Privacy policy

Last updated: [DATE]. Operated by [YOUR LEGAL NAME OR COMPANY], [ADDRESS], India.

Vayu is a personal assistant you use over WhatsApp. This policy explains what we collect, why, and the control you have. It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP Act).

What we collect

• Your WhatsApp number and display name — to know who you are and reply to you.
• Messages and photos you send — to do what you ask. We keep recent conversation history so the assistant has context.
• Things you ask us to remember — preferences like your home city or train class, reminders and lists.
• Google data, only if you connect Google — we read your calendar and email only when you ask a question that needs it, create events and drafts when you ask, and send email only after you confirm. We do not store copies of your emails.
• Waitlist details — name, number, city and what you'd like help with.

What we don't do

• We don't sell your data or use it for advertising.
• We don't use your messages, emails or photos to train AI models.
• We never ask for passwords, UPI PINs, CVVs, or Aadhaar/PAN numbers, and we never ask for a one-time code in chat. A one-time code is only ever typed by you, on the private linking page described below.

Linked apps: how it works and where it is kept

• You sign in yourself, never in the chat. Send link and the app's name on WhatsApp and Vayu sends a private link, signed for you and valid for one hour. It opens a page showing that app's own sign-in screen, running in a browser on our server. You type your mobile number and the one-time code the app texts to your phone, exactly as you would on the app.
• What we keep is the signed-in session. When you press "I'm signed in" we save the session the app issued (its cookies), encrypted with a key held only on our server, in your own record and separate from every other person's. It is used only for things you ask for.
• What we never keep. The one-time code and everything else you type on that page are passed straight to the app and are not written to any log, database or message. Passwords cannot be typed there at all. We never ask for a code in chat, never read one from your SMS or email, and never type one for you.
• What a linked app lets Vayu do. Search, read your orders and bookings, fill in forms and prepare an application or a cart. Before anything is submitted, applied for, ordered or booked, you get a Confirm button for that exact action. Payments are always made by you.
• It stays linked until you unlink it. Send unlink and the app's name, or DELETE to remove everything; the saved session is destroyed. You can also sign us out from the app's own "devices" or security page. Sessions expire on the app's own schedule, and then you link again.
• Some apps' terms discourage automated use and an app could restrict an account that uses it. Linking is your choice, app by app.
• Google and Zepto link through their own official sign-in (OAuth); there we hold an access key limited to what you approved, also encrypted.
• Vayu Companion (optional Chrome extension). If you install it and pair it with a code from WhatsApp, Vayu can ask your own Chrome to open a page on a listed shopping, travel, food or jobs site and send back the text on that page, so it can read live prices or your orders where you are already signed in. It only reads: it does not click, type, order or pay. Your passwords and cookies never leave your browser. We keep the site name, the reason and the time of each read, not the page. The extension lists every page it opened, and you can pause or unpair it at any time.
• Banks, brokers and UPI apps can never be linked.
• Check-ins after a Buy or Book button. A few hours later we may ask once whether it got done. We keep the name of the item, the shop and your answer. If you have linked Gmail, and only then, we look for the order email to confirm it, reading just the sender, the subject and the one-line preview. Tap "Don't ask me" to switch check-ins off.
• Affiliate links. Some Buy and Book buttons may carry our affiliate ID, which can earn Vayu a commission from the shop at no cost to you. It never changes which option is recommended: the pick is made first, on price and fit.

Who processes your data

To run the service we use: Meta (WhatsApp Business Platform) to send and receive messages; Anthropic (Claude) to understand requests and write replies — Anthropic does not train on data sent through its commercial API; Google, if you connect it; and our hosting provider. Some of these process data outside India.

Google user data

Vayu's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide the features you request and is never used to train AI models or for advertising.

Your rights and choices

• Delete everything: send DELETE on WhatsApp. We erase your messages, reminders, lists, photos, saved facts and Google access immediately.
• Disconnect Google: send DELETE, or remove access at myaccount.google.com/permissions.
• Access or correct your data: ask the assistant what it remembers, or contact us.

Retention

We keep your data while you use Vayu. If you don't message us for 12 months, we delete it.

Grievance officer

[NAME], [EMAIL]. We respond within 30 days. You may also approach the Data Protection Board of India.