What LekhaJokha keeps, and why

1. Who we are

In short: LekhaJokha is run by Mibora Technologies Private Limited, an Indian company. Under India's data protection law we are the "Data Fiduciary" and you are the "Data Principal" — meaning we decide how your data is handled, and we answer to you for it.

1.1 LekhaJokha ("LekhaJokha", "we", "our", "us") is a service operated by Mibora Technologies Private Limited, an Indian company with its place of business at Chandigarh, India.

1.2 For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, Mibora Technologies Private Limited is the Data Fiduciary in respect of the personal data described in this policy, and the individual using the service is the Data Principal.

1.3 This policy applies to the LekhaJokha service delivered over the WhatsApp Business Platform, and to the website at lekhajokha.ai. It does not apply to WhatsApp itself, which is operated by Meta under its own terms and privacy policy.

2. What we collect

In short: your available WhatsApp phone number, business-scoped sender ID, username, display name, and whatever you send to LekhaJokha — plus the records we make out of it. Nothing else. We do not read your other chats, and we cannot: WhatsApp only gives a business the messages sent to that business.

2.1 We collect the following categories of personal data, and no others:

2.2 We never ask you for your contacts, your location, your device identifiers, your other WhatsApp conversations, or your bank or card details, and nothing in LekhaJokha collects them on its own. We do not buy personal data from anyone and we do not enrich what you give us with data from other sources.

2.2b But a photograph contains whatever is in it. If you photograph a payment screen, a bank message, a cheque or a bill, what is printed on it is read and kept alongside that file — that can include a UPI address, a masked account number or a payment reference. We do not ask for those and we do not go looking for them; they arrive because they are on the paper you sent. They are stored with the file, they are never sold or used to advertise to you, and they are deleted when you delete that file or your data. The one deliberate exception is clause 2.2a.

2.2a Identity documents: built to keep nothing. LekhaJokha is built to recognise an identity document — an Aadhaar card, a PAN card, a licence — and to keep nothing from it: no number, no name, no text. That refusal is enforced twice, once when the file is read and again before anything reaches our database. Recognition is done by a machine and can be wrong, and if it fails to recognise the document the text printed on it is stored like any other file's. That is why we ask you not to send us identity documents you do not need us to hold. To recognise the document at all, the image is sent to the reader named in clause 5.1, and the photograph itself is kept with your other files until you delete it — which is why the reply offers you a one-tap delete.

2.3 You choose what to tell it. LekhaJokha records what you send, so what it holds about you is exactly what you decided to send it. Please do not send us information about other people that you are not entitled to keep — see clause 4 of the terms.

2.4 The website. lekhajokha.ai has no advertising tags, no embedded third-party content other than Cloudflare's visit counter, and no login. It counts visits with Cloudflare Web Analytics, which sets no cookie and keeps no record that identifies you — only which pages are visited, roughly from where, and on what kind of device. The owner web app, at admin-dev.lekhajokha.ai, is different in one way: it has a sign-in. You ask for a code from inside your WhatsApp chat with LekhaJokha, type it on the web page, and the app keeps one cookie — your session, for up to seven days — so it knows it is you. The web app sends you nothing; you can end every web session from the chat at any time; and the code and the session are deleted with everything else when you ask to be forgotten. See clause 12.

3. Why we collect it

In short: only to run the service you asked for — turn what you said into a record, keep it, and answer questions about it. We never sell it and never use it to advertise to you.

3.1 We process your personal data only for these purposes:

• To provide the service — to understand your message, create a record from it, store it, and reply to you.
• To answer your questions — to calculate totals and histories from your own records when you ask for them.
• To keep the service working — to detect and fix faults, to prevent the same message being processed twice, and to protect against abuse.
• To meet our legal obligations — where Indian law requires us to retain or disclose something.

3.2 We will never sell your personal data, rent or trade it, use it to target advertising at you or anyone else, use the content of your records to profile you for any purpose other than answering your own questions, or give it to a data broker.

3.3 If we ever want to use your data for a purpose not listed in clause 3.1, we will ask you first, in the chat, and you will be free to say no and carry on using the service.

4. Your consent, and taking it back

In short: messaging LekhaJokha is how you agree, and we record when that happened. You can withdraw at any time by deleting your data — one message in the chat.

4.1 How consent is given. Your first message to the LekhaJokha WhatsApp number is your consent to the processing described in this policy. We record the date and time of that first message so that we can evidence when consent was given.

4.2 What you are consenting to is set out in clause 2 (what we collect) and clause 3 (why). It is deliberately narrow: everything is for running the service.

4.3 How to withdraw it. Send the message delete my data to LekhaJokha and confirm once. That withdraws your consent and erases what we hold. Full instructions, including what to do if you no longer have the number, are on the delete my data page.

4.4 What happens then. Withdrawing consent stops the service for you — there is nothing left to keep records in. It does not undo processing that already lawfully happened before you withdrew, and it does not reach copies held by the companies in clause 5 on their own retention schedules.

4.5 Withdrawing is as easy as giving. One message, one confirmation button, no form, no reason required, and nothing to prove.

5. Who else handles your data

In short: five companies help run LekhaJokha — the one that carries the messages, the one that runs our software, the one that hosts the database, and two that read speech and text so we can structure it. Each is named below with what it sees and where it is. Nobody else gets your data.

5.1 We share personal data only with the processors listed below, only to the extent each needs it to perform its function, and only under contract.

5.2 Training: the position today, provider by provider. Content is sent to the providers in clause 5.1 only so that a single message can be understood. What each provider may then do with it is not the same, and we will not flatten that difference into a promise we cannot keep.

• The language model that reads your text — and the photos and PDFs you send (OpenAI) does not train on content submitted through its API. That is its published API policy, it applies by default without us having to ask for it, and it covers files as well as text — checked on its data-usage page on 9 September 2026. Two things that page also says, which we are repeating rather than leaving out: it keeps abuse-monitoring logs for up to 30 days, and longer where the law requires it or where it is reasonably necessary to prevent harm; and an image is scanned when it is submitted, with one their system flags retained for manual review.
• The service that turns a voice note into text (Sarvam AI, operated by Axonwise Private Limited) states in its own privacy policy that it uses customer content — inputs, uploads, prompts and outputs — to train, fine-tune and improve its models unless the customer explicitly opts out (checked 9 September 2026). We have not completed that opt-out. Until we have, and until this clause is changed to say so and to carry the date it took effect, you should assume that the audio of a voice note you send may be used by that service to improve its models. This applies to voice notes only: typed messages are never sent to it.

5.2a What we never do. We do not sell your content, we do not use it to advertise to you, and we do not use it to train any model of our own.

5.3 Transfers outside India. Running this service means some data crosses borders — the message carrier operates globally and one AI provider is in the United States. We make these transfers in reliance on section 16 of the DPDP Act, and we do not transfer personal data to any country that the Central Government has restricted. Invited testers use a separate test service, whose database is in Tokyo, Japan.

5.4 Changing a provider. If we replace or add a processor we will update the table above and change the date at the foot of this page. Where the change is significant, we will also tell you in the chat before it takes effect.

5.4a One change we did not announce in advance, and should have. On 8 September 2026 LekhaJokha began reading the photos and PDFs you send — a new role for the reader in clause 5.1 — and this page was not updated until 9 September 2026. Clause 5.4 says we will tell you in the chat before a significant change takes effect, and on this one we did not. We are contacting everyone who used LekhaJokha in that window directly, and this clause will name the date when that is done. We are recording it here rather than quietly fixing the wording, because a policy that edits its own history is worth less than one that admits a gap — and because a policy that admits a failure and then overstates the remedy is worse than one that admits nothing.

5.5 The only other circumstances in which your data leaves us are:

• Where the law requires it — a valid order of a court, or a lawful demand from an authority entitled to make it. We will tell you when we are permitted to.
• To protect people — where we believe in good faith that disclosure is necessary to prevent serious harm.
• If the business changes hands — in a merger, acquisition or sale of assets, your data may transfer to the acquirer. We will tell you in the chat before your data becomes subject to a different privacy policy, and withdrawing at that point is one message.

6. How long we keep it

In short: until you tell us to delete it. Your records are the product — deleting them on a timer would break the thing you came for. One message removes your records, files and messages; a few records are kept, which 6.2 lists.

6.1 We are honest about one thing here. We have not yet set an automatic expiry on the copy we keep of your messages as you sent them. Today that copy lives until you delete your data. Shortening it automatically is on our list, and when it changes this table changes with it.

6.2 What survives a deletion. A few records, none holding your name, number or anything you sent: an internal billing account number and the count of messages and photos used that month and that day; the cost of each AI call made for you, without your name, number or account; for 14 days, limited delivery metadata so old messages cannot restore what you deleted; and, if you started or made a purchase, the record of it. We have no automatic clean-up for these yet. Beyond those, the only thing that can outlive a deletion is a general pattern of phrasing already stripped of who said it.

6.3 What is outside our reach. The companies in clause 5 may hold a short-term copy that they delete on their own schedule, typically within a month; and the chat itself stays on your own phone until you delete it there.

6.3a A file we send back to you. When you ask LekhaJokha to send you a file it holds — a bill, a payment screenshot — it has to hand that file to WhatsApp to deliver it. WhatsApp's own documentation says: "All media files sent through this API are encrypted and persist for 30 days, unless they are deleted earlier." That copy is WhatsApp's, not ours. Deleting your data here removes our copy; it does not reach WhatsApp's, and it does not reach the one now sitting in your chat. We say "does not reach" rather than "cannot": WhatsApp does offer a way to delete such a file, but we do not keep the reference needed to use it, so today we have no handle to delete with.

7. How we protect it

In short: encrypted in transit, stored in private systems, secrets kept out of our code, and message content deliberately kept out of our logs. No system is perfect and we will not pretend ours is.

7.1 The measures we actually take, rather than the ones that sound good:

• Everything travels encrypted. All traffic between you, WhatsApp, our software and every processor uses TLS.
• We verify that a message is really from WhatsApp. Every incoming message carries a cryptographic signature which we check before we act on it, so a stranger cannot inject messages into your account.
• Your media is private. Voice notes and photos are held in a private store that is not readable from the internet.
• Our logs do not contain your messages. We deliberately never write message text, transcripts or phone numbers into our routine operational logs. We do record WhatsApp's own identifier for a message, so that we can trace a fault — and we should tell you that WhatsApp builds those identifiers in a way that embeds the sender's number, so the identifier is not wholly anonymous. It is treated as personal data and deleted with everything else.
• Secrets are never in our code. Access keys are held in a secret store, never in configuration files, source code or command lines.
• Access is limited to the people who need it to run the service, which today is a very small number of people.

7.2 What we do not claim. No service can promise that data will never be compromised. We are an early-stage product built by a small team, and we would rather you knew that than believed a stronger claim. What we do promise is clause 13.

8. Your rights

In short: you can see what we hold, correct it, delete it, complain about it, and name someone to act for you if you cannot. Most of it works from inside the chat, with no form to fill.

8.1 As a Data Principal under the DPDP Act you have the following rights.

8.2 We do not charge for any of this, and we will not ask you why.

8.3 We will confirm who you are first for any request that does not come from inside your own WhatsApp chat. Because your phone number is your account, a request by email to delete or disclose someone's records has to be checked — otherwise anybody could delete anyone's records by writing us an email. How we check is described on the delete my data page.

8.4 Your duties, briefly. The DPDP Act also asks that you do not impersonate someone else when exercising these rights, and do not file a false or frivolous complaint.

9. Complaints, and our Grievance Officer

In short: write to our Grievance Officer and you will hear back within 30 days, usually much sooner. If we do not put it right, you can take it to the Data Protection Board of India.

9.1 If you are unhappy with how we have handled your personal data, or we have not answered a request under clause 8, contact our Grievance Officer:

9.2 Escalating. If your grievance is not resolved to your satisfaction, or we do not respond within the time above, you may complain to the Data Protection Board of India in the manner prescribed under the DPDP Act. Nothing in this policy takes away that right.

10. Children

In short: LekhaJokha is not for anyone under 18. If we learn a child is using it, we delete the account.

10.1 The service is intended for adults keeping business or household records. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of 18.

10.2 We do not carry out any tracking, behavioural monitoring or targeted advertising, of children or of anyone else — so the specific prohibitions in section 9 of the DPDP Act do not arise in our service at all.

10.3 If you believe a child has been using LekhaJokha, tell our Grievance Officer and we will delete the account and everything in it.

11. Automated processing and AI

In short: a machine reads your message and decides what kind of record it is. It gets things wrong sometimes, which is why every reply shows you what was saved — or, for an udhaar with a person, what was read, before you save it. It makes no decision about you — only about your message.

11.1 What is automated. When you send a message, automated systems transcribe it if it is a voice note, read it if it is a photo or a PDF — what kind of document it is, the amounts, the dates and the names printed on it — decide what kind of record it is, and pull out the details: an amount, a person, a date. That is the entire product.

11.2 Every reply shows its work. LekhaJokha replies with exactly what it saved, and for a voice note it shows the words it heard first, so a mistake is visible immediately rather than discovered months later. One message corrects it. For a photo or a PDF, when it asks you what to do with the file — and when your own words under the photo make a record — it tells you in one line what it saw, so a misreading is visible at once. There is one path where it does not: if you tap the clip, name a record and then send a file that carries no payment or bill, the reply only confirms that it was attached.

11.3 No decisions are made about you. These systems classify your message. They do not score you, rate your creditworthiness, decide anything about your eligibility for anything, or produce any legal or similarly significant effect on you.

11.4 Figures are calculated, not guessed. When you ask a question, the totals come from arithmetic over your own stored records, not from an AI model's recollection.

12. Cookies and tracking

In short: this website sets no cookies and counts visits without identifying you. There is no banner to dismiss because there is nothing to consent to. The owner web app sets exactly one cookie — your sign-in session — and nothing else.

12.1 lekhajokha.ai sets no cookies, uses no local storage to identify you, embeds no third-party fonts, pixels, videos or advertising tags, and has no login. It counts visits with Cloudflare Web Analytics, as clause 2.4 says.

12.1a The owner web app, at admin-dev.lekhajokha.ai, sets one cookie: a random session token that lets it recognise you for up to seven days after you sign in with a code from your WhatsApp chat. It is not used for analytics or advertising and is not shared. The app stores only a scrambled form of that token and of your sign-in code, never the values themselves, and it does not record your IP address or browser. Tapping Sign out the web in the chat ends every web session at once; asking to be forgotten (clause 6) deletes them with everything else.

12.2 Our hosting provider processes ordinary server request information in order to serve the page and to protect the site from attack. We do not use it to build any profile of you.

12.3 Two scripts run on the site. Ours replays an example conversation inside the picture of a phone on the home page; it runs entirely in your browser, sends nothing anywhere, and the page works fully without it. The other is Cloudflare's visit counter (clause 2.4), which tells Cloudflare that a page was visited and sets no cookie.

13. If something goes wrong

In short: if your data is ever exposed, we tell the authorities and we tell you. We will not sit on it.

13.1 In the event of a personal data breach we will notify the Data Protection Board of India and every affected Data Principal, in the manner and within the timelines required by the DPDP Act and the rules under it.

13.2 Where a reportable cyber security incident occurs, we will also report it to the Indian Computer Emergency Response Team (CERT-In) within the timelines it directs.

13.3 Our own commitment, beyond what the law requires: we will tell you in the chat, in plain words, what happened, what of yours was involved, and what to do about it.

14. Changes to this policy

In short: if we change something that matters, we tell you in the chat before it applies.

14.1 We may update this policy as the service changes. The effective date at the top and the date at the foot always say when it last changed.

14.2 If a change materially affects how your personal data is handled, we will tell you in the chat before it takes effect, so that you can withdraw first if you prefer.

14.3 Small corrections — a clearer sentence, a fixed typo, a processor's name updated — are made without notice, and the date at the foot changes.

15. Governing law

In short: Indian law, Chandigarh courts.

15.1 This policy and any dispute arising out of it are governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and the rules under them.

15.2 Subject to your statutory right to approach the Data Protection Board of India, the courts at Chandigarh, India have exclusive jurisdiction.

16. How to reach us

The fastest route for anything about your own records is the chat itself. You do not need to email us to see, fix or delete them.