Version 2026-09-15 · Last updated 15 September 2026

Privacy policy

This policy explains what personal data This & That collects, why, and what you can do about it. It is written for India's Digital Personal Data Protection Act, 2023.

The Data Fiduciary is Karan Mundhra, an individual operating as This & That, India. Contact: contact@thisandthat.care.

1. Whose data

Givers. People who create an account.
Doers. People a Giver adds and hands work to. Doers do not sign up.

2. What we collect

From Givers

Name, business or team name, email address or mobile number, and a password if you use one.
Tasks, deadlines, comments and files you import.
The date you accepted our terms and this policy.
If you connect Telegram: your Telegram chat number.
If you connect a calendar: the private calendar address you paste (stored encrypted), and the titles, times and places of your meetings for the next two weeks.

About Doers, from the Giver

Name, and phone number or email address if the Giver adds them.
Tasks handed to them, their replies, and a record of each reminder.
Whether they accepted the invite, or replied STOP, and when, with the wording they were shown.
If they choose Telegram: their Telegram chat number.
Voice notes they send are turned into text. We keep the text, not the recording.

Automatically

Sign-in cookies that keep you logged in. We do not use advertising or tracking cookies.
Basic technical logs kept by our hosting providers for security and to fix faults.

3. Why we use it

To run your account and sign you in.
To record tasks and remind Doers until the Giver confirms the work is done.
To keep the service secure and prevent abuse.
To meet legal duties.

We rely on the Giver's consent when they create an account, and on each Doer's own consent before we message them. We do not sell personal data and do not use it for advertising.

4. Who processes it for us

Supabase. Database and sign-in. Data stored in Mumbai, India.
Vercel. Hosting the web app. App runs in Mumbai, India. Company based in the United States.
Resend. Sending and receiving email, including reminders and replies. United States.
Telegram. Delivering reminders and replies for people who choose Telegram. Outside India.
OpenAI. Turning voice notes into text, only when someone sends a voice note. United States.

Some of these companies are based outside India, so data may be accessed from other countries. We only share what each one needs to do its job.

5. How long we keep it

While your account is open.
When you delete your account, your workspace, the people you added, your tasks and their history are deleted from our live database straight away. Copies can remain in our providers' backups for a limited time until those backups are replaced.
A record that a Doer replied STOP is kept so we never message them again.

6. Your rights

You can ask us to:

Tell you what personal data we hold about you and how we use it.
Correct or complete it.
Erase it.
Withdraw consent. For Doers: reply STOP. For Givers: delete your account.
Nominate someone to exercise these rights if you die or cannot act.

Givers can download their data and delete their account from Account at any time. Anyone else, write to contact@thisandthat.care. We may ask you to confirm who you are.

7. Security

Data is encrypted in transit. Access to the database is restricted to the app's server. No system is perfectly secure. If a breach affects your data we will tell you and the authorities as the law requires.

8. Children

This & That is not for anyone under 18. We do not knowingly collect data about children.

9. Complaints

Grievance Officer: Karan Mundhra, contact@thisandthat.care. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

10. Changes

If we change this policy in a way that matters, we will tell Givers in the app and ask them to accept the new version. The version and date are at the top of this page.