← Back to home

Privacy Policy

How we handle your personal information, and the choices available to you.

Sakhi & Me Privacy Policy

Operated by Mehphil

Effective Date: 23 August 2026

Sakhi & Me is a voice and video companionship platform operated by Mehphil ("Mehphil," "we," "us," or "our"). This Privacy Policy explains what information we handle when you use the Sakhi & Me mobile application and related services (together, the "Platform"), why we handle it, and the choices available to you regarding your information.

We are committed to processing your personal data in accordance with the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Information Technology Act, 2000 and the rules made under it, and other applicable Indian laws. Mehphil acts as the Data Fiduciary in respect of the personal data we collect through Sakhi & Me.

This Policy should be read alongside our Terms of Service and Community Guidelines. Where a specific term is defined in our Terms of Service and used in this Policy, it carries the same meaning unless the context requires otherwise. If you do not agree with any part of this Policy, please do not use Sakhi & Me.

2. Who This Policy Applies To

This Policy applies to two groups of users:

  • Customers: individuals who install the Sakhi & Me app to browse Host profiles, purchase Coins, and initiate Calls; and
  • Hosts: individuals verified by us to receive Calls, earn Diamonds, and withdraw their earnings in accordance with our Host terms.

Sakhi & Me is intended solely for individuals who are 18 (eighteen) years of age or older and are residents of India. If you are under 18, please do not use Sakhi & Me or provide any personal information to us.

3. Definitions

For the purpose of this Policy:

  • "Account" means your registered Sakhi & Me user account.
  • "Coins" means the in-app virtual currency purchased by Customers using real currency, redeemable only for services on the Platform.
  • "Diamonds" means the earnings unit credited to Hosts in exchange for received Coins, redeemable in accordance with our Host terms.
  • "Call" means any audio or video communication session initiated between a Customer and a Host through the Platform.
  • "Personal Data" has the meaning given to it under the DPDP Act.

4. Information We Collect

We collect the categories of information described below. We only collect what is reasonably necessary to run the Platform and comply with the law.

4.1 Information you provide directly

From all users at sign-up

  • Mobile number, verified through an SMS one-time password sent by our authentication provider
  • Display name
  • Gender (Male or Female), collected as a mandatory input to the opposite-gender matching flow that Sakhi & Me is built around
  • Age or date of birth
  • Preferred language, chosen from among the ten Indian languages supported by the Platform
  • Profile photo, if you choose to add one
  • Bio, interests, and any other content you choose to add to your profile

From Hosts, in addition to the above, during onboarding and verification

  • Full legal name as recorded on government identity documents
  • Aadhaar number and/or PAN, submitted through our KYC verification partner
  • A live selfie or short video for liveness detection and identity match
  • Bank account details, IFSC code, and/or UPI ID for Diamond redemption
  • Any tax-related information we are required to collect from you

Payment-related information

When you purchase Coins, our payment orchestration provider and the payment gateways it connects to collect the payment details required to complete your transaction. From them we receive only a limited record consisting of the amount paid, the transaction identifier, the payment method at a high level (for example "UPI" or "card"), and the outcome of the transaction. We do not receive or store your full card number, CVV, or UPI PIN.

Support and grievance information

Any information you share with us when you contact our support or grievance channels, including screenshots, descriptions of the issue, and correspondence with our team.

4.2 Information collected automatically when you use Sakhi & Me

Device and technical information

Device model, operating system and its version, the Sakhi & Me app version, unique device identifiers (such as the Android advertising ID or iOS IDFA, where you have not opted out of them at the operating-system level), crash logs, and diagnostic data.

Network and connection information

IP address, network type, mobile country and operator codes, and an approximate location derived from your IP address (usually at the city or region level). We use this for language defaults, fraud prevention, and regulatory compliance, and not for precise location tracking.

Usage information

Screens viewed, buttons tapped, features used, session length, in-app search queries, and similar interaction data. We use these signals in aggregate form to understand how Sakhi & Me is used and where to improve it.

Call metadata

For each Call made on the Platform we retain the caller and callee identifiers, the type of Call (audio or video), the date and time it started, its duration, the Coins consumed, and its outcome (completed, dropped, missed, or cancelled). This metadata is required for billing, fraud prevention, and dispute resolution.

Push notification tokens

Tokens issued by Google or Apple that allow us to send you Call ringing notifications, service updates, and other messages.

4.3 Call content and moderation recordings

Ordinary Calls on Sakhi & Me are not routinely recorded or retained as media. Live audio and video streams flow through our real-time communications provider and are not written to storage for regular use.

We do, however, record a limited sample of Calls solely for the following purposes:

  • reviewing potential violations of our Community Guidelines (for example, when a report is filed against a user, or when our automated safety systems flag a Call for review);
  • training and improving our safety, moderation, and matching systems; and
  • resolving disputes about specific transactions or reported incidents.

Access to these recordings is restricted to authorised personnel and moderation vendors bound by written confidentiality obligations, is logged, is retained only for the period necessary to fulfil the purpose above, and is never sold, published, or used for advertising. You will be informed within the Platform when Call recording for safety purposes may apply to Calls you participate in.

4.4 Information we receive from other sources

We may receive information about you from:

  • other users, when they report your Account or provide feedback about a Call with you;
  • our KYC and identity verification partners, who verify Host documents on our behalf and share the verification outcome with us;
  • our payment partners, who share transaction status and reconciliation data with us;
  • our marketing partners and mobile attribution providers, who tell us which campaign or referral led you to install Sakhi & Me (this helps us measure marketing effectiveness and detect installation fraud); and
  • publicly available sources and law-enforcement authorities, where relevant to safety, fraud prevention, or legal compliance.

5. Permissions We Request on Your Device

Sakhi & Me asks for the following device permissions in order to work. You control each of these through your device settings and can revoke them at any time, though some Platform features will not work without them.

  • Microphone: required for audio and video Calls.
  • Camera: required for video Calls and, for Hosts, for live selfie verification during onboarding.
  • Notifications: required to receive incoming Call rings, verification updates, and other important account notifications.
  • Phone / Call Management (Android) and CallKit (iOS): used only to render an incoming Call ring in the same way as a regular phone call, so you can accept or decline the Call from your lock screen.
  • Photos / Media (limited): used only if you choose to upload a profile photo.

We do not request access to your contacts, SMS messages, precise GPS location, or files that are unrelated to the Platform.

6. How We Use Your Information

We use the categories of information described in Section 4 for the following purposes.

  • To operate the Platform: creating and maintaining your Account, matching Customers with Hosts based on gender and language preferences, running audio and video Calls, and running the Coins-to-Diamonds economy that powers those Calls.
  • To process payments and pay Hosts: verifying and settling top-up transactions, crediting Coins to Customers, crediting Diamonds to Hosts, processing withdrawal requests, and complying with the tax reporting and accounting obligations that apply to us.
  • To keep the Platform safe: verifying Host identities, preventing fake accounts and impersonation, investigating reports and violations of our Community Guidelines, protecting Customers and Hosts from harassment or abuse, and detecting fraudulent or automated behaviour.
  • To communicate with you: sending Call rings, transactional messages (such as OTPs, top-up receipts, and withdrawal confirmations), and updates about your Account. Where you have opted in, we may also send you promotional messages about new features or offers on Sakhi & Me.
  • To improve the Platform: understanding how features are used, diagnosing crashes and performance issues, testing new experiences, and improving our automated safety systems using the limited call recordings described in Section 4.3.
  • To meet our legal obligations: complying with the DPDP Act, the Information Technology Act and the rules made under it, tax laws, consumer protection laws, and lawful requests from courts, regulators, and law enforcement authorities in India.

7. Legal Basis On Which We Process Your Data

Under the DPDP Act, we rely on the following grounds for processing your Personal Data:

  • Your consent, given through the sign-up flow and specific in-app prompts, for processing personal data we handle to provide you the Platform and to send you promotional communications; and
  • Certain legitimate uses recognised under the DPDP Act, including compliance with law, responding to medical or safety emergencies, and employment-related processing where relevant.

You may withdraw your consent at any time as described in Section 12 (Your Rights). Withdrawal will not affect the lawfulness of any processing carried out before the withdrawal, and may result in the Platform becoming partly or fully unavailable to you.

8. How We Share Your Information

We do not sell your Personal Data. We share information only in the situations described below.

8.1 With the person you are calling

When a Call takes place, limited profile information (your display name, your profile photo if you have added one, and your language preference) is visible to the other participant. Your mobile number is never shared with another user.

8.2 With our service providers and processors

We share data with the vendors that help us run Sakhi & Me. Each of these providers processes data on our instructions, under written contracts that require appropriate security and confidentiality. The main categories are:

  • Authentication: Firebase Authentication (Google LLC), for SMS one-time password verification.
  • Real-time calling: Stream.io, for audio and video Call infrastructure.
  • Payments: Juspay Technologies Private Limited for payment orchestration, Razorpay Software Private Limited and Cashfree Payments India Private Limited as payment gateways, and Google Play Billing for in-app purchases made through the Google Play Store.
  • KYC and identity verification: our verification partner, for Aadhaar and PAN checks required to onboard Hosts.
  • Analytics, engagement, and attribution: MoEngage, AppsFlyer, and Amplitude, for product analytics, marketing attribution, and messaging.
  • Crash and performance monitoring: Sentry and Google Crashlytics.
  • Cloud infrastructure: our cloud hosting providers, which store our databases and backend systems.

An updated list of our current service providers can be requested by writing to us at the address given in Section 15.

8.3 With group companies

We may share your data with Mehphil’s parent, subsidiary, and affiliated entities, subject to the same protection standards described in this Policy, for the limited purposes of shared administration, support, and improvement of Mehphil’s products.

8.4 For legal, regulatory, and safety reasons

We may disclose your data where we believe in good faith that doing so is necessary to:

  • comply with an applicable law, court order, or lawful request from a governmental or regulatory authority;
  • enforce our Terms of Service or Community Guidelines;
  • prevent, detect, or investigate fraud, security incidents, or abuse of the Platform; or
  • protect the rights, safety, or property of Mehphil, our users, or the public.

8.5 In connection with a business transfer

If Mehphil undergoes a merger, acquisition, financing round, restructuring, or sale of assets, personal data held by us may be transferred to the counterparty as part of that transaction, subject to the recipient continuing to protect it under terms no less protective than this Policy. Where required by law, we will notify you.

8.6 In aggregated or anonymised form

We may share data that has been aggregated or otherwise anonymised such that it can no longer identify you, for research, reporting, and business purposes.

9. International Data Transfers

Some of the service providers listed in Section 8.2 process data on servers located outside India. We rely on these transfers being permitted under the DPDP Act and the notifications issued under it, and we require those providers to protect your data to the standards set out in this Policy. If the Government of India restricts transfers to any country, we will comply with that restriction.

10. Data Retention

We retain your Personal Data only for as long as necessary for the purposes described in this Policy or for the period required by applicable law, whichever is longer.

Broadly:

  • Account and profile data is retained while your Account is active and for a limited period after deletion to complete offboarding, resolve disputes, and satisfy legal, financial, and tax obligations.
  • Call metadata is retained for the period required by our billing, safety, and legal obligations.
  • Sample Call recordings made for the purposes in Section 4.3 are retained only for as long as necessary for the specific review or model-training purpose, after which they are deleted.
  • Transaction, tax, and financial records are retained for the periods required under Indian tax and accounting laws.
  • Data required in connection with an ongoing legal proceeding, regulatory request, or safety investigation is retained until the matter is concluded.

When retention is no longer justified, we delete the data or convert it into an anonymised form that no longer identifies you.

11. Security

We use technical and organisational safeguards designed to protect your data against loss, misuse, unauthorised access, disclosure, alteration, and destruction. These include encryption of data in transit, encryption at rest for sensitive fields, role-based access controls, audit logging, secure development practices, and regular reviews of our systems.

No system is fully secure and we cannot guarantee absolute security. You have an important role in protecting your Account: use a device with an up-to-date operating system, do not share your OTPs or Account credentials with anyone, and let us know immediately if you suspect any unauthorised use of your Account.

If we become aware of a personal data breach that is likely to affect you, we will notify you and the Data Protection Board of India in the manner and within the timelines required by the DPDP Act.

12. Your Rights

Subject to the DPDP Act and other applicable laws, you have the following rights in relation to your Personal Data:

  • Right to access a summary of the personal data we process about you and the processing activities we have undertaken.
  • Right to correction and updating of your personal data, and to completion of incomplete data.
  • Right to erasure of your personal data, subject to our legal and legitimate retention needs.
  • Right to grievance redressal, as described in Section 15.
  • Right to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
  • Right to withdraw consent where our processing is based on your consent.

To exercise any of these rights, please write to us using the details in Section 15. We may ask you to verify your identity (typically by confirming ownership of the mobile number linked to your Account) before acting on your request. We will respond within the timelines required under applicable law. If we are unable to fully act on your request, we will explain why and tell you how you may escalate the matter.

You may unsubscribe from Sakhi & Me’s promotional messages at any time using the opt-out link or setting inside the app, or by writing to us. Even after you opt out, we may continue to send transactional and service messages that are necessary to operate your Account.

13. Children

Sakhi & Me is not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If we learn that we have collected personal data from a child, we will delete it and terminate the Account. If you believe a child is using Sakhi & Me, please write to us using the details in Section 15.

14. Cookies and Similar Technologies

The Sakhi & Me mobile application uses local storage on your device (such as key-value stores, secure keychain entries, and preference files) to remember your Account, keep you signed in, cache content, and remember your language and other choices. Our support portal and any web pages we operate may use cookies for basic session, analytics, and preference purposes. You can clear this data through your device or browser settings.

15. Grievance Redressal and How to Reach Us

If you have a question about this Policy or wish to exercise any of the rights described above, please write to us at:

Mehphil Data Protection Team

Email: privacy@mehphil.com

If you have a specific grievance about the handling of your personal data or a violation of your rights under this Policy or applicable law, you may reach our Grievance Officer, appointed under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

Grievance Officer

Name: Grievance Officer, Mehphil Technology Private Limited

Email: grievance@mehphil.com

Address: Unit 101, Oxford Towers, 139/88, HAL Old Airport Road, Kodihalli, Bengaluru, Karnataka 560008, India

We will acknowledge your grievance within the timelines prescribed by law and work to resolve it in a reasonable period. If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India constituted under the DPDP Act, once operational.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in the Platform, our practices, or applicable law. When we make a material change, we will let you know through the app, by email or SMS to your registered contact, or by another appropriate means before the change takes effect. The "Effective Date" at the top of this Policy shows when it was last updated.

Your continued use of Sakhi & Me after a change takes effect means you accept the updated Policy.