This Privacy Policy describes how Dharmalife Foundation gGmbH (“we”, “us”, “our”), operating the DL Haat mobile application (Android package name: com.dharmalife.dleapp), published on Google Play by Dharma Labs, collects, uses, stores, and shares information when you use the app. For privacy-related questions or requests, contact us at it@dharmalifelabs.com.
1. Who we are
This Privacy Policy applies specifically to the mobile application DL Haat (Android package name com.dharmalife.dleapp).
DL Haat is developed and published on Google Play by Dharma Labs, a program of Dharmalife Foundation gGmbH. The registered legal entity behind Dharma Labs, and the data controller for the purposes of this policy, is Dharmalife Foundation gGmbH.
DL Haat is a mobile commerce app for Dharma Life Entrepreneurs (DLEs). It lets authorised users browse a product catalogue, place orders (requisitions), pay online or record cash/advance payments, share product content, and manage their profile and language settings.
This policy applies only to the DL Haat mobile app (com.dharmalife.dleapp). It does not apply to other Dharmalife products such as DL One, unless those products link to a separate policy.
Access requires a valid account created through phone number and OTP sign-in. The app is intended for authorised Dharma Life Entrepreneurs and related programme users — not for the general public as a consumer social app.
This policy is governed primarily by India’s Digital Personal Data Protection Act, 2023 (DPDPA). Because Dharmalife Foundation gGmbH is established in Germany, we also comply with the EU General Data Protection Regulation (GDPR) where it applies.
3. Information we collect
We collect the following information through DL Haat. Unless noted, it is sent to our backend at dlone.dharmalifelabs.com (production) or dev-dlone.dharmalifelabs.com (development/testing).
3.1 Information you provide (account and authentication)
Information
When collected
Where stored / sent
Mobile phone number
Sign-in (OTP)
Backend; stored locally on device
One-time password (OTP)
Verification step
Sent to backend for verification only
First and last name
After login (from profile)
Backend; local session
Email address
Profile / online payment
Backend; sent to PayU for online payments
User ID, workforce ID, workforce code, workforce type
Cart / order line items (product ID, name, quantity, prices, margin)
Placing order
Backend
Project ID, order type
Placing order
Backend
Payment amount, payment mode (cash / online)
Checkout
Backend
Transaction ID, payment date, remarks
Checkout
Backend
PayU payment response (online payments)
After PayU checkout
Backend
Payment receipt image
Cash/advance payment with receipt
Uploaded to AWS S3; URL stored with order
Cart contents are held in memory only while you use the app and are not persisted to disk.
3.3 Location and device information
Information
When collected
Where stored / sent
GPS latitude, longitude, altitude, accuracy
When placing orders, if you grant location permission
Backend with order; also sent to PayU for online checkout
IP address
Order placement / payment
Backend; PayU flow (via public IP lookup)
Location note. The app may ask: “Allow DLE App to use your location when placing orders.” Location is requested after login on the home screen. If you deny permission, orders may still proceed with empty or zero location values. You can change this choice at any time in your device settings.
Public IP address lookup is performed using ipify.org.
3.4 Photos (payment receipts)
When you record a cash or advance payment, you may photograph a receipt with the camera or attach one from your photo library. Receipt images are uploaded to Amazon Web Services (AWS) S3 (bucket: dharma-dlone-mobile, region: ap-south-1) using Amazon Cognito identity pool authentication. Images may be delivered via CloudFront (https://d3k64exjgncxh8.cloudfront.net/). A URL to the image is stored with your order on our backend.
The app may ask:
“Allow DLE App to photograph a payment receipt.” (camera)
“Allow DLE App to attach a payment receipt from your photos.” (photo library)
3.5 Information stored on your device
Login session (authentication token and profile fields) — to keep you signed in
Language preference — to remember your chosen language
Pending online payment order (temporary) — to recover if the app closes during a PayU payment flow
This on-device data is stored using the app’s local storage (AsyncStorage) and is removed when you clear app data or uninstall the app.
3.6 User-initiated sharing
The app lets you share product images and text through WhatsApp, WhatsApp Business, Microsoft Teams, or the Android system share sheet. Data is shared only when you explicitly choose to share. Sharing is subject to the privacy practices of the app you select.
3.7 Information we do not collect
Based on the current DL Haat app, we do not collect:
Data through Firebase, Google Analytics, Sentry, Crashlytics, or similar analytics/crash SDKs
Data through advertising SDKs
Contacts, SMS, call logs, or microphone recordings
Return/exchange photos (this feature is not yet available in the app)
Meeting record-keeping, tax, audit, or regulatory obligations
We do not use DL Haat data to show third-party advertising in the app.
5. How we share your information
We share information with the service providers needed to run DL Haat. We do not sell personal information.
Our own systems. The DL Haat backend and related Dharmalife programme systems are developed and operated by Dharma Labs / Dharmalife Foundation gGmbH. They are not third-party vendors in the ordinary sense, but they process your data on our behalf.
Recipient
Role
Information involved
Dharma Life backend (dlone.dharmalifelabs.com) — operated by Dharma Labs
PayU merchant name in the app: Dharmalife. PayU fallback contact: it@dharmalife.in.
These providers process information only as needed to provide their services to us. We may also disclose information if required by law, to protect a person from harm, or to establish or defend legal claims.
6. Permissions we request
DL Haat may ask for the following Android permissions:
Internet / network — API calls, payments, and file uploads
Location (when in use) — order and payment context when placing orders
Camera — photograph payment receipts
Photos / media library — attach a payment receipt from your gallery
The app also declares intent to interact with UPI/payment apps (such as Google Pay, PhonePe, and Paytm) and WhatsApp for user-initiated payment and sharing flows. No data is sent to those apps unless you choose to use them.
You can refuse a permission. Features that need it will not work without it, but other parts of the app may still be available.
7. Data retention
Account and profile data: kept while your account is active and for as long as needed for programme operations, payment reconciliation, audit, or legal purposes.
Order and payment records: kept while needed to fulfil orders, reconcile payments, and meet legal or accounting requirements, then deleted or de-identified when no longer required.
Payment receipt images: kept with the related order record, then removed when that record is deleted or no longer needed.
On-device session and preference data: until you log out, clear app data, or uninstall the app.
Technical logs: for a limited period needed for security and operations.
8. Security
We send information over HTTPS (encrypted in transit). Authentication tokens are stored on your device using the controls available to the app. Receipt uploads use AWS Cognito identity pool authentication — the app does not embed long-lived AWS access keys.
No method of transmission or storage is completely secure. We cannot guarantee absolute security. You are responsible for keeping your OTP and device secure.
9. Your rights and choices
Subject to applicable law (including DPDPA and, where applicable, GDPR), you may have the right to:
access the personal information we hold about you;
request correction of inaccurate information;
request deletion of your personal information (see Section 10);
withdraw consent where processing is based on consent;
opt out of location collection by denying or revoking location permission in your device settings;
lodge a complaint with a supervisory authority where applicable.
To exercise these rights, email it@dharmalifelabs.com from a contact we can verify against your account, or write to the grievance officer listed in Section 1. We will respond within the time required by applicable law.
10. Account and data deletion
DL Haat supports account creation through phone number and OTP sign-in. You may request deletion of your account and associated personal data.
How to request deletion: Email it@dharmalifelabs.com with the subject line “DL Haat account deletion request”. Include the phone number linked to your account so we can verify your identity.
What we delete: When your request is approved, we will delete or de-identify your account profile and associated personal data held for DL Haat, including order-linked personal data where we are not legally required to retain it. Deletion is permanent — we do not merely freeze or deactivate accounts.
Timeline: We aim to complete verified deletion requests within 30 days. We will confirm by email when deletion is complete.
Exceptions: Some records (for example payment, tax, audit, or fraud-prevention records) may need to be retained for a longer period where required by law or legitimate business needs. We will explain any such limit when we respond to your request.
Logging out or uninstalling the app does not by itself delete server-side records. Local data on your device may remain until you clear app data or uninstall the app.
11. Children’s privacy
DL Haat is a commerce app for authorised Dharma Life Entrepreneurs. It is not directed at children and we do not knowingly collect personal information from anyone under 18 through this app.
If you believe a child has provided personal information in DL Haat, contact it@dharmalifelabs.com and we will delete it where we are not legally required to keep it.
12. International data transfers
Our primary DL Haat backend is operated on dlone.dharmalifelabs.com hosts. Personal data is ordinarily stored and processed in India.
Payment receipt images are stored on AWS in the ap-south-1 (Mumbai) region. Because the registered legal entity, Dharmalife Foundation gGmbH, is established in Germany, authorised personnel or service providers in the EU (or other permitted locations) may access information as needed to operate and support the app.
We take steps to ensure that any cross-border transfer is carried out in accordance with applicable law, including the Digital Personal Data Protection Act, 2023, and GDPR where it applies.
13. Changes to this policy
We will post updates to this page and change the “Last updated” date. If changes are material, we will also notify you in the app or by email where we have a working contact.
