Privacy Policy

Depending on how you use Maa Nest, we may collect:

Identity & contact details

• Full name, date of birth and gender
• Mobile number and email address
• Address
• Government-issued ID and Aadhaar-linked verification details
• Emergency contact details

Verification information (for safety and compliance)

• DigiLocker and KYC verification data
• Identity documents and educational credentials
• A live selfie and face / liveness verification data
• Your verification status

Information about the children in your care (provided by parents)

• Name and age
• Medical conditions, allergies and behavioural notes
• Care instructions, care preferences and schedule
• Emergency notes and care routine (such as medication, foods to avoid and emergency medical information)
• For a multi-child booking, the relationship between the children (for example, siblings, cousins, friends or relatives)
• Emergency contacts

Information about a senior receiving Elder Care (provided by the family)

• Name and age
• Medical conditions, mobility needs, allergies and dietary requirements
• Medication schedule and instructions, and any assistance the caregiver should provide with taking medication
• Care routine, care preferences and daily-living needs
• Emergency medical information and emergency contacts
• The relationship between you and the senior, and who is authorised to make care decisions

You should share health and care information only about a person you are responsible for and with their agreement where they are able to give it. This information is sensitive; we treat it as described in Sections 5, 6 and 6A and use it only to deliver and keep the care safe.

Bookings & activity

• Booking and session history and caregiver assignments
• The service location you confirm for each booking (see Section 1.1)
• Wallet balance, rewards, promo-code usage and payment history
• In-app messages and communication records
• Ratings, reviews and support requests
• Incident reports

Device & technical data (collected automatically)

• Device type, operating system and app version
• IP address and device identifiers
• Login timestamps and usage activity
• Crash logs, cookies and analytics data

To provide, coordinate, and keep care safe, we collect and process location information, including:

• The service location (address and precise map coordinates) that you select and confirm for each booking
• The caregiver’s live location while a booked session is active, so the family can see where their caregiver is for the duration of that session. This is shared only while the session is active. It does not begin before the session starts, and it stops when the session ends. The caregiver’s device may share this location in the background while the session is running
• Approximate device location used to show nearby caregivers and improve matching
• For Instant requests, an approximate position a caregiver shares while she has Instant switched on, so that requests from families nearby can be offered to her. It expires by itself within minutes, it is never shown to a family as a live position, and it is used only to decide who to offer work to
• On our public website, the location you choose or allow your browser to share, used to run that one search for caregivers near you

Fresh location is not always available — a phone loses signal, a building blocks GPS, a device pauses an app in the background. When that happens during an active session, the app continues to show the most recent position it did receive, labelled with how long ago it was received. That is a last-known location, not the caregiver’s current position, and the app says so rather than presenting a stale point as a live one. A position more than five minutes old is not treated as live. This changes nothing about when tracking runs: it still begins only when a session becomes active, and it still stops when the session ends, is cancelled, or the share expires.

The service location you confirm is stored with that specific booking and is used to deliver care at the right address, for booking records, and for safety. A caregiver’s live location during an active session is visible to the family who booked that session and to Maa Nest, and to nobody else. Location information is shared between the family and the assigned caregiver only as needed to deliver and coordinate that booking, and during emergencies as described in Section 13.

The location you use on our public website is different, and deliberately lighter. It runs that single search, it is not attached to an account, and we do not need your name, your number or an account to run it. The results show only a caregiver’s first name, photo, verification badges and approximate distance from the point you chose. A caregiver’s address and exact coordinates are never published on the website.

We use the information we collect to:

• Verify identities and keep children safe
• Manage bookings and match parents with caregivers
• Show the family their caregiver’s live location while a booked session is active
• Process payments and prevent fraud
• Provide customer support and send important notifications
• Coordinate during emergencies
• Improve the platform through analytics and monitoring
• Resolve disputes and enforce our policies
• Meet our legal and regulatory obligations
• Carry out AI-assisted identity verification
• Run automated fraud detection and prevention
• Provide AI-assisted caregiver matching and booking recommendations
• Perform automated risk assessment, safety monitoring, and abuse prevention

We rely on one or more of the following legal bases: your consent, the need to deliver our services, legitimate business interests, fraud-prevention and safety obligations, and legal compliance.

Some of the uses described in Section 2 rely on automated systems, rules, or AI-assisted tools. This section sets out what they actually do.

Where automated processing is used

• Identity verification — the checks described in Sections 3 and 4 include automated steps, such as comparing a face capture against a verified document and reading the fields returned by DigiLocker.
• Matching — deciding which caregivers are eligible and nearby for a booking or an Instant request, and in what order they are offered. This applies rules about availability, distance, service eligibility and existing bookings.
• Fraud, risk and abuse prevention — detecting duplicate accounts, unusual booking or refund patterns, and misuse of promotional credit.
• Safety monitoring — flagging language and behaviour reported to us, and surfacing incidents for review.
• AI assistance inside the product — an in-app assistant that can answer questions about your bookings and, where you ask it to, carry out an action you could carry out yourself. It also assists caregivers in drafting a profile description, which the caregiver then edits and approves.

What data those systems may use

Account and profile information, booking details, the text of your request to the assistant, verification outcomes (not the underlying documents), payment and refund history where relevant to a risk check, and device or technical signals. Face and liveness data is used only for the verification described in Section 3 and for nothing else.

What these systems may and may not decide

• They support operational decisions such as who is offered a booking, what a screen shows you, and what is escalated for review.
• They do not, on their own, decide your legal rights or obligations. A suspension, a termination, a refund refusal, a safety finding or a verification rejection is not made final by an automated system alone — a person at Maa Nest reviews it before it stands.
• The in-app assistant cannot take an action that changes a booking or moves money without your explicit confirmation of that specific action.
• The platform does not use AI to diagnose a medical condition, to prescribe, or to make a clinical judgement of any kind.

Third-party AI processing

AI features run on Amazon Bedrock, a service of Amazon Web Services. The content of an AI request — which may include the text you write and the booking details needed to answer it — is sent to that service to generate a response. It is processed to answer your request and is not used by us to train a public model. AWS may process this outside India; see Section 12.1.

If you disagree with a decision

If your account is suspended or restricted, a verification is rejected, or a safety decision affects you, you can ask for it to be looked at again by writing to the addresses in Section 18. Tell us what happened and why you think the outcome is wrong. A person will review it, and we will tell you the outcome.

We may use aggregated, anonymised, or de-identified information for analytics, research, service improvement, performance monitoring, operational insights, product development, and statistical reporting. Information used this way does not identify you.

When you use our verification tools, you consent to Maa Nest and its authorised verification partners processing your facial-verification data to authenticate your identity, prevent fraud and duplicate accounts, protect your account, and support safety compliance.

Verification may involve a live selfie, facial-similarity comparison, and liveness detection.

Biometric data and verification results are processed securely and kept only as long as needed for verification, fraud prevention, safety, and other lawful purposes.

You authorise Maa Nest and its approved partners to access and validate your verification records, carry out KYC checks, and verify submitted documents through DigiLocker or other approved systems.

Maa Nest does not access Aadhaar databases directly and does not store Aadhaar numbers unless required by law or a compliance obligation.

We share only the information needed, and only with:

• Verification providers and payment processors
• Technology and cloud service providers
• Support and compliance partners
• Legal authorities where required by law
• Emergency responders during emergencies

Information is shared strictly on a need-to-know basis for operational, legal, safety, and compliance purposes. Maa Nest does NOT:

• Sell your personal data, or a child’s or senior’s data
• Use a child’s or senior’s data for advertising
• Rent your information to third parties

If Maa Nest goes through a merger, acquisition, investment, restructuring, business transfer, or sale of assets, your information may be transferred as part of that transaction, subject to applicable law and to the continued protection of your personal information.

We take children’s privacy seriously. Information about a child is:

• Access-restricted
• Used only to coordinate childcare
• Protected with reasonable security measures
• Never sold or used for advertising

Parents are responsible for the accuracy of the child-related information they provide, and confirm they are authorised to share it. Children may not create their own Maa Nest accounts.

The same applies when a child is the patient for a physiotherapy booking, which we accept from age five. A parent or guardian books, provides the patient details, and consents to the session on the child’s behalf.

Alongside the confirmation in Section 6 that you are legally authorised to share a child’s information, please share only what is reasonably necessary for the childcare service you are booking.

Avoid uploading sensitive information about your child that we have not asked for and that the booking does not need.

For Elder Care, information about the senior receiving care, including health, medication and mobility details, is treated as sensitive personal information. It is:

• Access-restricted and shared only with the assigned caregiver and, where relevant, Maa Nest support and safety staff
• Used only to coordinate and deliver the Elder Care service and keep it safe
• Protected with reasonable security measures
• Never sold or used for advertising

The family member booking Elder Care is responsible for the accuracy of the senior-related information they provide and confirms they are authorised to share it. Please share only what is reasonably necessary for the care being booked, and respect the senior’s wishes and dignity, including any decisions they are able to make for themselves.

When you book physiotherapy, we collect what the session needs and nothing more:

• Whether the session is for you or for someone else, and your relationship to them
• The patient’s name, date of birth and gender, so the physiotherapist knows who they are treating and we can apply the minimum age for home physiotherapy
• The therapy area you choose, such as orthopedic and pain relief or post-surgery recovery
• Any instructions you add for the physiotherapist, and the address the session runs at

These details are shared with the physiotherapist you booked, so that they can prepare and treat safely. Physiotherapy through Maa Nest is home therapy, not a medical consultation, and we do not ask for or store medical records, prescriptions or diagnostic reports. Please do not upload them.

To protect users, we may monitor and retain in-app communications, booking interactions, reports and complaints, support conversations, and rating activity. This is for fraud prevention, safety monitoring, policy enforcement, dispute handling, and operational support.

We may send you service-related messages, including:

• Booking updates
• Verification alerts
• Payment confirmations
• Safety notifications
• Emergency communications
• Account-related messages

You can manage non-essential notification preferences in your device or app settings where available. Some messages are essential to the service, such as safety and emergency communications, and cannot be turned off.

We keep information for as long as your account is active and as needed for legal compliance, fraud prevention, dispute resolution, and safety recordkeeping. Some information may be retained after account deletion where the law requires it.

The table below sets out how long each category of information is kept. Where a period is stated as a number of days, that is the period our systems actually apply. Where a category is governed by a rule rather than a fixed number, the rule is stated instead, because giving a precise-sounding figure we do not in fact apply would be misleading.

Deleted when you delete your account

The following are removed from our live systems as part of the deletion itself, together with the files they point to in our storage:

• Your profile and caregiver profile, including photographs, intro video, achievements and certificates
• Identity and DigiLocker verification records, including the masked Aadhaar value and the verification documents you uploaded
• Face verification records
• Children’s profiles you created
• Emergency contacts
• Bank account details held for payouts
• Device push-notification tokens and your in-app notification history
• Saved sign-in sessions and refresh tokens

In place of the above we keep a single deletion record (your name, contact details at the time, the roles held, the reason given, and the last four digits of any Aadhaar already held in masked form) so that a later support or legal query about the account can be answered. Your account row itself is retained in a scrubbed, anonymised state so that records belonging to other people do not break.

Kept for a fixed period

• Superseded identity documents, where you replace a document with a newer one: 30 days, then permanently deleted
• One-time codes sent by email: 10 minutes, then unusable, and removed once expired or used
• Sign-in refresh tokens: up to 60 days, or until you sign out or delete your account, whichever comes first
• A caregiver’s approximate Instant position: minutes, expiring by itself; it is never retained as a location history

Kept while the session is running

• A caregiver’s live location during a booked session: shared while the session is active and stopped when the session ends, is cancelled, or the share expires. A position older than five minutes is no longer treated as live (see Section 1.1)

Kept for as long as the records they belong to are kept

These are not deleted when an account is deleted, because they are shared records: they belong to the other party to a booking as much as to you, or they are financial and safety records we are required to be able to produce.

• Bookings, including the service address recorded on each booking, and the care information supplied for that booking
• Payments, refunds, invoices, caregiver earnings, payouts and wallet or reward ledger entries
• Ratings and reviews, and the messages exchanged between a family and a caregiver about a booking
• Safety and incident records, including SOS records
• Fraud and risk records, and the audit log of actions taken on the platform
• Support and grievance correspondence

Financial and tax records are kept for the period required by applicable tax, accounting and company law, and safety records for as long as needed for any investigation, claim or legal proceeding that is open or may reasonably arise. We do not state a single number for these because the period is set by the law that applies to the record, not by us.

Once a period ends, information is deleted or anonymised, unless applicable law requires it to be kept for longer.

This section brings together, for each category of information, what it is used for, who may receive or access it, how long it is kept, and the basis on which we handle it. It is a summary of the detailed sections above and does not replace them — where this summary and a detailed section differ, the detailed section governs.

Under the Digital Personal Data Protection Act, 2023, most processing described here rests on your consent, given when you create an account, verify your identity, confirm a booking, or grant a device permission. Some processing instead rests on a legitimate use recognised by that Act, or on a legal obligation — for example keeping tax records, responding to a lawful request from an authority, or acting in an emergency involving a threat to life or safety. Where a category below says “legal obligation” or “safety”, that means your withdrawal of consent does not by itself require us to delete it.

Contact and account information

• Mobile number and email address — used to sign you in, to reach you about a booking, and to send service messages. Received by our OTP and email delivery providers. Kept while the account exists; the deletion record retains them afterwards. Consent.
• Account and profile information, including your name, date of birth, gender and photograph — used to operate your account and to show a caregiver’s profile to families. Visible to the other party to a booking. Deleted on account deletion. Consent.

Location

• The exact booking address you confirm — used to deliver care at the right place and to record what was booked. Shared with the assigned caregiver, and with Maa Nest. Kept with the booking record. Consent.
• Approximate device location — used to show caregivers near you and to match Instant requests. Not shown to families as a live position. Held briefly. Consent, via your device permission.
• Live location during an active session — used so the family can see the caregiver on the way and at the home. Visible to that family and to Maa Nest only. Stops when the session ends. Consent, and safety.
• Last-known location — the most recent fix already received, shown with its age when fresh location is briefly unavailable. Same audience and the same stop rules as live location. Consent, and safety.

Care information

• Child information, including age, routine, allergies and special needs — used to deliver care safely. Shared with the assigned caregiver for that booking only, and only what is needed. Kept with the booking. Consent of the parent or guardian.
• Senior information, including mobility, routine and care needs — used the same way, with the same limits. Consent of the family member arranging care, and of the senior where they are able to give it.
• Physiotherapy patient information, including the therapy area and the condition described — used to match an appropriately qualified physiotherapist and to deliver the session. Shared with that physiotherapist. Kept with the booking. Consent; for a patient under 18, that of the parent or guardian.
• Child health and care information supplied for a booking — treated as sensitive, shared only with the assigned caregiver, and only for that booking.

Verification

• Identity and KYC information — used to confirm a caregiver is who they say they are before they can be booked. Processed by our DigiLocker verification provider. Deleted on account deletion; a superseded document is deleted after 30 days. Consent, and safety.
• Aadhaar verification information — we store a masked value only, never the full number. Used to record that verification succeeded. Deleted on account deletion, except the last four digits retained in the deletion record. Consent.
• Face and liveness verification — used to confirm that the person onboarding is the person on the verified document. Treated as sensitive. Deleted on account deletion. Explicit consent (see Section 3).
• DigiLocker information — the verified fields returned by DigiLocker for the checks described in Section 4. Consent.

Money, communication and platform records

• Payment and transaction information — used to take payment, issue refunds and pay caregivers. Card and bank details are handled by our payment and payout providers, not stored by us beyond what is needed to identify a transaction. Retained for the period required by tax and accounting law. Contract, and legal obligation.
• Messages and communications between a family and a caregiver — used to coordinate a booking and, where a report is made, to investigate it. Retained with the booking record. Consent, and safety.
• Ratings and reviews — published on a caregiver’s profile. Retained; a reviewer’s name is removed if they delete their account. Consent.
• Device and technical information — used for security, fraud prevention and to keep the service working. Retained for operational and security purposes. Legitimate use.

Safety, risk and automated processing

• Safety and incident information, including SOS records — used to respond to an incident and to investigate it. May be shared with emergency services or authorities where there is a threat to life or safety. Retained while any investigation, claim or proceeding is open or may reasonably arise. Safety, and legal obligation.
• Fraud and risk information — used to detect and prevent misuse of the platform. Retained for as long as needed for that purpose. Legitimate use.
• AI-assisted processing — described in Section 2.1, including which provider processes it and what it is and is not allowed to decide.

Subject to applicable law, you may request to:

• Access the personal information we hold about you
• Correct inaccurate information
• Withdraw consent where applicable
• Delete your account or eligible personal data
• Receive a copy of your stored information where permitted

Some information may be retained where required by law, or where needed for investigations, fraud prevention, or dispute resolution.

Where applicable law allows it, you may withdraw consent you previously gave us. Withdrawing consent does not make our earlier processing unlawful. It applies from the point you withdraw, not backwards.

Some Maa Nest services may become limited or unavailable if you withdraw a consent they depend on, such as identity verification.

You can delete your account from within the app, and it takes effect immediately: the account is locked, and the categories listed under “Deleted when you delete your account” in Section 8.1 are removed as part of that request, together with the files they point to in our storage. A file that cannot be removed at that moment is queued and removed by our next cleanup run.

If you hold a caregiver account with upcoming bookings, deleting it also cancels those bookings and refunds the affected families under the Refund & Cancellation Policy. See Section 14 of the Terms & Conditions.

A request made by writing to us instead, and any other request to exercise a data right under Section 9, is acted on once we have verified who you are, within the grievance timeline in Section 18 unless we tell you why it needs longer.

We may need to keep specific information for longer where applicable law requires it, or where it is needed for an ongoing investigation, fraud prevention, dispute resolution, regulatory compliance, or child safety obligations.

We use reasonable technical and organisational safeguards to protect your information against unauthorised access, misuse, loss, alteration, and disclosure. However, no online service can be guaranteed completely secure. If a significant data breach occurs, we may notify affected users and the relevant authorities where the law requires.

The safeguards referred to in Section 10 include:

• Encryption of data in transit
• Access controls
• Authentication mechanisms
• Security monitoring
• Periodic security reviews
• Role-based access controls

On our website we use cookies and similar identifiers in two groups, and they are treated differently.

• Essential — needed for the site to work and to stay secure: your session, protection against cross-site request forgery, your saved cookie choice, and Cloudflare’s security and bot protection. These are always on, because without them the site cannot be served safely.
• Analytics — optional, and off until you accept them: Google Analytics (GA4), which records pages viewed, approximate location and device type with IP addresses anonymised, and Microsoft Clarity, which records how pages are used, including clicks, scrolling and a replay of the interactions in a visit.

Neither analytics provider is loaded before you accept analytics cookies. Until you do, no Google Analytics or Microsoft Clarity script is placed on the page at all — declining is not a setting passed to a tool that has already loaded, it is the tool never loading. Withdrawing consent stops them again. Full detail, and the control to change your mind, is on our Cookie Policy page.

In the mobile app we also use device identifiers and technical signals for security, fraud prevention and delivering notifications, as described in Sections 1 and 2.

You can manage, disable, or restrict cookies through your browser or device settings. Disabling some cookies may affect the availability or functionality of parts of the platform.

Maa Nest relies on third parties to run parts of the service. Each processes only what that function needs, under its own policy and applicable law:

• Payments and refunds — our payment gateway, which handles card and bank details directly so that we do not store them.
• Caregiver payouts and bank-account verification — our payouts provider.
• Identity verification — our DigiLocker verification provider.
• One-time codes — our SMS and email delivery providers.
• Cloud hosting, storage and database — Amazon Web Services.
• AI features — Amazon Bedrock, a service of Amazon Web Services (see Section 2.1).
• Website analytics — Google Analytics and Microsoft Clarity, both of which load only after you accept analytics cookies and neither of which runs if you decline (see Section 11).
• Network security and delivery for our website — Cloudflare.

Data may be processed or stored on cloud infrastructure inside or outside India, with appropriate safeguards.

As noted in Section 12, your personal information may be processed, stored, or transferred outside India. Where that happens, we do so only where appropriate safeguards, contractual protections, and applicable legal requirements are met, and we take reasonable steps to see that your information stays protected.

The platform may link out to third-party websites, payment gateways, verification providers, or other external services.

We are not responsible for the privacy practices, security measures, or content of those services. Please read their own privacy policies before sharing information with them.

In an emergency involving the safety of a child or a senior in care, a medical situation, or an immediate security concern, we may share necessary information with emergency responders, hospitals, law-enforcement authorities, and emergency contacts where reasonably needed for safety.

You agree to:

• Provide accurate information
• Not submit false documents or misuse another person’s identity
• Keep your account credentials confidential

You are responsible for activity that happens under your account.

The accuracy commitment in Section 14 applies for as long as you use Maa Nest, and covers:

• Your personal information and contact details
• Emergency contacts
• Child information
• Caregiver information
• Anything else you submit to us

Please keep it complete and up to date. We may rely on the information you give us when delivering our services, including during an emergency, when there is no time to check it.

While we take reasonable measures to protect your information, we cannot guarantee absolute security or the prevention of every cyber threat. You acknowledge the inherent risks of using internet-based technology.

We may update this Privacy Policy from time to time. Updated versions take effect when published in the app, and continued use of Maa Nest means you accept the revised policy.

This Privacy Policy is governed by the laws of India. Any disputes fall under the jurisdiction of the courts in Bengaluru, Karnataka, India.

Maa Nest is operated by:

• MAANEST BABYSITTER PRIVATE LIMITED
• CIN: U88900KA2026PTC217655 · GSTIN: 29AAUCM6655Q1Z4
• Registered office: Building No. 23, Taj Building, Dr. BR Ambedkar Road, Near Jain Temple, Oorgaum, Robertsonpet, Kolar, Karnataka – 563122

For privacy questions, data requests, or grievances about how your personal information has been handled, contact us:

• Maa Nest Support: support@maanest.in · +91 63628 34307
• Grievance Officer: Shaik Adnan · adnan@maanest.in

How a grievance is handled

• We acknowledge a grievance within 24 hours of receiving it.
• We resolve it, and tell you the outcome, within 15 days of receiving it.

This timeline applies to grievances — a complaint that something has gone wrong, including a complaint about how your personal information has been handled, about a refusal of a data request, or about a decision affecting your account. It is not a promise to complete every request within 15 days: a request to exercise a data right (Section 9) may reasonably take longer where the information is large or spread across records, and where that is the case we will tell you within the 15 days why, and when to expect completion.

Complaints about a booking, a payment or a refund are handled through the Refund & Cancellation Policy, and safety incidents through the Safety Standards; both may also be raised with the Grievance Officer above.

Maa Nest collects your phone number, email address, and other contact details to provide our childcare services and ensure a safe user experience.

We use your contact information to:

• Verify your identity using OTP.
• Process and manage bookings.
• Facilitate secure communication between parents and caregivers through masked calling.
• Send booking confirmations and reminders.
• Notify you about caregiver arrival and booking status.
• Provide customer support.
• Send payment confirmations, invoices, refunds, and payout notifications.
• Deliver important account, security, and safety updates.

Maa Nest uses trusted third-party communication providers to deliver these services. These providers process your information only to facilitate service-related communications and in accordance with applicable laws.

We do not use your contact information for promotional or marketing communications without your consent. We do not sell or rent your personal information to third parties.

Users may opt out of promotional communications, where applicable, but essential transactional communications required for the operation and safety of the Maa Nest platform will continue to be delivered.