Privacy Policy

Your account. When you sign up — with Google or with an email address and password — we receive your email address and whether it has been confirmed. If you sign in with Google, we also receive the basic profile information Google provides. This is handled by Firebase Authentication, a Google service.

Your email address is held by Firebase. It is not stored in our own database. Everything we store about you is keyed to an anonymous Firebase user ID, not to your email.

What you tell the assistant. Your messages, and the replies you receive, are stored so your conversations are still there when you come back. If you ask for a report, the report is stored with the conversation.

Your business profile. When you tell the assistant about your business, we save those details so you do not have to repeat them. This can include your state and city, the type of entity, your sector, how long you have been operating, your annual turnover, how many people you employ, your credit score band, whether you have collateral, and which registrations you hold.

This is commercially sensitive information about your business. We treat it that way. We do not sell it, and we do not use it to build advertising profiles.

Ideas you have shortlisted. If you use the idea-discovery feature, the ideas it produces are saved so you can return to them, and they stay saved even if you delete the conversation that produced them.

Usage records. We log which actions you take and when — a chat message, a funding report — so we can apply fair-use limits and detect abuse. These records contain your user ID, the type of action, and a timestamp. They do not contain what you wrote.

Public tools. Some parts of the site, such as city and market reports, work without an account. For these we record the city and business type requested, and a one-way cryptographic hash of your IP address. We use the hash to stop one visitor from consuming the service's capacity. We do not store your actual IP address in that record, and the hash cannot be reversed back into it.

This is the part most policies skip, and it is the part you should actually know.

Your messages are sent to Google. Vyavsay AI runs on Google's Gemini models through Google Cloud Vertex AI. When you send a message, that message — together with relevant history and the business profile facts the assistant needs — is transmitted to Vertex AI to generate a reply. The same applies when a report is produced.

Some of your information reaches Google Search. Reports are researched against live sources. To do that, search queries derived from what you have told us — for example your city, your sector, and what you are trying to fund — are sent to Google Search. Those queries are shaped by your inputs.

We do not use your data to train AI models, and we do not permit our providers to use it to train theirs under the terms on which we use Vertex AI.

If there is something you would not want processed this way, do not put it into the chat.

We use a small number of service providers. We do not sell your information to anyone, and we do not share it with advertisers.

• Google Cloud Platform — hosting, our database, and Vertex AI model processing.
• Firebase (Google) — account creation, sign-in, and email confirmation.
• Google Search — the live sources behind researched reports, as described above.
• Sanity — the content system behind our blog. It holds no information about you.
• Google Analytics — if enabled, to understand how the site is used. See Cookies below.

We may also disclose information where we are legally required to, or where it is necessary to protect the safety or rights of our users or ourselves.

Our database and application run on Google Cloud infrastructure. Depending on the region configured for the service, your information may be processed and stored outside India, on infrastructure operated by Google. By using the service you agree to that transfer.

We keep your conversations, business profiles, and saved ideas for as long as your account exists, because the service is built around remembering them.

You can delete individual conversations and individual business profiles yourself, from within the app, at any time. When you do, they are removed from our database.

Deleting your entire account and everything associated with it is not yet possible from within the app. Until it is, write to us at the address below and we will do it for you.

Usage records are kept for a limited period for abuse prevention and are not linked to the content of what you wrote.

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

• Know what personal data we hold about you and who we have shared it with.
• Correct anything inaccurate, incomplete, or out of date.
• Erase your personal data where we no longer need it for the purpose it was collected.
• Withdraw consent at any time. Withdrawing it will usually mean you can no longer use the service, since the service cannot function without processing what you tell it.
• Nominate someone to exercise these rights on your behalf if you die or become incapacitated.
• Complain to us, and to the Data Protection Board of India if we do not resolve it.

To exercise any of these, write to our Grievance Officer at the address below. We will respond within the time the law requires.

We use cookies and browser storage for two things:

Keeping you signed in. Firebase Authentication stores a token in your browser so you are not asked to sign in on every page. Without it, the service cannot work.

Understanding usage. If Google Analytics is enabled on this site, it sets cookies to measure things like which pages are visited and where people stop. This tells us what to improve. You can block these through your browser settings without losing access to the service.

We do not use advertising cookies and we do not track you across other websites.

Vyavsay AI is intended for people running or planning a business, and is not directed at anyone under 18. We do not knowingly collect information from children. We do not use anyone's information for behavioural advertising or tracking. If you believe a child has given us information, tell us and we will delete it.

Access to the service requires a confirmed email address. Traffic between your browser and our servers is encrypted, our backend services are not publicly reachable and accept requests only from our own frontend, and every request is verified against a signed authentication token before any data is returned.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the Data Protection Board as required by law.

If we change how we handle your information, we will update this page and change the date at the top. If the change is significant, we will tell you in the app before it takes effect.

For any question about this policy, or to exercise any of the rights above:

If you are not satisfied with our response, you may complain to the Data Protection Board of India.