Privacy Policy

Who we are and what this covers

Vavy Works LLP (“Vavy Works”, “we”, “us”) is a limited liability partnership registered in India. This policy explains how we collect, use, share and protect personal data when you visit vavyworks.com, or use any web, mobile or desktop application, API or other online product that we publish and that links to this policy (together, the “Services”).

For the Services, Vavy Works is the data fiduciary under India’s Digital Personal Data Protection Act, 2023, and the controller under the EU and UK General Data Protection Regulation. Our registered office is:

Client engagements are different. When we build or run software for a client and handle personal data inside that client’s systems, we act on the client’s instructions as their processor, under a written agreement with them. In that case the client’s privacy policy applies, and you should direct questions to the client.

Information we collect

Information you give us

• Account details: your name, email address and password (stored only as a salted hash), or the profile details Google provides if you sign in with Google.
• Content you create: text, files, settings and anything else you enter into or upload to a Service.
• Messages: what you send us by email or through a support or contact form, including your contact details and any attachments.
• Billing details: your billing name, address, country and tax identifier, if you buy something. Card details go directly to our payment processor, Stripe, and never reach our servers (see Payments).

Information collected automatically

• Log and device data: IP address, browser and operating system, device type, the pages or endpoints requested, referring page, timestamps and error reports. Our servers and hosting providers record this to keep the Services running and secure.
• Cookies and similar technologies: described in our Cookie Policy. We do not use advertising cookies or cross-site tracking.

Information from other sources

• Google, when you choose to sign in with Google or connect your Google account (see Google user data).
• Stripe, which tells us whether a payment succeeded and gives us limited details such as the card brand, the last four digits, the expiry month and the billing country.

Google user data

Some of our apps let you sign in with Google or connect your Google account. Google first shows you a consent screen that lists exactly what the app is asking for, and nothing is shared with us until you approve it.

What we access

• Google Sign-In (the openid, email and profile scopes): your name, email address, profile picture, and a Google account identifier.
• Additional Google data: an app only requests further access, such as to Google Calendar or Google Drive, when you turn on a feature that needs it. The consent screen names the specific access, and the app explains on the screen where you enable the feature what it reads or changes and why. We request the narrowest access the feature needs.

How we use it

• To create your account, sign you in, and show your name and picture inside the app.
• To send you messages about your account, such as security notices and receipts.
• To provide the user-facing feature you turned on, and for nothing else.

What we never do with it

• We do not sell Google user data.
• We do not use it, or transfer it, for advertising, including personalised or retargeted ads.
• We do not use it to determine creditworthiness or for lending.
• We do not use it to develop, improve or train generalised or non-personalised AI or machine-learning models.
• Our staff do not read it unless you ask us to (for example, to help with a support request), it is needed to investigate security or abuse, it is required by law, or it has been aggregated and anonymised for internal operations.

Sharing, storage and deletion

We share Google user data only with the service providers who host and run the app for us, under contracts that limit them to that purpose, or where the law requires it. It is encrypted in transit (TLS) and at rest, and OAuth access tokens are stored encrypted. When you delete your account we delete your Google user data within 30 days. You can also remove an app’s access at any time at myaccount.google.com/permissions.

Limited Use

Vavy Works’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information

We use personal data only for the purposes below. Where the GDPR applies, the legal basis for each purpose is given in brackets.

• To provide the Services: creating and running your account, storing your content and delivering the features you use (performance of a contract).
• To take payments: processing purchases and subscriptions, issuing invoices and handling refunds (performance of a contract; legal obligation for tax records).
• To support you: answering your questions and requests (performance of a contract; legitimate interests).
• To keep the Services secure: detecting and preventing fraud, abuse and security incidents, and debugging errors (legitimate interests).
• To improve the Services: understanding which features are used and where they fail, using logs and aggregated usage data (legitimate interests). This never includes Google user data beyond what the Limited Use requirements allow.
• To communicate with you: service and account messages. We send marketing email only if you opt in, and every such email has an unsubscribe link (consent).
• To meet legal obligations: tax, accounting, and responding to lawful requests (legal obligation).

Under India’s Digital Personal Data Protection Act, we process your personal data on the basis of the consent you give when you create an account or contact us, or for the legitimate uses the Act allows. You can withdraw consent at any time (see Your rights). Doing so does not affect processing that already took place, but we may no longer be able to provide a Service that depends on it.

AI features

Some Services include features powered by AI models. When you use one of these features, the content you submit for it may be sent to an AI model provider (for example, Anthropic, OpenAI or Google) to generate the response. We use these providers under business terms that prohibit them from training their models on your content, and we send only what the feature needs.

We do not use your content, or any Google user data, to train generalised AI models.

Payments

Payments are processed by Stripe. When you pay, you enter your card or other payment details into a form hosted by Stripe, and they go directly to Stripe. We never see or store your full card number or security code.

Stripe processes your payment data as an independent controller, to process the payment and to prevent fraud, in line with the Stripe Privacy Policy. If you buy through the Apple App Store or Google Play instead, that store processes the payment under its own privacy policy.

How we share information

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share it only as follows:

• Service providers who process data on our behalf and under our instructions: cloud hosting and databases, email delivery, error monitoring, customer support tools, AI model providers (for AI features) and Stripe (for payments). Each is bound by a contract that limits their use of the data to providing their service to us.
• Legal requirements: where we are required to by law, court order or a lawful request from a government authority, or where disclosure is necessary to protect the rights, property or safety of our users, the public or Vavy Works.
• Business transfers: if Vavy Works or a Service is merged, acquired or sold, personal data may transfer to the new owner, who must keep honouring this policy. We will notify you before your data becomes subject to a different policy.
• With your consent: in any other case, only when you have asked us to or agreed.

International transfers

We are based in India and some of our service providers operate in other countries, including the United States and the European Union. Your data may therefore be processed outside the country where you live.

Where we transfer personal data out of the EEA, the UK or Switzerland, we rely on an adequacy decision or on the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), together with appropriate security measures. Transfers of data collected under Indian law follow any restrictions the Government of India places on transfers to particular countries.

How long we keep data

• Account data and content: for as long as your account is open. After you delete your account we delete it within 30 days, except that encrypted backups roll off within a further 90 days.
• Billing and tax records: for as long as Indian tax and accounting law requires, currently up to eight years.
• Server logs: normally 90 days, or longer when needed to investigate a specific security incident.
• Emails and enquiries: for as long as the conversation is active and a reasonable period afterwards, normally no more than three years.

If an account stays inactive for a long period we may delete it after notifying you by email and giving you time to respond.

Security

We protect personal data with encryption in transit (TLS) and at rest, access controls based on least privilege, multi-factor authentication for staff accounts, and logging of administrative access. Our security practices are designed to meet the reasonable security practices required under India’s Information Technology Act, 2000 and the rules made under it.

No system is perfectly secure. If a personal data breach affects you, we will notify you and the relevant authorities as the law requires, including the Data Protection Board of India and CERT-In.

Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct, complete or update it;
• delete it;
• stop sending you marketing, or withdraw a consent you gave.

India

Under the Digital Personal Data Protection Act, 2023, you also have the right to grievance redressal and the right to nominate another person to exercise your rights if you die or become incapable. If you are not satisfied with how we handle a grievance, you may complain to the Data Protection Board of India.

EEA, UK and Switzerland

You also have the right to data portability, to object to processing based on legitimate interests, and to ask us to restrict processing. You may complain to your local data protection authority, although we would appreciate the chance to resolve the issue first.

California and other US states

You have the right to know, correct and delete your personal information, and not to be discriminated against for using these rights. We do not sell or share personal information as those terms are defined in the CCPA and similar state laws, and we do not use sensitive personal information for purposes that would require an opt-out.

How to make a request

Email hello@vavyworks.com with the subject “Privacy request”, from the email address linked to your account if you have one. We may ask for further information to confirm your identity. We answer within 30 days, and sooner where the law requires it.

Deleting your account

You can delete your account from the account settings in each app, where that option is available. You can also email hello@vavyworks.com from the address linked to your account and ask us to delete it. We confirm by email once deletion is complete. Retention after deletion is described under How long we keep data.

Children

The Services are not directed to children, and you must be at least 18 years old, or the age of majority where you live, to create an account. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email hello@vavyworks.com and we will delete it.

Changes to this policy

We may update this policy as our Services or the law change. The date at the top shows when it was last updated. If we make a material change, we will tell you by email or through a notice in the Services before the change takes effect.

Contact and Grievance Officer

For any privacy question, request or complaint, contact our Grievance Officer, who is also our point of contact for data protection matters:

We acknowledge grievances within 48 hours and aim to resolve them within 30 days.