Privacy Policy

1.1 About the Website. The Website provides free-of-charge chat rooms.

1.2 Our role as a data controller. The entity that is responsible for the processing of your PD through the Website is maxochat ("we", "us", and "our"). We act as a data controller with regard to your PD collected through the Website (e.g., when you register your user account, browse the Website, or communicate with us).

1.3 Applicable laws. We process PD in accordance with applicable data protection laws, including but not limited to the Information Technology Act, 2000 (India), the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), the Digital Personal Data Protection Act, 2023 ("DPDPA"), the EU General Data Protection Regulation ("GDPR"), and the California Consumer Privacy Act ("CCPA"), as applicable.

1.5 Cookies. We use cookies on the Website. For more information on the types and purposes of our cookies, please refer to our Cookie Policy available on the Website.

2.1 PD that we collect. We comply with data minimisation principles and collect only the minimum PD necessary. The types of PD we collect include:

• Without registration: Username, Gender, Country, State — to provide access and ensure security.
• When registering: Username, Age, IP address, Country, City, Email address, device type, profile information, Password — to create and maintain your account. We also collect data via Microsoft Clarity (session recordings, heatmaps, clicks).
• Profile updates: Image — to customise your profile, based on your consent.
• Chat messages: Any PD you choose to provide — to feature your message, based on your consent.
• Contacting us: Name, email address, message content — to respond to your enquiries.
• General use: IP address and cookie-related data — to analyse and improve our services.

2.2 NPD that we collect. When you use the Website, we automatically receive browser and device information to analyse trends, identify errors, and develop additional features.

2.3 PD obtained from third parties. When you permit third-party integrations, those providers may share PD with us. We will use such PD only for the purposes for which it was provided.

2.4 What Happens If You Don't Give Us Your PD? If you do not provide requested PD, we may not be able to provide all services. However, you can access some parts of the Website without providing PD.

2.5 Sensitive data. We do not intentionally collect special categories of personal data. Under the SPDI Rules, passwords, financial information, health data, and biometric data are treated as sensitive personal data with appropriate safeguards.

2.6 Your feedback. If you contact us, we may keep records of questions, complaints, or compliments and de-identify your PD where possible.

2.7 Aggregated data. If NPD is combined with PD in a way that allows identification, it will be handled as PD. De-identified data that cannot be associated with an identifiable person may be used for legitimate business purposes.

2.8 Privacy of communication. We put reasonable efforts to ensure message confidentiality. We do not intentionally access your messages unless strictly necessary for provision of the Website, enforcement of legal terms, or as requested by law enforcement.

3.2 Sharing with our data processors. Where necessary, we share your PD with third-party service providers ("Our Processors") including web analytics companies, advertising networks, help desk providers, accountants, law firms, auditors, and email service providers.

3.4 Legally required releases. We may be legally required to disclose your PD if required by subpoena, law, or other legal process, including orders from competent Indian authorities under the DPDPA and IT Act, 2000.

3.5 Disclosures to successors. If our business is sold or merges with another business, we retain the right to transfer your PD to the new business, subject to this privacy policy.

3.6 Disclosure of NPD. We may disclose your NPD and de-identified PD for any purpose, including sharing with partners for business or research purposes.

3.7 Google reCAPTCHA. We use reCAPTCHA to verify that users are human. Google may collect certain PD from you including cookie data, IP address, and browser data. See Google's privacy policy.

The PD we collect may be stored, processed, and transferred between any of the countries in which we or Our Processors operate.

Wherever we transfer, process, or store your PD, we will take reasonable steps to protect it and ensure adequate levels of protection in accordance with applicable law, including the requirements of the DPDPA for cross-border data transfers.

We will use your PD to provide the goods, services, and/or information you request, to perform a contract with you, or to satisfy a legitimate interest of our company in a manner that does not outweigh your freedoms and rights.

5.1 Retention of PD. We retain information only for as long as we need it for legal, business, or tax purposes. When your PD is no longer needed and there is no lawful basis for storing it, we will securely destroy, delete, or erase it.

5.2 Retention of NPD. We may retain your NPD for as long as necessary for the purposes described in this privacy policy, including to pursue legitimate business interests, conduct audits, comply with legal obligations, and enforce our agreements.

5.3 Retention required by law. In some cases, we may be obliged by law to store PD for a certain period. We will delete it as soon as the required retention period expires.

6.1 Updating Your PD. You can update your PD using services found on our Website or by contacting us.

6.2 Revoking Your Consent. You have the right to revoke your consent at any time. You can opt out from marketing communications by clicking the "unsubscribe" link in any marketing email.

6.4 How to exercise your rights. Contact us using the details at the end of this policy. We will respond within 30 days, free of charge up to 2 times per year.

6.5 How to launch a complaint. Contact us first. If not satisfied, you may lodge a complaint with the Data Protection Board of India or your applicable local data protection authority.

11.1 Marketing messages. Normally, we do not send you marketing messages. If we do so with your consent, we will not sell, rent, or trade your email address to any unaffiliated third party without your permission.

11.2 Opting out. Every marketing email includes an "unsubscribe" link allowing you to opt out at any time.

11.3 Informational notices. From time to time we may send service-related, technical, or administrative emails on an "if-needed" basis. These do not constitute direct marketing and do not require prior consent.

We have built our Website using industry-standard security measures and authentication tools to protect the security of your PD.

Security measures include SSL encryption, strong password requirements, DDOS mitigation, limited staff access to PD, and anonymisation of PD where possible — in compliance with the SPDI Rules and the DPDPA.

We strongly urge you to protect any password you may have for our Website and not to share it with anyone. Always log out when you finish using the Website, especially on shared or public computers.

Security breaches. In the event of a personal data breach, we will take immediate measures to mitigate the breach and notify the Data Protection Board of India and affected Data Principals as required under the DPDPA.

13.1 Term. This privacy policy enters into force on the effective date indicated at the top and remains valid until terminated or updated by us.

13.2 Changes. We reserve the right to change this privacy policy at any time. For significant material changes, or where required by applicable law, we may seek your consent. If you disagree with changes, you should cease using the Website.

13.3 Repurposing of PD. If we decide to use your PD in a method different from that specified at the time it was collected, we will provide advance notice by email (if we have it) and, if necessary, seek your consent.

13.4 Data Sharing with LiveRamp. We may share certain information (such as your email in hashed form, IP address, or browser data) with LiveRamp Inc. LiveRamp returns an online identification code used in cross-channel advertising. To opt out, please visit: liveramp.com/opt_out.