What we collect, exactly why, how long we keep it, and the rights the DPDP Act 2023 gives you. The short version: we collect the minimum for the step you are on, every consent expires, and we sell nothing.
Vriksha AI Technologies Private Limited is the data fiduciary for personal data processed on Dvaram, under the Digital Personal Data Protection Act 2023 and the Information Technology rules that apply to us. The rule we hold ourselves to is stricter than the law's minimum: every collection states its purpose, every consent expires, and nothing is pre-ticked, anywhere, ever.
| Data | Why | When |
|---|---|---|
| Email address, mobile number and OTP verification | To verify both contact details and create your account. Both email and mobile verification are required. | At signup |
| Documents you upload or import (loan letters, policies, statements) | To run the check you asked for. Each imported document takes its own tick. | When you run a check |
| Gmail invitations you review | Your connected sender address, selected recipients, exact message, referral link, approval and per-recipient sending outcome. Gmail sending permission is separate from document access. We do not import your contacts for this flow. | Only when you connect Gmail for invitations and review a message |
| Referral community profile | Your chosen city and state select local rankings. Publishing your first name and location is a separate choice, off by default. Rankings count qualifying paid subscriptions. | When you save a location or choose to publish your profile |
| Consent records (the Ticks) | The verbatim text you agreed to, where and in which language — our proof and yours. | At every grant, decline and revocation |
| Call recordings | So you can hear what a caller actually said, and so a dispute can be settled on the record. This is not a tick you can decline: the Gatekeeper tells the caller the call is recorded in its opening line, before it asks them anything. | Every call your Gatekeeper screens and every AI advisor call, always |
| Scrambled numbers of the contacts you pick (People you know) | So the Gatekeeper recognises a caller you know and connects, asks or screens them as you chose. It never uploads your contacts: only a scrambled form of each number you pick, and the name your phone gave it, is kept under your account. Delete them any time. | Only when you choose contacts on your phone |
| De-identified product analytics | To understand the journey and improve completion. Events use random device/session identifiers and exclude names, contact details, PAN, income, bureau data, document contents, balances, messages, audio and transcripts. Off by default. | Only after you allow analytics cookies |
| Live voice-advisor audio and transcript | To answer the financial question you actively ask in the Advisor section. The session begins after a separate microphone consent and uses a short-lived connection credential. | Only while you actively run the voice advisor |
| Policy document and extracted policy brief | To explain the policy you deliberately upload and ground the text or voice questions you ask about it. | Only after a separate one-time policy-analysis consent |
Consent on Dvaram is a stored record, not a checkbox: each grant names its channel, its purpose in one plain sentence, its frequency cap and its expiry date, and stores the exact wording you saw, the page you were on and the language it was in. You can read every live grant at any time, and revoke any of them — revocation works even when you are logged out, takes effect immediately, and generates its own dated record.
Withdrawal is as easy as the grant. Nothing in the product is withheld because you declined or revoked a contact permission.
One thing is deliberately not a tick: the recording of a call your Gatekeeper screens. It comes with the gate rather than as a choice inside it, because a screening record either party could switch off would settle nothing. So we disclose it instead of offering it — to you before you switch the gate on, and to the caller in the first line they hear. Section 5 says how long we keep it.
Your data page at /account/data shows what we hold about you, per purpose. Signed-in members delete their account from the app itself: once a one-time code is confirmed the erase runs immediately — call forwarding to Dvaram must be switched off on every screened line first — and it issues a deletion receipt whose status anyone can check at /account/data?receipt=… without logging in. Consent records are kept with identifiers removed for the periods listed above. Requests made while logged out go by email to the grievance inbox and are answered within 30 days.
| Data class | Retention |
|---|---|
| Gmail invitation content and sending attempts | Removed by a scheduled sweep after 30 days; the window runs from the latest sending attempt where one exists. Closing your account removes invitation content immediately. A message already accepted by Gmail cannot be recalled by Dvaram. |
| Uploaded and imported documents | For as long as needed to provide the check you requested, or until you delete them or close your account, subject to records we must retain by law |
| Gmail invitation consent decisions | 7 years from the recorded decision; account deletion removes the member identifier. These records contain the consent notice and decision, not recipient messages. |
| Other consent records | 7 years past account closure — they are your proof as much as ours |
| Call recordings | 30 days from the call, then the audio is deleted by a scheduled sweep whether or not you ask; you can delete one sooner from your data page |
| Call and chat transcripts and summaries | Until you delete them or close your account; the underlying call and message logs are PII-redacted at 2 years |
| Analytics events | Pseudonymous by design and retained only under the published analytics-retention schedule; never joined to documents, voice, transcripts, PAN, income or bureau information |
| Live interpreter media | Processed during the session; Dvaram does not add the audio or transcript to journey analytics or save it as an advisor record unless you separately choose to do so |
| One-time policy analysis | The original file is sent inline for analysis and is not retained by Dvaram in this browser flow; the extracted brief and chat remain only in the open page and are cleared when you remove them or leave/reload the page |
Dvaram does not send your information to a bank, NBFC, lender, insurer or credit bureau to obtain an offer, start an application or make an eligibility decision. Data is shared only with processors that run Dvaram under contract and on our instructions, when you expressly choose to export or send information yourself, or with authorities where the law compels it. Personal data is stored in India.
If you connect a Google account, Dvaram reads only what you granted: Gmail to find financial documents you asked us to fetch, and Calendar free/busy so a call lands when you are free. We can see that you are busy. We cannot see why — no event titles, no attendees, no locations.
Dvaram's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: Google user data is used only to provide and improve the features you connected it for; it is never sold; it is never used for advertising; it is not transferred to others except as needed to provide those features, to comply with law, or as part of a merger with prior notice; and no human reads it except with your explicit consent, to resolve a support issue you raised, or where the law requires.
Documents fetched from Gmail are processed and deleted; nothing is retained without a tick on that specific document. Disconnect either connection at any time from your Ticks, and the access token is revoked.
When you deliberately upload a policy in the Advisor section, the original PDF or image is sent inline over an encrypted connection to Google Gemini for one-time extraction. Dvaram receives a bounded brief of policy facts, findings and page/clause references. In this browser flow, Dvaram does not persist the original file, extracted brief or policy chat. The brief may be sent with the text or live-voice questions you deliberately ask, so the answer can stay grounded in your policy. AI extraction can be wrong; the policy wording remains authoritative.
When you deliberately start the voice advisor, audio and the policy brief shown on screen (if one is attached) are sent over an encrypted live connection to Google Gemini to return spoken audio and captions. Dvaram's server issues a short-lived, feature-limited credential; the Gemini API key is never placed in the app. You can stop the session at any time, which closes the microphone and connection. Dvaram AI explains a user-supplied document; it does not recommend, sell or renew insurance and cannot place a transaction.
Our parent company publishes group-level policies at vriksha.ai. For anything that happens on Dvaram surfaces, this policy governs; where this policy is silent, the group privacy policy applies.
Material changes to this policy are announced on this page with a new effective date. Questions about personal data go to privacy@dvaram.app; grievances to grievance@dvaram.app. The registered office is at Flat C1-123, Gottigere Main Road, Chikka Kammanahalli, Bannerghatta, Bangalore South, Karnataka 560083.
Vriksha AI Technologies Private Limited · Registered office: Flat C1-123, Gottigere Main Road, Chikka Kammanahalli, Bannerghatta, Bangalore South, Karnataka 560083 · Business address: Building No. 46, 1st Floor, 12th Main Road, behind HSR BDA Complex, Sector 6, HSR Layout, Bengaluru, Karnataka 560102 · Questions to support@dvaram.app · Grievances to grievance@dvaram.app · See all policies at dvaram.app/legal