This Privacy Policy explains how Smitten Co., trading as Smitten Technologies (“Smitten”, “we”, “our”, or “us”) handles personal data when you use TruSight — our Android and iOS apps, website, APIs, result-sharing features, and support (together, the “Service”).
Nothing is investigated unless you start a check or choose to send information to us.
1. Controller
Smitten Co., trading as Smitten Technologies
Email: info@smitten.co.in
Website: https://smitten.co.in
TruSight includes the Sherlock investigator persona and user-initiated capture features inside the app.
2. Scope and applicable law
This Policy applies globally to the Service. We are based in India and apply the Digital Personal Data Protection Act, 2023 and its rules as they come into force, the Information Technology Act, 2000, and other law that applies to a particular user or processing activity.
Where the GDPR, UK GDPR, or another regional privacy law applies, we process personal data under an available lawful basis, including your consent, performance of the service you requested, compliance with law, or our legitimate interests in securing and improving the Service where those interests do not override your rights.
This Policy does not control third-party websites you visit from a result, app-store policies, or independent registry and legal-record operators. Our processors are required to protect personal data consistently with their contracts and applicable law.
3. Data we collect
3.1 Account
Depending on how you sign in: email address; phone number; Google, Apple, or Microsoft identifiers; and basic profile fields the provider shares through Firebase Authentication. We receive only the fields authorised through that sign-in method.
3.2 Content you submit
Text, URLs, screenshots, photos, PDFs, DOCX files, video, audio or voice notes, Sherlock captures, OCR text, transcripts, and limited file metadata when you choose to submit them for a check. Submissions may contain personal data about you or another person. Submit them only when you have a lawful reason to do so.
3.3 Device, network, and diagnostics
Device type, operating system, app version, language, IP address, API request metadata, and crash or performance information. Firebase Crashlytics may process Android diagnostics such as stack traces, device model, OS, and app version. We do not use advertising SDKs.
Push-notification, FCM, APNs, and Live Activity tokens may be linked to your account so TruSight can notify your device about checks you started.
3.4 Approximate country for Product Check
When you grant location permission during a product-pack scan, the device may reverse-geocode location to an approximate country name or code. Only that country string — not latitude, longitude, or precise location — is sent with the Product Check request, and only to choose pack-label rules when the pack does not identify its market. Denying permission does not prevent the check.
3.5 Usage and security events
Feature, reliability, rate-limit, fraud-prevention, and error events needed to operate and secure the Service. Operational events are designed to exclude OCR bodies, message bodies, document images, and raw submitted media.
3.6 Feedback and support
Feedback may include whether a result was helpful, selected reasons, an optional comment, check identifier, content type, result headline or verdict, score, platform, scan tier, and app version. Support emails include the message and attachments you choose to send. We use this information only to investigate issues and improve the Service, not for advertising.
3.7 Local history and backups
Analysis history may remain on your device. Optional backups use your iCloud or Google Drive account and the protection those providers supply. We do not operate those services.
3.8 Health Profile
Health Profile is optional. If you set one up, you may enter a name, date of birth, sex, eating pattern, and health preferences such as allergies, conditions, medications, or nutrients to watch, for yourself and for up to three family members in your household.
This information is stored and used on your device only, to personalise Product Check guidance such as an allergen flag or a “watch sugar” note. It is not sent to Smitten, included in any check request, or shared with AI, search, registry, or other providers. If you have device backups turned on, it may be included in your own iCloud or Google backup and restored with the app. Removing the profile deletes it from the device; we do not hold a copy to delete.
Enter information about another person only if you have the right to do so, including as the parent or guardian of a child.
3.9 Website
smitten.co.in uses a minimal set of essential technologies and no advertising pixels. See Cookies.
4. Data we do not collect for the core product
- Your SMS inbox or contacts
- Precise location
- Always-on microphone or screen capture
- Your selected health-profile conditions, allergens, or preferences off-device
- Face templates or biometric identifiers; TruSight does not perform face matching or liveness checks
Sherlock capture and microphone operate only after you start them and approve the operating-system permission. Android may offer an optional floating overlay; iPhone uses the Share sheet, Shortcuts, or Action Button instead. There is no continuous recording or background chat monitoring.
5. Why we use data
- Run the check you requested and present its result
- Apply Product Check label rules using an optional approximate country
- Authenticate accounts and deliver requested notifications
- Prevent abuse, fraud, and security incidents
- Respond to support, feedback, privacy, and grievance requests
- Maintain and improve reliability
- Comply with law and valid legal process
- Operate the de-identified Truth Vault described below
6. How a check uses your submission
TruSight processes submitted content on the selected check axis. Different checks use different assessment paths. For claim investigations, the Evidence Engine gathers, grades, and selects evidence; advocates and the judge determine the score solely from that selected evidence packet. Message Trust, media, voice, document, identity, and product checks use their own relevant signals, models, and structured checks.
Document and identity checks may extract visible identifiers and, where configured, send identifiers or prepared images to authorised registry or verification providers solely to produce the requested result.
Legal-record lookup, where available and enabled, is separate. The provider receives name and address only — never ID numbers or document images. A reported FIR or court record is not guilt, and an empty result does not prove that no record exists. A matched record may show the name of another party to the same proceeding, applicable law sections, or a business category, exactly as published by the source; this does not confirm that party’s identity or involvement.
Submitted URLs may be sent to Google Web Risk or a similar reputation service. Ordinarily only the URL is sent.
Before a check transfers submitted personal data to external AI, OCR, transcription, media-analysis, registry, or search providers, TruSight presents the relevant permission or processing notice where required. You may decline by not starting that check.
7. AI and third-party processors
Processors receive only the information reasonably needed for their task. We do not sell personal data. Processor categories include:
- Foundation-model providers used for extraction, advocates, and the judge
- Web search, news, academic, and financial-evidence providers
- OCR, transcription, and media-authenticity services
- Issuer, registry, and document-verification providers
- Legal-record search using name and address only
- Authentication, crash reporting, push delivery, hosting, email, DNS, and bot protection
- URL-reputation services
For emails and texts that claim to be from an organisation and that our own checks cannot confirm, a redacted copy of the text (with account numbers, codes, your email address and your name removed) may be sent to an AI provider so it can point out warning signs. We do not send personal chats or messages from senders we have verified. Providers are not permitted to train on this text, and we do not keep it.
Authentication providers and independent registry operators also process data under their own policies. They may retain lookup records under applicable law or their policies. We assist with deletion requests where our contracts and the law allow, but cannot promise deletion from systems we do not control.
8. Truth Vault
Truth Vault is a de-identified, content-keyed result cache, not an account history. Entries are retained for up to 30 days so an identical or closely matching check can return faster. The system is designed to remove obvious sensitive tokens such as OTP codes and phone numbers from stored previews.
Because Vault entries are not account-linked, account deletion may not identify an entry created from your check. Entries expire automatically. A cached result may be served to another user who submits identical or closely matching content.
9. Result-share links
When you choose to share a result, TruSight creates an unlisted link with a random identifier. Anyone who receives the link can access the shared result without signing in. Do not create or forward a link containing information you are not authorised to share.
New share links expire after 7 days. You may revoke a link before expiry through available in-app controls or by contacting us. Account deletion removes account-linked share links. Search engines are not intended to index these links.
10. Retention
- Raw submissions and staged uploads: only as long as needed to run the check; staged payloads commonly expire within hours.
- Analysis job records: short-lived pending records commonly expire within 24 hours; completed Message Trust job records may remain for up to 30 days so the result can be retrieved.
- Result-share links: 7 days unless revoked sooner.
- Truth Vault: up to 30 days.
- Feedback: until the issue is closed, and never longer than 90 days.
- Security and abuse logs controlled by us: up to 30 days, unless a longer period is required for an active investigation or by law.
- Account and push-token records: while the account is active, then deleted through the account-deletion process.
- Legal hold: only for the period required by law or valid legal process.
11. Sharing and disclosure
We disclose data to the processors described above, when you create a share link, to authorities in response to valid legal process, or as part of a merger, financing, acquisition, or transfer of the Service subject to appropriate protection. We do not sell personal data or share it for cross-context behavioural advertising.
12. Your choices and rights
Depending on applicable law, you may ask for access to or a summary of your data, correction, erasure, restriction, objection, portability, withdrawal of consent, grievance handling, or review of our response. Indian users may also exercise the right to nominate another person as provided by applicable DPDP law.
You can withdraw an operating-system permission in device settings, stop future analysis by not submitting content, disable notifications, revoke eligible share links, or delete your account. Withdrawal does not invalidate processing already completed lawfully.
Where applicable, EEA and UK users may complain to their local supervisory authority. California residents may request access, correction, or deletion and may exercise applicable opt-out and non-discrimination rights; TruSight does not sell personal information or use it for cross-context behavioural advertising.
13. Account deletion and privacy requests
Use in-app Settings → Request account & data deletion, visit Data deletion, or email us. We may verify a request using the registered email address, phone number, or active session. We aim to complete verified requests within 30 days unless law permits or requires longer.
14. Grievances
Privacy and Grievance Contact
Smitten Co., trading as Smitten Technologies
info@smitten.co.in
Write “Privacy” or “Grievance” in the subject line and describe the account and issue. We will respond within the period required by applicable law.
15. Adults only
TruSight is for people aged 18 or older. Do not create an account or submit data if you are under 18. If you believe a person under 18 has provided personal data, contact us so we can investigate and delete it where appropriate.
16. International transfers
We operate from India and use providers in multiple countries. Your submission may therefore be processed outside your country. Where required, we use contractual and organisational safeguards and comply with applicable transfer restrictions.
17. Security and incidents
We use reasonable technical and organisational measures, including encrypted transport. No system is completely secure. If a personal-data breach requires notice, we will notify affected users and authorities as required by applicable law. See Security.
18. Automated outputs
TruSight produces algorithmic and AI-assisted informational results. Smitten does not use a TruSight score to make decisions about your employment, housing, credit, insurance, immigration status, or legal rights. Read the cited sources and use independent judgment.
19. Payments
The current version is free to download with no in-app purchases. If paid plans are introduced, the app-store billing provider will process payment information and this Policy will be updated before the change applies.
20. Changes
We post changes at https://smitten.co.in/privacy-policy with a revised date. Material changes will also be communicated in the app or through another reasonable channel before they take effect where required.
21. Contact
Smitten Co., trading as Smitten Technologies
info@smitten.co.in
https://smitten.co.in
Related: Terms · Acceptable use · Data deletion · Cookies · Disclaimer · AI & media notice · Security