TomDum ("we", "us", or "our") operates tomdum.com, a local business discovery and review platform for Kathmandu Valley, Nepal. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information. By using TomDum you agree to this policy.
1. Information We Collect
Account information
When you create an account we collect your name and email address. Phone number is optional. You may also upload a profile photo and write a short bio.
Content you create
We store the reviews, star ratings, posts, and photos you submit through the platform.
Business claim information
If you claim a business listing, we collect the information you submit in the claim form — business name, address, phone, WhatsApp, website, description, category, tags, and photos.
Authentication
We use one-time passwords (OTP) sent to your email to verify your identity. We also support login with a password. We plan to offer Google and Facebook sign-in; when you use these services we receive your name, email address, and profile picture from those providers.
Usage data
We may log standard server information such as your IP address, browser type, and the pages you visit, solely for security and debugging purposes. We do not use third-party analytics trackers.
2. How We Use Your Information
- To create and manage your account
- To send you OTP and password reset emails via Gmail (transactional only — no marketing without consent)
- To display your reviews, posts, and profile publicly on the platform
- To process and review business claim submissions
- To generate AI-powered summaries of businesses using local AI (Ollama — your data does not leave our server)
- To improve the platform and diagnose technical issues
- To enforce our Terms of Service and prevent abuse
3. Google API Services
TomDum uses Google Sign-In (OAuth 2.0) to allow users to log in with their Google account. When you choose to sign in with Google, we receive your name, email address, and profile picture. We do not access your Google Drive, Gmail, Contacts, or any other Google services beyond the basic profile information needed to create your account.
TomDum's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell, share, or use your Google data for advertising or any purpose beyond providing and improving the TomDum service.
4. Cookies and Local Storage
We use a single session cookie (td_session) to keep you logged in. This cookie contains a signed JSON Web Token (JWT) and does not store personal information directly. We do not use advertising cookies or third-party tracking cookies.
5. Sharing of Information
We do not sell your personal information. We do not share it with third parties except:
- Publicly by design — reviews, posts, and profile information you submit are visible to other users on the platform. Business claim information is visible to TomDum administrators only until approved.
- Email delivery — we use Gmail SMTP to send you OTP and system emails. Your email address is transmitted to Google's mail servers for delivery only.
- Legal requirements — we may disclose information if required by Nepalese law or to protect the safety of users or the public.
6. Data Storage and Security
Your data is stored on servers located in our hosting environment. We use industry-standard practices including encrypted passwords (bcrypt), signed authentication tokens (JWT), and HTTPS encryption for all data in transit. Uploaded photos are stored on our server filesystem.
No method of transmission over the internet is 100% secure. We take reasonable steps to protect your data but cannot guarantee absolute security.
7. AI-Generated Content
TomDum generates AI summaries of businesses using publicly submitted reviews. This processing happens entirely on our own server using a locally hosted AI model (Ollama). Your review text may be included in this analysis. No personal data is sent to external AI providers.
8. Data Retention
We retain your account information and content for as long as your account is active. If you request account deletion, we will remove your personal information within 30 days, except where retention is required by law or for legitimate business purposes (such as preserving aggregate review data).
9. Your Rights
You have the right to:
- Access the personal information we hold about you
- Correct inaccurate information via your profile settings
- Request deletion of your account and associated personal data
- Withdraw consent at any time (this will not affect processing already done)
To exercise any of these rights, contact us at [email protected].
10. Children's Privacy
TomDum is not directed at children under 13 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of TomDum after changes are posted constitutes your acceptance of the revised policy.
12. Contact Us
If you have questions about this Privacy Policy or how we handle your data, please contact us: