Compliance Statement

1Scope of this statement

This statement sets out how we comply with:

• The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (the "IT Rules")
• The Information Technology Act, 2000, including Sections 43A, 72A and 79
• The Digital Personal Data Protection Act, 2023 (the "DPDP Act")
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011

It summarises obligations that are set out in full in our Privacy Policy, Terms of Use, Community Guidelines and Content Moderation Policy. Where this statement and those documents differ, those documents apply.

2Our status as an intermediary

We operate as an intermediary and specifically as a social media intermediary, within the meaning of the IT Act and the IT Rules. Our function is limited to enabling one-to-one audio and video conversations between users, together with related features.

• We do not originate the content of a session or select who receives it. We do monitor sessions for safety as described in section 5.
• We observe the due diligence required of an intermediary under Rule 3 and rely on the safe harbour available under Section 79 of the IT Act.

3Publication of policies

Rule 3(1)(a), 3(1)(b) and 3(1)(f)

Our Privacy Policy, Terms of Use, Community Guidelines, Content Moderation Policy, Charges and Refund policy and this statement are published on our website and are reachable inside the app under Profile → Settings.

These documents inform users of what they may not host, display, upload, publish, transmit, store, update or share on the platform.

We inform users, at least once every year and on each occasion a material change is made, of the rules and policies that apply to their use of the app, of any change to them and of the fact that non-compliance may result in removal of the content concerned, suspension or termination of their access and forfeiture of any balance where our Terms of Use so provide. Notice is given through an in-app notification and by SMS or email.

4Content we prohibit

Rule 3(1)(b)

Our Community Guidelines and Terms of Use prohibit users from creating, sharing or transmitting anything that:

• Belongs to another person and to which the user has no right
• Is obscene, pornographic, paedophilic, invasive of another's privacy including bodily privacy, insulting or harassing on the basis of gender or racially or ethnically objectionable
• Is harmful to a child
• Infringes any patent, trademark, copyright or other proprietary right
• Deceives or misleads the addressee about the origin of the message or knowingly and intentionally communicates information that is patently false or misleading but may reasonably be perceived as a fact
• Impersonates another person
• Threatens the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign states or public order; incites the commission of a cognizable offence; prevents the investigation of an offence; or insults another nation
• Contains a software virus or any computer code designed to interrupt, destroy or limit the functionality of a computer resource
• Is in the nature of an online game that is not a permissible online game or is an advertisement or surrogate advertisement for one
• Violates any law for the time being in force

The full list, with the conduct rules that accompany it, is in our Community Guidelines.

5Proactive safety measures

Beyond what the IT Rules require of an intermediary of our size, we apply the following measures voluntarily:

• Real-time automated moderation. Session audio and video are analysed while a session is in progress by an automated safety system operated by a specialist provider. Where a likely violation is detected, the session is ended immediately.
• Zero tolerance on child safety. Any content or conduct that sexualises or harms a child results in immediate permanent removal and is referred to the appropriate authorities.
• No nudity. We operate a strict No Nudity Policy. Sessions containing identifiable nudity are terminated without refund.
• Identity verification. People complete KYC verification under applicable Indian requirements, together with onboarding, before they may host a session.
• Human review. Where an automated flag may lead to action against an account, the material is reviewed by a trained person before that action is taken.

Automated tools have limitations. They are used to support human judgement, not to replace it.

6Grievance redressal

Rule 3(2)

Users may file a complaint in the app, from the in-call menu or from session history or in writing to our Grievance Officer.

We acknowledge a complaint within 24 hours of receiving it. Content exposing a private area, showing full or partial nudity, depicting a sexual act or being in the nature of impersonation including an artificially morphed image is removed within 24 hours of a complaint.

Where we remove content or act against an account on our own initiative, we notify the user concerned, explain the action and the reason for it and give them an opportunity to dispute it.

We will require the mobile number registered to the account in order to locate the relevant records.

7Appealing our decisions

Rule 3A

If you are not satisfied with the decision of our Grievance Officer, you may appeal to a Grievance Appellate Committee constituted by the Central Government under Rule 3A of the IT Rules. An appeal must be made within thirty days of receiving our decision and is filed online through the Committee's digital portal.

This is in addition to and does not replace, any other remedy available to you in law.

For complaints concerning your personal data, you may also complain to the Data Protection Board of India.

8Court and government orders

Rule 3(1)(d)

On receiving actual knowledge, in the form of an order by a court of competent jurisdiction or on being notified by the appropriate government or its authorised agency, that information hosted on the app is being used to commit an unlawful act, we remove or disable access to that information within 36 hours of receiving the order.

Orders should be addressed to our Grievance Officer at the address in section 14 and should identify the information concerned with sufficient particularity to allow us to locate it.

We preserve the information removed and associated records, for the periods set out in our Privacy Policy and as the IT Rules require.

9Assistance to authorities

Rule 3(1)(j)

On receiving a lawful written order from a government agency authorised to make it, we provide the information in our possession or the assistance sought, within 72 hours. Such an order must state the purpose for which the information is sought and the purpose must be one permitted under the Rules - verification of identity or the prevention, detection, investigation or prosecution of an offence or cyber security incidents.

Requests from law enforcement agencies should be directed to our Grievance Officer at the address in section 14.

We do not disclose user information other than under a valid legal request, in an emergency involving a risk to life or safety or as otherwise described in our Privacy Policy.

10Traceability

Rule 4(2)

The requirement to enable identification of the first originator of information applies to significant social media intermediaries providing services primarily in the nature of messaging. We are not a significant social media intermediary and this requirement does not presently apply to us.

We respond to lawful requests for information in our possession as described in section 9.

11Age assurance

The app is for adults. A date of birth is collected before sign-in and an account is not created where the date entered indicates the person is under 18. We may make further enquiries, directly or through third parties, to verify age and may refuse or close an account where we cannot verify it.

We do not knowingly process the personal data of a child. Where we become aware that an account belongs to someone under 18, the account is closed and its data deleted. Behavioural advertising and tracking directed at children are not carried out on this platform.

12Data protection

Digital Personal Data Protection Act, 2023

We are the data fiduciary for the personal data we process about users of the app.

Notice and consent

Our Privacy Policy serves as the notice required under Section 5 of the DPDP Act. It identifies the personal data we collect, the purpose of each category of processing, how rights may be exercised and how a complaint may be made to the Data Protection Board of India. Consent is obtained at registration and may be withdrawn at any time, as easily as it was given.

Purpose limitation and minimisation

We collect only the personal data necessary for the purposes stated in our Privacy Policy and process it only for those purposes. We do not access device contact lists and we do not store payment instrument details.

Rights of data principals

Users may exercise their rights of access, correction, erasure, withdrawal of consent, nomination and grievance redressal. Most of these are available directly in the app under Profile → Settings, including deletion of the account. The remainder are handled by our Grievance Officer.

Processors

Where we engage third parties to process personal data on our behalf - including cloud hosting, calling infrastructure, automated moderation, payment processing and analytics - we do so under contract, with confidentiality and data protection obligations and only for purposes we specify.

Transfers outside India

Personal data may be processed outside India by our service providers. We transfer data only to countries not restricted by the Central Government under Section 16 of the DPDP Act and require contractual protections comparable to those in this statement.

Complaints to the Board

If you are not satisfied with our response to a complaint about your personal data, you may complain to the Data Protection Board of India in the manner prescribed under the DPDP Act.

13Personal data breaches

Where a personal data breach occurs, we assess it without delay and, where the DPDP Act and the rules made under it require, notify the Data Protection Board of India and every affected user.

Notice to users describes, so far as we know it at the time, what happened, the data involved, the steps we are taking and what the user can do to protect themselves. We also maintain an internal incident record for every breach we identify, whether or not it is notifiable.

Where an incident constitutes a cyber security incident reportable to CERT-In, we report it within the timelines those directions require.

14Officer details

Rule 3(2)(a)

Court orders, government notifications and law enforcement requests should be addressed to the Grievance Officer at the address above.

For general support, including questions about your account or a session, write to info@mikuapp.live or report it in the app. Support is available at all times; the Grievance Officer's working hours are as stated above.

15Review of this statement

We review this statement at least once a year and whenever the law or our practices change materially. The date at the top reflects the current version.

Please check this page from time to time so that you know what the current version says.