Privacy Policy

Effective: [TBD — pending legal review] · Operator: [TBD — pending legal review] (a service operated by [TBD — pending legal review], [TBD — pending legal review]).

This Privacy Policy explains how [TBD — pending legal review] ("we," "us," or "our") collects, uses, retains, and shares personal data when you use the service at [TBD — pending legal review] (the "Service"). It is drafted principally for compliance with the Digital Personal Data Protection Act, 2023 (India) ("DPDPA") and is intended to also meet the substantive expectations of the General Data Protection Regulation (EU) 2016/679 ("GDPR") for visitors accessing the Service from the European Economic Area.

1. Data We Collect

Category	Fields	How collected
Birth details	Date of birth, time of birth, place of birth (geocoded to latitude, longitude, and time zone)	Directly from you when you request a Report
Email address	Email only — used for magic-link authentication and receipts	Directly from you at sign-in
Technical + minimal analytics	IP address, browser user-agent, referring URL, page timings	Automatically on visit
Generated Reports and chart images	SVG/PNG renderings + textual interpretations derived from your birth details	Server-side, at the moment of generation
Payment metadata	Razorpay `payment_id`, `order_id`, status, amount, currency, timestamp. We never receive card, UPI, or bank account numbers.	Received from Razorpay after checkout

2. Purposes (Purpose Limitation)

We use the data listed above only for:

generating and delivering the Reports you request;
authenticating your account and sending transactional emails (receipts, Report links, password-less sign-in);
preventing fraud, abuse, and denial-of-service against the Service;
improving the Service — only for chart data you have expressly opted in to share for research, via the reciprocity moment described in §5;
complying with law, tax, and accounting obligations.

We do not sell your personal data. We do not use your personal data for third-party advertising. We do not build advertising profiles.

3. Legal Basis

Under the DPDPA, we rely on your consent (§6 DPDPA) and on performance of the service you requested. Under the GDPR, we rely on Article 6(1)(b) (performance of contract) for generating and delivering Reports, and on Article 6(1)(a) (consent) for the research-mode opt-in and for marketing emails. Where birth data is treated as special-category data under Article 9, we rely on Article 9(2)(a) (explicit consent) — obtained via the layered consent flow described in §5.

4. Third-Party Processors

We use the following processors. We do not share personal data with any other third party except as required by law.

Razorpay Software Private Limited — payment processing (India). Razorpay is a Payment Aggregator regulated by the Reserve Bank of India and handles all card, UPI, and bank data on our behalf.
Resend, Inc. (or the transactional email provider named on our /legal/subprocessors page) — transactional email delivery (magic-link sign-in, receipts, Report links). Operated from the United States.

A current sub-processor list is maintained at [TBD — pending legal review]/legal/subprocessors and updated when a new processor is onboarded.

5. Retention

Data is retained only for as long as necessary for the purpose for which it was collected, or as required by law. Specifically:

Account email — retained until you terminate your account, then deleted within thirty (30) days.
Birth details and generated Reports (default, no research opt-in) — retained for twenty-four (24) months after last access, then deleted. You may ask us to delete them sooner by emailing TheVedicCatalyst@gmail.com; we action erasure requests manually. Self-service deletion from your account is not available yet.
Birth details when you opt in to "Help improve astrology" — a sixty (60) day grace period on the raw chart during which you may withdraw; thereafter aggregated into research rollups retained for seven-hundred-thirty (730) days.
Payment metadata — retained for seven (7) years to meet India tax and accounting record-keeping obligations.
Server access logs (IP, user-agent) — retained for ninety (90) days on a rolling basis, then automatically discarded.

Research contributions derived from opt-in chart data are architecturally unlinkable from your account: at the moment of contribution creation, we discard the back-link to your chart identifier. This means we cannot later show you which specific studies used your contribution, because we do not keep a record connecting the contribution to you. This is a stronger privacy guarantee than "anonymised" — it is unlinkability by design. See §10.

6. Your Rights

As a Data Principal under the DPDPA (and, if applicable, a Data Subject under the GDPR), you have the following rights:

Access — a copy of the personal data we hold about you.
Correction — correction of inaccurate or incomplete data.
Erasure — deletion of your personal data, subject to legal retention obligations (e.g. tax records).
Nomination (DPDPA §13) — nominate another individual to exercise your rights in the event of your death or incapacity.
Grievance redressal — contact our Grievance Officer (§13 below) for any complaint. We aim to acknowledge within seventy-two (72) hours and resolve within thirty (30) days.
Withdrawal of consent — as easily as it was given. Contact us using the details in section 13 and we will action it.
For EU visitors, additionally: restriction of processing, portability, and the right to lodge a complaint with a supervisory authority in your EU Member State of residence.

To exercise any right, contact [TBD — pending legal review].

7. Cookies and Tracking

We use a single, first-party, HTTP-only session cookie to authenticate signed-in users. We do not use third-party advertising cookies, we do not embed third-party trackers, and we do not participate in cross-site behavioural advertising networks. We may set a lightweight first-party cookie for anti-abuse rate-limiting on anonymous endpoints (e.g. the free prediction game).

8. International Data Transfers

Some processors we use (notably our transactional email provider) are located in the United States. Where personal data is transferred outside India or the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the relevant regulator, and on the recipient processor's own privacy commitments. A current list of transfer destinations is available at [TBD — pending legal review]/legal/subprocessors.

10. Sensitive Data and Research Safeguards

We treat certain categories of information — including any labels that could reveal medical, legal, political, or otherwise sensitive attributes — as sensitive by policy, regardless of their classification under any single statute. Our internal audience-scoped visibility policy (extensions/cohort_visibility.py) governs which research categories are accessible to which internal audiences, with a fail-safe default of the most restrictive audience for any unclassified category.

When you opt in to "Help improve astrology" for a given chart, only the birth-chart scope becomes research-eligible by default. Annotations, journal entries, and any sensitive labels remain private to you and are never eligible for research contributions — this is enforced in code, not only in policy.

11. Breach Notification

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify you and the appropriate regulator without undue delay and, where feasible, within [TBD — pending legal review] hours of becoming aware of the breach.

13. Grievance Officer

As required by the DPDPA and the IT Rules 2021:

Name: [TBD — pending legal review]
Email: [TBD — pending legal review]
Postal: [TBD — pending legal review], [TBD — pending legal review]
Acknowledgement SLA: within seventy-two (72) hours of receipt.
Resolution SLA: within thirty (30) days.

Where applicable under the GDPR, our Data Protection Officer (or equivalent contact) is: [TBD — pending legal review].