Privacy policy

The short version

• This website stores no payments and no personal data. There are no accounts and no cookies.
• You pay on our secure payment page, not on this website. This website never sees your card, UPI PIN or bank details.
• Your conversation with the Coach happens on WhatsApp, between you and The Alpha MD Foundation.
• You can ask us what we hold about you, correct it or have it erased, at any time.

This policy explains how The Alpha MD Foundation ("we", "us") handles personal data when you visit tobafree.org or buy access to TobaFree Support on WhatsApp. We are the Data Fiduciary for that data under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025.

Who we are: The Alpha MD Foundation, [TO CONFIRM: legal form and registration number, e.g. Section 8 company CIN or trust registration], registered at [TO CONFIRM: registered postal address].

What this website keeps

Nothing personal. The website has no accounts, no sign-up forms and no database. It does not store your payment, your name, your phone number or your email address. When you pick a plan, the website sends you to our payment page with only the plan's name (for example ?plan=90days) in the link.

What the payment page collects when you pay

You pay on our secure payment page at bots-pay.amdha.health, not on this website. [TO CONFIRM: who operates the payment page and the payment processor behind it, with a link to its privacy policy.] It collects what it needs to take the payment, such as your phone number, email address and payment method.

We never receive your card number, CVV, UPI PIN or net-banking password. We see each payment's amount, status, reference and the contact details you entered when paying. We use those details only to issue your receipt, process a refund and answer your support requests.

What happens on WhatsApp

After you pay, the payment page takes you to WhatsApp. When you send your first message, you start a conversation with the Coach, TobaFree's WhatsApp chatbot run by The Alpha MD Foundation. That conversation includes your WhatsApp number and anything you choose to tell the Coach, which may include details about your tobacco use and your health.

We use these messages only to support you in quitting and to confirm your payment. [TO CONFIRM: what the Coach stores from WhatsApp conversations, where it is stored, and for how long.] WhatsApp itself is operated by WhatsApp LLC under its own privacy policy.

Analytics without cookies

We count visits with Vercel Web Analytics. It uses no cookies, does not track you across other websites and does not identify you as a person. We see totals only, such as how many visitors picked each plan. Because nothing is stored on your device, there is no cookie banner.

Who processes data for us

• Our payment page and its payment processor: take payments, handle refunds and keep the payment records the law requires. [TO CONFIRM: name the processor.]
• Vercel Inc.: hosts this website and provides the cookie-free analytics. Like any web host, it processes technical request data such as your IP address to deliver and protect the site.
• WhatsApp LLC: carries your messages to and from the Coach.

We do not sell your personal data, rent it or use it for advertising.

Why we process it

We process the personal data described above to sell you access, confirm your payment, give you the Coach's support, issue receipts and refunds, answer your questions and meet our legal duties, such as keeping tax and payment records. You give your consent when you pay and when you message the Coach. You can withdraw it at any time; doing so stops the Coach's support but does not undo a payment already made.

How long it is kept

• This website: keeps nothing personal, so there is nothing to delete.
• Payment records: kept by the payment processor, and by us for receipts and accounts, for as long as tax and payments law requires. [TO CONFIRM: retention period for payment records.]
• Coach conversations: [TO CONFIRM: retention period for WhatsApp conversations and what happens when access ends.]

Your rights

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and who we have shared it with;
• ask us to correct, complete or update it;
• ask us to erase it, unless the law requires us to keep it;
• withdraw your consent;
• nominate someone to exercise these rights if you die or become unable to;
• raise a grievance with us and, if you are not satisfied with our answer, complain to the Data Protection Board of India.

To use any of these rights, write to support@tobafree.org from the email address or phone number you paid with, and include your payment reference if you have it. We aim to reply within [TO CONFIRM: response time in days], and always within the time the DPDP Rules allow.

Grievance Officer

[TO CONFIRM: Grievance Officer's name], The Alpha MD Foundation. Email: support@tobafree.org.

Children

TobaFree is for adults. [TO CONFIRM: minimum age for buying access (18 suggested; the DPDP Act requires verifiable parental consent to process a child's data).]

Security

Payments run entirely on our payment page, over encrypted connections. This website takes no payments and holds no payment keys. If a personal data breach affects you, we will tell you and the Data Protection Board as the DPDP Act requires.

Changes to this policy

If we change this policy, we will update it here and change the "Last updated" date above. If a change affects how we use data you have already given us, we will tell you on WhatsApp before it applies.