Privacy Policy

Your account. When you sign up, with Google or with an email address and password, we receive your email address and whether it has been confirmed. If you sign in with Google, we also receive the basic profile information Google provides. If you sign in with your mobile number, we receive that number instead, confirmed by a one-time SMS code. All of this is handled by Firebase Authentication, a Google service.

Your email address or mobile number is held by Firebase. It is not stored in our own database. Everything we store about you is keyed to an anonymous Firebase user ID instead.

What you tell the assistant. Your messages, and the replies you receive, are stored so your conversations are still there when you come back. If you ask for a report, the report is stored with the conversation, along with the details you confirmed before it ran. We also look at the language your last message was written in, so the report can be written in it; that is worked out from the text and not stored separately.

Your business profile. When you tell the assistant about your business, we save those details so you do not have to repeat them. This can include your state and city, the type of entity, your sector, how long you have been operating, your annual turnover, how many people you employ, your credit score band, whether you have collateral, and which registrations you hold.

This is commercially sensitive information about your business. We treat it that way. We do not sell it, and we do not use it to build advertising profiles.

Ideas you have shortlisted. If you use the idea-discovery feature, the ideas it produces are saved so you can return to them, and they stay saved even if you delete the conversation that produced them.

Your task list. Tasks you add, or accept from a report, are saved against the business they belong to, with any due dates, and are deleted with that business.

Usage records. We log which actions you take and when (a chat message, a funding report), so we can apply your plan's limits and detect abuse. These records contain your user ID, the type of action, the plan you were on, a timestamp, and whether the action was refunded because it failed. They do not contain what you wrote.

Payments. If you buy Pro, Razorpay processes the payment. We receive and keep the Razorpay payment, order and subscription identifiers, the amount, the plan, and whether each payment succeeded or was refunded, linked to your account. We never receive or store your card number, UPI ID or bank details. We keep payment records for as long as the law requires us to keep accounts.

Public tools. Some parts of the site work without an account. For market snapshots, we record the city and business type requested, and a one-way cryptographic hash of your IP address. We use the hash to stop one visitor from consuming the service's capacity. We do not store your actual IP address in that record, and the hash cannot be reversed back into it.

The scheme check and filing calendar send what you enter to our server, which works out the answer and sends it back; none of it is stored. The GST invoice maker runs entirely in your browser: nothing you type into it is sent to us. The invoice maker's business details and running invoice number, and the ticks on the registration checklists, are kept only in your own browser's storage, on your device.

This is the part most policies skip, and it is the part you should actually know.

Your messages are sent to Google. Vyavsay AI runs on Google's Gemini models through Google Cloud Vertex AI. When you send a message, that message, together with relevant history and the business profile facts the assistant needs, is transmitted to Vertex AI to generate a reply. The same applies when a report is produced.

Some of your information reaches Google Search. Reports are researched against live sources. To do that, search queries derived from what you have told us (for example your city, your sector, and what you are trying to fund) are sent to Google Search. Those queries are shaped by your inputs.

We do not use your data to train AI models, and we do not permit our providers to use it to train theirs under the terms on which we use Vertex AI.

If there is something you would not want processed this way, do not put it into the chat.

We use a small number of service providers. We do not sell your information to anyone, and we do not share it with advertisers.

• Google Cloud Platform: our application servers, and Vertex AI model processing.
• Neon (on Amazon Web Services): our database, which holds your conversations, reports, business details, tasks, ideas, usage records and payment records.
• Firebase (Google): account creation, sign-in, email confirmation and SMS codes, and the hosting that serves the website.
• Cloudflare: the network in front of the website. Every request to vyavsay.ai passes through it, which protects the site from attacks; it does not store the content of your requests.
• Google Search: the live sources behind researched reports, as described above.
• Sanity: the content system behind our blog. It holds no information about you.
• Google Analytics: to understand how the site is used. See Cookies below.
• Razorpay: if you buy Pro, to take the payment. Razorpay collects your payment details and contact information directly, under its own privacy policy.

We may also disclose information where we are legally required to, or where it is necessary to protect the safety or rights of our users or ourselves.

Some of your information is stored and processed outside India. Specifically:

• Our application servers run in Google Cloud's Mumbai region, in India.
• Our database is hosted by Neon on Amazon Web Services in Singapore. Your conversations, reports and business details are stored there.
• Researched reports are generated by Google's models in the Mumbai region.
• Chat replies are generated by Google's models through Google's global service, which may process your messages in data centres outside India.
• Sign-in (Firebase Authentication) and analytics run on Google's global infrastructure.

These transfers are permitted under the Digital Personal Data Protection Act, 2023. By using the service you agree to them. If any of these locations changes, we will update this list.

We keep your conversations, business profiles, and saved ideas for as long as your account exists, because the service is built around remembering them.

You can delete individual conversations and individual business profiles yourself, from within the app, at any time. When you do, they are removed from our database.

Deleting your entire account and everything associated with it is not yet possible from within the app. Until it is, write to us at the address below and we will do it for you.

Usage records are kept while your account exists, to apply your plan's limits and detect abuse, and are deleted with it. They are not linked to the content of what you wrote.

Payment records are the exception: if you have paid for Pro, the record of each payment is kept for as long as the law requires businesses to keep accounts, even after the rest of your account is deleted. A paid subscription should be stopped before you ask us to delete your account.

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

• Know what personal data we hold about you and who we have shared it with.
• Correct anything inaccurate, incomplete, or out of date.
• Erase your personal data where we no longer need it for the purpose it was collected.
• Withdraw consent at any time. Withdrawing it will usually mean you can no longer use the service, since the service cannot function without processing what you tell it.
• Nominate someone to exercise these rights on your behalf if you die or become incapacitated.
• Complain to us, and to the Data Protection Board of India if we do not resolve it.

To exercise any of these, write to our Grievance Officer at the address below. We will respond within the time the law requires.

We use cookies and browser storage for these things:

Keeping you signed in. Firebase Authentication stores a token in your browser so you are not asked to sign in on every page. Without it, the service cannot work.

Understanding usage. Google Analytics sets cookies to measure things like which pages are visited and where people stop. This tells us what to improve. You can block these through your browser settings without losing access to the service.

Remembering things on your device. Your theme choice, the invoice maker's business details and invoice number, and the ticks on the registration checklists are kept in your browser's own storage. They never leave your device, and clearing your browser's site data removes them.

Paying. When you open Razorpay's payment window, Razorpay may set its own cookies, which it uses to process the payment and prevent fraud.

We do not use advertising cookies and we do not track you across other websites.

Vyavsay AI is intended for people running or planning a business, and is not directed at anyone under 18. We do not knowingly collect information from children. We do not use anyone's information for behavioural advertising or tracking. If you believe a child has given us information, tell us and we will delete it.

Access to your account requires a confirmed email address or a verified mobile number. Traffic between your browser and our servers is encrypted, our backend services are not publicly reachable and accept requests only from our own frontend, and every request for your data is verified against a signed authentication token before anything is returned. Payment notifications from Razorpay are accepted only with a valid cryptographic signature.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the Data Protection Board as required by law.

If we change how we handle your information, we will update this page and change the date at the top. If the change is significant, we will tell you in the app before it takes effect.

For any question about this policy, or to exercise any of the rights above:

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

If you would like this policy in Hindi, or in any other language listed in the Eighth Schedule to the Constitution of India, write to us and we will provide it.