Payment and tax records: retained for the periods Indian tax and financial law requires, even after account deletion.

10. Your rights

Under the DPDP Act you can ask for access to your personal data, correction of it, and erasure of it. You can nominate a person to exercise your rights if you are unable to. You can delete your account directly in the app (Profile, then Delete account). To exercise any right, write to the Grievance Officer in section 15. If you are not satisfied with our response, you have the right to complain to the Data Protection Board of India.

11. If something goes wrong

If a personal data breach affects you, we will notify you and the Data Protection Board in the form and timelines the law prescribes, tell you plainly what happened, and what we are doing about it.

12. Children

HSTLE is for adults only. Age is checked from the government document during verification, not from a self-declared date. Accounts found to belong to anyone under 18 are closed and their data deleted.

13. Cookies

The website and web app use only essential cookies needed to keep you signed in and the site working. There are no advertising cookies and no third-party trackers.

14. Changes

When this policy changes we update the date at the top, and for significant changes the app will ask you to read and accept again before continuing.

15. Grievance Officer

Aquleem Sayyed, Founder, HSTLE (An Obvious Name Private Limited), Flat-2 Monogiri 8, Juhu Scheme 13th N S Road, Vile Parle (West), Mumbai 400056. Email hello@hstle.in. Grievances are acknowledged within 48 hours and resolved within 30 days, or sooner where the law requires.