1. Who we are
HSTLE ("we", "us") operates a task marketplace in Mumbai, India, on iOS, Android and the web. Questions about this policy go to hello@hstle.in, or to the Grievance Officer named in section 15.
2. What we collect
- Account: name, phone number (verified by one-time password), email if you give one, language preference, and whether you use HSTLE to post, to work, or both.
- Identity verification: to keep the marketplace real, we check who you are in one of three ways. A scan with our verification partner: you scan a government photo ID and take a short selfie video. The partner extracts the document details, checks the document is genuine and matches you, and reads your date of birth so we can enforce our 18+ rule. We store the verification outcome, your date of birth, a one-way cryptographic fingerprint of the ID number and at most its last few digits. We never store the raw ID number or the document image on our servers. DigiLocker: you share your Aadhaar from your own DigiLocker account, with your consent, and take a selfie that our verification partner checks is live and matches the Aadhaar photo. From it we keep the name on the Aadhaar, your date of birth and the last 4 digits of the number. We never receive the full number, and we keep no images: not the selfie, not the Aadhaar photo. Photos checked by our team: you send a photo of your ID and a selfie, and a person on our team checks them by hand. The ID photo shows what is printed on your ID, its number included, so for Aadhaar we ask you to cover the first 8 digits. We keep the two photos in our database only until our team decides, and never longer than 30 days. Only the HSTLE staff who check IDs can see them, they are never shown to other users, and then we delete them. We keep no ID number, fingerprint or digits from them.
- Location: your device location, with your permission, to show nearby tasks and to set task locations. During an active task, the working Hustler's live location is shared with the Poster while they are on the way, so the Poster can see progress on a map. The app tells the Hustler when this is on. We keep only the most recent position for the duration of the task. When you open the feed with location on, we keep a rounded (about 500 m) last-known location so posters can see that people are free nearby. Never your exact position.
- Tasks, chats and photos: task descriptions, chat messages between matched users, ratings, and photos uploaded as proof of work or receipts.
- Payments: payment status, amounts, commission, refund and payout records, and the UPI ID you choose for receiving payouts. Card numbers, UPI PINs and bank credentials are handled entirely by our regulated payment partners and never reach us.
- Calls: in-app calls run through private, randomly named rooms on an audio-video service. We do not record calls and phone numbers are never revealed to the other side.
- Device and notifications: a push notification token, app version, and basic device type, so the app works and can notify you.
- Website analytics: when you visit hstle.in we count the page view on our own server, derive an approximate city from your IP address, and then keep only a one-way hash of the IP, never the address itself.
- Connected assistants: if you connect an AI assistant such as ChatGPT or Claude to your account, we keep a record of the connection (which assistant, the access it has, when it was made and last used), its sign-in tokens only as one-way hashes, and the tasks it posted for you. We log each call an assistant makes to HSTLE with the kind of call and how it came out, never the words of a task.
- Sharing a task: the link carries your referral code, which starts with the first letters of your name, so anyone you send it to can see them. We count opens of shared links, never who opened them.
3. Where it comes from
Directly from you, from your device with permissions you grant, and from our verification and payment partners reporting the outcome of a check or a transaction you started.
4. Why we use it
- To run the marketplace: matching tasks, holding and releasing money, showing profiles and ratings, delivering chat, calls and notifications.
- To keep people safe: identity verification, the 18+ rule, moderation of what gets posted, a strike system for no-shows and abuse, and fraud prevention.
- To improve wording and pricing: task text you type or speak may be processed by AI services to suggest clearer descriptions, fair prices, and to screen for unsafe or prohibited content. Voice notes are transcribed by an AI transcription service.
- To support you: responding to complaints and in-app support messages.
- To meet legal duties: tax, accounting and lawful requests from authorities.
5. Consent and choice
We process your data on the basis of your consent, given when you accept these policies in the app, and for certain uses on legitimate grounds recognised by law, such as fraud prevention and compliance. You can withdraw consent at any time by deleting your account in the app. Some things simply stop working without certain data: no location means no nearby tasks, and no verification means no posting or working.
6. Who we share it with
We share personal data only with processors who help us run HSTLE, each bound to use it solely for that purpose:
- Identity verification: a regulated KYC provider processes your ID scan, or the Aadhaar you share through DigiLocker, and your selfie. ID photos you send for our team to check stay with us.
- Payments and payouts: RBI-regulated payment aggregators process pay-ins, refunds and payouts.
- Sign-in: Google Firebase delivers the phone one-time password and runs Sign in with Google and Apple. The web sign-up page loads Google’s sign-in code and asks Google which websites may use it.
- Infrastructure: our servers, database and encrypted backups run on cloud providers.
- Notifications: the push service that delivers alerts to your phone.
- AI processing: task text and voice notes may be processed by large language model providers for the purposes in section 4. These providers do not use your data to train their models under our agreements with them.
- Calls: an audio-video conferencing service carries in-app calls.
- Maps and place names: the coordinates you search or pin are sent to OpenStreetMap's geocoding service to show a place name. Map tiles come from Apple Maps on iPhone and OpenStreetMap elsewhere.
- Crash reports: if the app crashes, a report with the device model, app version and the error, but not your messages or documents, goes to an error-reporting service so we can fix it.
- Assistants you connect: a connected assistant receives what it asks HSTLE for on your behalf: the words, status and price of your tasks, how many people applied, and, for a task it posted, the photos and files the person doing it sent for it. The company behind the assistant keeps these in your conversation under its own privacy policy. A connected assistant can never pay, pick a person, read your chats or see a phone number, and you can disconnect it at any time in the app under You, Connected assistants.
Beyond processors, we disclose data only when the law requires it or to protect users from fraud or harm. We do not sell personal data, and we do not share it with advertisers.
7. Where your data lives
Our primary servers and database are hosted in Singapore, with encrypted backups on international cloud storage. Verification, payment, AI and call partners may process data in their own regions. These transfers are made under the DPDP Act's provisions for cross-border processing.
8. How we protect it
All traffic is encrypted in transit. ID numbers from a scan or DigiLocker exist only as one-way hashes and last digits. ID photos sent for our team to check stay in our database, never in public storage, until they are deleted. Money sits with regulated payment partners, not with us. Direct access to production data is restricted to the founder and is logged. Our staff work through a staff console that shows them only what their work needs, and ID photos open there only for the staff who check IDs. No system is perfect, which is why section 11 exists.
9. How long we keep it
- Account data: until you delete your account.
- On deletion: your account and personal data are removed. Your messages in other people's task threads are anonymised rather than deleted, so the other side's record and any dispute evidence stays intact without your identity attached.
- Website analytics: hashed page-view rows are deleted after 30 days.
- ID photos sent for our team to check: deleted once our team decides, and after 30 days at most.
- Backups: rotated and deleted after 30 days.
- Live location: only the latest position is kept, for the duration of the active task.
- Payment and tax records: retained for the periods Indian tax and financial law requires, even after account deletion.
- Connected assistants: an access token lasts 1 hour and a sign-in refresh token 30 days, renewed while the assistant is in use. The connection ends when you disconnect it or delete your account, and its records are deleted with your account.
10. Your rights
Under the DPDP Act you can ask for access to your personal data, correction of it, and erasure of it. You can nominate a person to exercise your rights if you are unable to. You can delete your account directly in the app (You, then Profile, then Delete account), or ask us to do it: see Delete your account for the steps, what is deleted and what the law makes us keep. To exercise any right, write to the Grievance Officer in section 15. If you are not satisfied with our response, you have the right to complain to the Data Protection Board of India.
11. If something goes wrong
If a personal data breach affects you, we will notify you and the Data Protection Board in the form and timelines the law prescribes, tell you plainly what happened, and what we are doing about it.
12. Children
HSTLE is for adults only. Age is checked from the government document during verification, not from a self-declared date. Accounts found to belong to anyone under 18 are closed and their data deleted.
13. Cookies
The website and web app use only essential cookies needed to keep you signed in and the site working. There are no advertising cookies and no third-party trackers.
14. Changes
When this policy changes we update the date at the top, and for significant changes the app will ask you to read and accept again before continuing.
15. Grievance Officer
Aquleem Sayyed, Founder, HSTLE (An Obvious Name Private Limited), Flat-2 Monogiri 8, Juhu Scheme 13th N S Road, Vile Parle (West), Mumbai 400056. Email hello@hstle.in. Grievances are acknowledged within 48 hours and resolved within 30 days, or sooner where the law requires.
