Privacy Policy

Last updated 27 August 2026

Hello Beta is operated by Mohit Shukla, Hyderabad, India. In this policy, “we” and “us” mean that operator. If you have a question about anything here, write to contact@hellobeta.co and a person will answer.

This policy describes the system as it is actually built today, not what it may do later. Where it says something is stored, there is a table and a column behind that sentence. When the system changes, this page changes with it.

1. What Hello Beta is

Hello Beta is a voice assistant that takes a spoken grocery order, reads the resulting basket back to the user, and places the order for cash-on-delivery payment after spoken confirmation. A companion application allows one family member to link a household account and see completed orders.

Hello Beta currently runs on a single device in a single household, against a local grocery catalogue used for development. It is not open for public signup.

2. What we store

The household record. An identifier for the household, the name the assistant calls the user by, and a small set of ordering preferences: a glossary of the words that household uses for products, and rules about how it likes to order.

The basket for each call. Every call has a record holding the items, the quantities, the total, and the stage the call reached, with the time it started and ended. This is kept after the call ends. It is what lets a family member see completed orders in the companion app, and it is the household’s own order history. We do not currently delete it on a schedule, so assume it is kept until you ask us to remove it.

Access tokens for a linked account. If you connect a Swiggy account, we store the access token that Swiggy issues. See section 4.

A diagnostic log. An append-only record of what happened during a call: which tool ran, whether it succeeded, how long it took, and the reason if the assistant refused to do something. This log deliberately records the shape of a failed instruction rather than its contents, specifically so that delivery addresses and similar values never enter it.

3. What we do not store

Payment information. Hello Beta places orders for cash on delivery only. We do not take, process, or store any card number, bank detail, UPI identifier, or other payment instrument. There is no payment screen in the product.

Delivery addresses. We do not keep addresses. While a call is open, the record for that call can carry a short address label so the screen can show which address the order is going to. That is cleared when the call ends. Your address lives in your Swiggy account, not in ours.

Voice recordings. Speech is streamed to a recognition provider and converted to text during the call. We do not write audio to our own storage, and the provider is configured not to retain it or train on it. See section 6.

Advertising and profiling. We do not sell information, we do not share it for advertising, we do not build advertising profiles, and we run no advertising or analytics trackers of any kind.

4. Linked Swiggy accounts

Connecting a Swiggy account uses OAuth 2.1 with PKCE. You authorise on Swiggy’s own consent page, using your phone number and a one-time password. Your Swiggy password and that one-time password go to Swiggy, never to us. We never see either.

What comes back is an access token for your account. We use it only to do what you asked Hello Beta to do: look up items, build a basket, and place an order you have confirmed out loud.

• There is one row per household, replaced whole each time you link again. We keep no history of old tokens, because an expired credential is not evidence of anything and is only a liability.
• There are no refresh tokens. Swiggy’s current API does not issue them. The access token expires about five days after it is issued, and the connection then has to be authorised again. We cannot silently keep access alive.
• The table has row-level security enabled with no read policy of any kind, so it is reachable only by a server-side service role. The public key shipped inside our apps cannot read it.
• Tokens are never written to logs, and they leave our server only in requests to Swiggy.

Revoking access. Either of these is sufficient, and you do not have to tell us first:

1. Revoke Hello Beta from Swiggy’s own connected-applications settings. That invalidates our token immediately.
2. Write to contact@hellobeta.co and ask us to disconnect. We will delete the stored token within 30 days and confirm by email when it is done.

5. Deletion

Write to contact@hellobeta.co and ask for deletion. We will delete the household record within 30 days and confirm by email when it is done. Deleting the household removes everything attached to it in the same operation: every call record and basket, the diagnostic log for those calls, any in-flight authorisation, and the stored access token. That is enforced by the database, not by us remembering to tidy up.

There is no charge and we will not ask you why.

6. Who else processes this

We do not sell information and we do not share it with anyone for their own purposes. It is handled by three service providers, who process it on our instructions in order to run the product:

• Sarvam AI, which converts spoken audio into text and speech back again. Audio retention and model training are both switched off on our account, so Sarvam does not keep the audio after converting it and does not use anything said to Hello Beta as training data.
• Supabase, which hosts the Postgres database described above. The project is in the ap-south-1 region, so this data is stored in India.
• Cloudflare, which serves this website.

If you link a Swiggy account, Swiggy necessarily receives the orders we place on your behalf, under their own terms and privacy policy.

Beyond these, information is disclosed only where we are required to do so by law.

7. This website

This website is a set of static pages. It sets no cookies, runs no analytics, embeds no third-party scripts, and loads no third-party fonts or assets. It does not attempt to identify you. Cloudflare, which serves the site, processes standard request information such as IP address in the ordinary course of delivering the page and defending against abuse.

8. Children

Hello Beta is not intended for use by children, and we do not knowingly collect information from children.

9. Changes

If we change what the system does with information, we will change this page and the date at the top of it.

10. Contact

contact@hellobeta.co
Mohit Shukla, Hyderabad, India