Privacy policy
Updated 26 September 2026
We collect as little as the service needs: mainly your WhatsApp number, the names of the cards you hold, and the questions you ask. We never ask for your card number, CVV, OTP or UPI PIN, we never sell your data, and we send you offers only if you have asked for them.
Who is responsible for your data
AskTula is a service of Om & Company, based in Raigarh, Chhattisgarh, India. Om & Company decides how your personal data is used, and is the data fiduciary under the Digital Personal Data Protection Act, 2023. We also follow the Information Technology Act, 2000 and its rules on reasonable security practices.
What we collect, why, and for how long
Each item below is collected for the purpose next to it, and for nothing else.
| What | Why we need it | How long we keep it |
|---|---|---|
| Your WhatsApp number | It is your account. We use it to send your sign-in code and to answer you. | While you have an account. |
| Your name | To address you. We ask for it once, after your sign-in code. | While you have an account. |
| Your email address, if you give it | For messages about your account, to reply if you write to us, and for offers only if you have agreed to them. You can add, change or remove it at any time. | While you have an account, or until you remove it. |
| Whether you want our offers and updates, and when you said so | To send them only if you agreed, and to stop the moment you tell us to. | While you have an account. |
| The names of the cards you hold, and each card's network | To answer for the cards you actually hold. Card names only, never card numbers. | While you have an account, or until you remove the card. |
| The UPI apps you use, if you tell us | Some card offers pay only through one app, and we should not quote those to you if you do not have it. | While you have an account, or until you remove the app. |
| A card whose monthly cap you tell us is spent | So we stop recommending that card until its cap resets. | While you have an account. |
| Your answers to our optional profile questions: the kinds of shops you use, a rough monthly spend, the reward you prefer, a large purchase you are planning | So that we suggest a card you do not hold only when you have asked, and only when we know enough about your spending to make the suggestion fair. | While you have an account, or until you ask us to remove them. |
| Your questions, our answers, and cards you ask us to add | To follow a conversation (we use your last few messages from the past 30 minutes), to add missing cards, and to keep to the daily and monthly question limits. To find and fix wrong answers, we also keep each question with the answer our own software worked out and the answer our AI model gave, so the two can be compared. | While you have an account. |
| Your referral code, and who referred you | To record who invited whom. | While you have an account. |
| Sign-in codes and website sign-in | To sign you in safely. We store only a scrambled copy of each code. | A code works for a few minutes. Codes are deleted after 30 days, and website sign-ins 30 days after they end. All of them go with your account if you close it. |
| Your number, if you start signing up and do not finish | To remind you once on WhatsApp to finish signing up. | Until you finish signing up, ask us to delete it or tell us to stop. |
On the website
- On the website, a cookie that keeps you signed in. It holds a random code, and we store only a scrambled copy of it. We use no advertising cookies or trackers. If you press Accept on the cookie notice, we also collect website usage statistics through Google Analytics: which pages you looked at and roughly where in the world you are, never your number, your name or your cards. Press Reject, or ignore the notice, and none of it runs. You can change your mind at any time from the link in the footer.
- Nothing else about you is collected by simply reading a page.
Your consent
You give your consent to the service when you sign up, by sending us your number and confirming the code.
Offers and updates need a separate consent: a box at sign up that is never ticked for you. Saying no does not change the service in any way.
You can withdraw either consent at any time, as easily as you gave it: tell us on WhatsApp or write to hello@asktula.com. Withdrawing consent to the service closes your account, and we then delete your data as described below. Withdrawing consent to offers only stops the offers. Neither affects what we did before you withdrew.
What we never do
- We never ask for your card number, CVV, OTP or UPI PIN.
- We never sell your data or share it for anyone else's marketing.
- We never share your number, your cards or your questions with any bank, card issuer or shop.
- We never send you offers or updates unless you have agreed to them. Otherwise we message you only to answer you, to send your sign-in code, about alerts you choose to switch on, and, if you start signing up and do not finish, to remind you once to finish.
- If you choose to join the AskTula community on WhatsApp, that is a separate choice. Messages there can include news and offers, and the community's admins can see your number. Leaving the community stops those messages and does not affect your account.
Who helps us run the service
These providers process data for us, only to run AskTula and only on our instructions:
- Meta, which carries our WhatsApp conversations, delivers your sign-in codes and, if you have agreed to them, our offers and updates.
- Supabase, which stores our database. The database is in India, in Mumbai.
- Hostinger, which runs our servers, hosts this website and carries our email.
- Anthropic, whose Claude model writes many of our answers. For each question it receives your question, the names of the cards you hold, the UPI apps you have told us about, which card caps you have told us are spent, and your last few messages from the past 30 minutes. It never receives your WhatsApp number, your name or your email address. Anthropic is a United States company, and this is processed outside India.
- Groq, which helps our own software work out what a question is about. It may receive part of the words of your message, and nothing else. Groq is a United States company, and this is processed outside India.
- Google, which provides Google Analytics. This runs only if you press Accept on the cookie notice, and it is switched off until you do. It receives which pages you looked at and roughly where in the world you are, and never your number, your name, your email or your cards. Google is a United States company, and this is processed outside India.
Some of this processing happens outside India, as the Digital Personal Data Protection Act, 2023 permits. We will update this list before we add a provider that receives your personal data.
How long we keep it, and deleting your account
We keep your data while you have an account, as set out in the table above. You can close your account by telling us on WhatsApp or writing to hello@asktula.com. We stop using it the moment it is closed, and within 30 days we delete your number, name, email, cards, UPI apps, profile answers, questions and answers, and ask our providers to do the same. You can sign up again with the same number at any time.
If you start signing up and do not finish, we keep your number so that we can remind you once on WhatsApp to finish. We delete it as soon as you finish signing up, ask us to delete it or tell us to stop. The code we sent you is deleted within 30 days either way.
The one exception is a record the law requires us to keep, such as a record needed to investigate a security incident. We keep only that record, only for the period the law sets, and use it for nothing else.
Our understanding service keeps a log of the words of questions it was asked to place, with no number, name or account attached, to improve how it understands questions. We delete each entry after 90 days. Because nothing links those words to you, they cannot be found and deleted with your account before then, so please do not put personal details such as your name or a card number into a question.
How we protect it
Data travels to and from AskTula encrypted. The database is encrypted where it is stored, sign-in codes and website sign-ins are stored only as scrambled copies, and only the people who run AskTula can reach your data. If a breach ever affects your personal data, we will tell you and the authorities as the law requires, with what happened and what you can do.
Your rights
You can:
- ask for a summary of the personal data we hold about you, how we use it, and who helps us process it;
- ask us to correct, complete or update it;
- ask us to delete it, and withdraw your consent;
- nominate someone to use these rights for you if you die or become unable to;
- have a complaint about how we handle your data answered by our grievance officer.
These are your rights under the Digital Personal Data Protection Act, 2023, and we honour them now, before those parts of the Act come into force.
To use any of them, write to hello@asktula.com or tell us on WhatsApp, from the number on your account, so we know the request is yours. We may send a code to that number to confirm it. We reply within 30 days.
If you are not satisfied with our answer, you can complain to the Data Protection Board of India once the Act allows it.
Grievance officer
Ravi Gupta, Founder, AskTula (Om & Company). Write to hello@asktula.com. We acknowledge every complaint within seven days and answer it within 30 days.
Children
AskTula is meant for adults who hold credit cards, and is not directed at children. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete its data.
Changes to this policy
If we change this policy, we will update this page and its date. If a change affects how we use your data, we will tell you on WhatsApp before it applies and ask again where the law requires.