Data Protection Policy

1. Who this covers, and who is responsible

This policy applies to every system that stores or processes Dvaram member or brand data: the gateway, the engine and its workers, the messaging service, the web app and the native apps, and the processors named in the Privacy Policy. Hosting is Vercel and AWS in the Mumbai region (ap-south-1).

Vriksha AI Technologies Private Limited is the data fiduciary. Engineering owns the technical controls; the Data Protection Officer owns the register and handles your rights requests; a release does not ship without the founder signing its gate.

A Data Protection Officer is to be appointed; until then the founder's office carries the role, and the grievance route below reaches it.

2. What we hold, and how each class is handled

3. Isolation and access

Every table that carries member data has row-level security enabled and forced, keyed to the organisation that owns the row; engine routes run inside a tenant transaction. A read that crosses tenants is possible only through an administrative client, with a named reason recorded in code review.

Production access is by named identities with multi-factor authentication. There are no shared credentials. Secrets live in AWS Secrets Manager and SSM — never in a repository, never in chat. Access is reviewed quarterly and the review is recorded.

4. Minimisation rules that are enforced in code, not promised in prose

• The Android app does not request SMS, contacts, call-log or direct-call permissions. A build that adds one fails the release check.
• The only Gmail scope we ask for is read-only. The consent lane parses signup, receipt and newsletter mail and discards the bodies.
• Every brand-facing response is tested for identifier patterns (phone numbers, email addresses) before it can ship.
• Analytics events pass a property sanitiser that blocks phone numbers, email addresses, names, amounts and message content.

5. How long we keep things

The full table is in the Privacy Policy. The technical sweeps that enforce it: recordings 30 days, raw inbound mail 7 days, push tokens cleared on logout, document checks removed when you delete your account, consent evidence 7 years with identifiers scrubbed, financial records 8 years, logs 180 days, grievance records 3 years.

6. Your rights, and how each one is answered

• Access and export: from your data page, or by email; 30 days at the outside, usually immediate.
• Correction: in the app.
• Erasure: in the app, immediate, gated only on turning call forwarding off first so your calls are not stranded. The receipt is public and carries no name.
• Nomination: a field on your profile.
• Withdrawal of consent: one tap, or an email — no login required.
• Requests by email go to privacy@dvaram.app and are logged with the time they were answered.

7. Processors

Every processor is under a contract that names the purpose, the location, its own sub-processors, and deletion on termination. The register is kept by the Data Protection Officer; a change to it bumps the version of the privacy notice, so you are told.

8. If there is a breach

Detect (alerts on isolation-bypass attempts, unusual export volume, secret access), contain, assess, notify the Data Protection Board and the affected members within the period the DPDP Rules set, and record what happened. The response is drilled twice a year, the first drill before launch.

9. Privacy by design, as release gates

• Every new model that holds member data needs a deletion disposition before it can ship — a drift test fails the build otherwise.
• Every new consent surface needs a notice version and a mapping to the proof fields of the Tick Standard.
• Every new brand-facing endpoint needs the identifier test.

10. Contact

Data protection questions and rights requests: privacy@dvaram.app. Grievances: grievance@dvaram.app — the route and the timelines are on the Grievance Redressal page.