Legal

Privacy Policy

Effective date: 8 September 2026

PRIVACY POLICY

Effective date: 8 September 2026

Bestie4 ("Bestie4", "we", "us", "our") is operated by PHONE4U, a sole proprietorship of Arun Joseph, registered in India. This Privacy Policy explains what personal data we collect from You when You use Bestie4, why we collect it, what we do with it, and the choices You have.

By registering, purchasing coins, or otherwise using Bestie4, You consent to the practices described here. If You do not agree, please do not use Bestie4.

1. WHO WE ARE

  • Data controller: PHONE4U (Prop. Arun Joseph)
  • Principal place of business: IX/610, Chemperi, Kannur, Kerala, India, 670632.
  • Support / grievance email: support@bestie4.com
  • Support phone: +91 96453 05240

2. WHAT WE COLLECT

We keep data collection to the minimum needed to run Bestie4.

You give us:

  • Your mobile number (verified via a one-time password) so we can authenticate You.
  • A display name and, optionally, an avatar and date of birth. Date of birth is used only to confirm You are 18 or older.
  • Any content You provide inside the app: reviews, reports of abuse, agent-block reasons, or messages to our support team.

We generate automatically when You use Bestie4:

  • Call metadata: call ID, participating User and Agent IDs, start/answer/end timestamps, duration, and the coin amounts charged and paid. We do not routinely record call audio.
  • Wallet records: coin purchases, per-minute call debits, and any wallet credits, kept as an append-only ledger for audit and dispute-handling purposes.
  • Device information: a device push token (for delivering incoming-call notifications), OS platform (Android or iOS), app version, and coarse device identifiers required to secure the account.
  • Technical logs: IP address, timestamps, HTTP request paths, and error information, used for security, abuse detection, and debugging. These are automatically rotated and purged.

Payments — what we do NOT store:

  • We never store Your full card number, CVV, PIN, UPI PIN, bank password, or netbanking credentials. Those go directly to Our payment gateway and remain within the gateway's PCI-DSS-compliant environment. We only receive an order identifier and the payment outcome.

Sensitive personal data:

  • We do not solicit or process sensitive personal data such as biometric information, financial account passwords, health records, sexual orientation, religious or political beliefs. Please do not share such information on Bestie4.

3. HOW WE USE YOUR DATA

We process Your data only for these purposes:

  1. To provide the Services — authenticate You, place and receive calls, keep Your coin wallet accurate, deliver push notifications for incoming calls, and connect You with Agents in Your chosen categories.
  2. Safety and abuse prevention — detect fraud, rate-limit abuse, act on user reports, and enforce our Terms.
  3. Payments — send order details to Our payment gateway and reconcile the response.
  4. Support and communications — reply to Your queries; send transactional messages (payment receipts, incoming-call push, missed-call notifications). We do not send promotional messages unless You have explicitly opted in, and every promotional message includes a way to opt out.
  5. Legal and audit — comply with Indian law, respond to legitimate authority requests, and keep records required by tax and consumer-protection statutes.
  6. Service improvement — analyse aggregate, anonymised usage patterns to improve Bestie4. We do not sell or share Your personal data for advertising.

4. WHEN WE SHARE DATA

We do not sell Your personal data. We share it only in these narrow situations:

  • Service providers we rely on to deliver Bestie4:

    • Payment gateway — a RBI-authorised payment aggregator, for processing coin purchases.
    • Voice infrastructure — Agora — for carrying call audio between You and the Agent. Voice packets pass through Agora's network; we do not routinely record.
    • Push-notification providers — Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS) — for delivering incoming-call and other notifications.
    • SMS provider — used, when enabled, to deliver one-time passwords for login. During early testing, OTPs may be displayed only within the app and no SMS is sent.
    • Cloud hosting — Amazon Web Services (Mumbai region) — where our servers, database, and object storage run.
    • Placeholder avatars — DiceBear (https://www.dicebear.com) — generates a deterministic image icon when You have not uploaded Your own avatar. Only Your Bestie4 user identifier (an opaque string) is used as the image seed; no name, phone number, or other personal information is sent.

    Each provider processes data only under our instructions and their own privacy commitments.

  • Legal disclosure — when required by law, a valid court order, or a legitimate government request; to prevent fraud or protect the rights, property, or safety of Bestie4, our users, or the public.

  • Business transfers — if we are involved in a merger, acquisition, or asset sale, Your data may be transferred, subject to the same commitments in this Policy.

Between Users and Agents: phone numbers are never exchanged. Users and Agents only see each other's display name and avatar. Voice audio is carried by our voice provider without exposing either party's number.

5. HOW WE PROTECT YOUR DATA

  • All Bestie4 traffic is encrypted in transit over HTTPS / TLS 1.2+.
  • Data at rest is stored on servers hosted in India, with access controls and encryption at the database and storage layers.
  • Passwords, one-time passwords, and payment credentials that we don't need after use are hashed with strong algorithms and salts.
  • Only a limited number of authorised employees have access to production data, and only for legitimate operational reasons; access is logged.
  • We continuously monitor for unauthorised access; if a data breach affects Your data, we will notify You and the appropriate authorities in accordance with applicable law.

No system is perfect. Please help us by choosing a mobile number You have exclusive control over, keeping Your OTP private, and reporting any suspected account compromise immediately to support@bestie4.com.

6. HOW LONG WE KEEP YOUR DATA

  • Account data (phone, name, avatar, date of birth) — kept for as long as Your account is active. On deletion, we remove or anonymise personal identifiers within a reasonable time.
  • Wallet and call ledgers — retained for at least eight (8) years after account closure to meet statutory tax, accounting, and consumer-protection retention obligations under Indian law. These records identify the transaction, not the conversation.
  • Support conversations — kept while active and for a reasonable period after resolution.
  • Technical logs — automatically rotated and purged; typically kept no longer than ninety (90) days.
  • KYC documents for Agents — if and when Agent KYC is collected under a separate onboarding flow, those documents will be retained for the statutory period applicable at the time.

7. YOUR RIGHTS

Under the Digital Personal Data Protection Act, 2023 (DPDP) and other applicable Indian law, You may:

  • Access the personal data we hold about You.
  • Correct inaccurate data.
  • Withdraw consent to processing that relies on consent (this may prevent us from continuing to provide the Services).
  • Request deletion of Your account and associated personal identifiers, subject to statutory retention obligations described in Section 6.
  • Complain to the Data Protection Board of India (once operational) if You believe Your rights have been infringed.

To exercise any of these rights, email support@bestie4.com from the mobile number registered with Bestie4. We will respond within the timelines required by law.

8. CHILDREN'S PRIVACY

Bestie4 is intended for adults aged 18 or older. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we will delete the account and its associated data. Parents or guardians who believe a minor has provided personal information to Bestie4 may write to support@bestie4.com and we will act promptly.

9. COOKIES AND SIMILAR TECHNOLOGIES

Bestie4 is primarily a mobile application and does not rely on browser cookies. Our admin website may use strictly-necessary session cookies for staff authentication. We do not use third-party advertising or tracking cookies.

10. INTERMEDIARY STATUS

Bestie4 operates as an intermediary within the meaning of the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. We provide the platform on which Users and Agents interact; we do not participate in or direct their conversations.

Complaints will be acknowledged within twenty-four (24) hours of receipt and resolved within fifteen (15) days.

11. LEGAL DISCLOSURE

We may disclose Your information when required by:

  • Indian law, statute, regulation, or a legally valid subpoena or court order;
  • A legitimate request from a law-enforcement or regulatory authority acting within its powers;
  • A good-faith belief that disclosure is necessary to investigate unlawful activity, suspected fraud, threats to personal safety, or a breach of these Terms.

12. CROSS-BORDER TRANSFERS

Some of our service providers may process data outside India (for example, cloud regions in other jurisdictions or global push-notification networks). Where this happens, we take reasonable steps to ensure the transferred data continues to enjoy protection consistent with this Policy and Indian law.

13. YOUR CONSENT

By registering, purchasing coins, or otherwise using Bestie4, You confirm that You have read this Privacy Policy and agree to the practices described here.

14. CHANGES TO THIS POLICY

We may update this Policy from time to time. Material changes will be communicated in the app or by notification. The Effective Date at the top always reflects the current version. Continued use of Bestie4 after an update constitutes acceptance of the updated Policy.

15. GRIEVANCE OFFICER AND CONTACT

If You have any questions, concerns, or complaints about how we handle Your data — or wish to exercise any of the rights in Section 7 — please contact:

  • Email: support@bestie4.com
  • Phone: +91 96453 05240
  • Postal address: Grievance Officer (Arun Joseph), PHONE4U, IX/610, Chemperi, Kannur, Kerala, India, 670632

We acknowledge grievances within 24 hours and aim to resolve them within 15 days, in line with the Intermediary Guidelines Rules, 2021.

16. GOVERNING LAW

This Policy is governed by the laws of India. Any dispute arising out of or in connection with this Policy shall be resolved through arbitration under the Arbitration and Conciliation Act, 1996, seated in Kannur, Kerala.