Privacy Policy

Version 0.1 (draft) · Effective: {{EFFECTIVE_DATE}} · Last updated: 24 October 2026 · Notice version: privacy-2026-10-v0.1

In short (plain language)

• Who: Trinetra AI Labs Private Limited runs DamruVani and decides how your personal data is used (we are the "Data Fiduciary").
• What we collect: your name and email, the text and audio you give us, the audio we generate for you, voice recordings if you create a voice clone, and technical data needed to keep the service secure. If you choose to: waitlist details, invite / referral links, a phone number for verification, survey answers and feedback, and your number if you join our WhatsApp group. Billing details only once paid plans exist.
• Why: to run the service, keep it safe, prevent abuse and meet legal duties. We do not sell your data and we do not show ads.
• Your voice is protected: we clone a voice only with your separate, explicit consent and a live check. We do not use your data — or any audio generated with Model 1 — to train AI models.
• Third-party AI (Google Gemini) is switched off during the beta. If we switch on features such as auto-tagging emotions or fixing Hinglish spelling, some text will go to Gemini — we will update this policy before that happens (§7).
• Where: our servers and GPU are planned to be in India. Encrypted backups are stored with Cloudflare R2 outside India, and a few providers (email, error monitoring) may process data outside India.
• How long: uploads about 7 days, generated audio for your plan's history period, account data until you delete your account. Billing records must be kept for about 8 years under tax and company law.
• Your rights: see, correct and delete your data, withdraw consent, nominate someone, and complain — from Settings → Privacy or by writing to our Grievance Officer at grievance@{{DOMAIN}}. We reply within 30 days.
• Only 18+. Cookies: strictly necessary only — no tracking or advertising cookies.

1. Who we are

Swipe sideways to see the whole table →

2. Laws that apply

• Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), notified in November 2025. Most duties of data fiduciaries under the Rules apply from 13 May 2027. [VERIFY: commencement dates against the Gazette notification (G.S.R. 846(E)); a MeitY proposal to bring them forward was reported in early 2026 but, per trackers, had not been notified as of October 2026] We follow the DPDP standard now.
• Until the DPDP Act fully replaces it, section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules") also apply. Under the SPDI Rules, biometric information — which includes voice patterns — is sensitive personal data. [VERIFY: SPDI Rule 2(1)(b) wording] [LAWYER: confirm voice-clone consent meets SPDI Rule 5]
• The IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended in 2026 ("IT Rules"), and the CERT-In Directions of 28 April 2022 also apply to parts of our processing. [LAWYER: whether DamruVani is an "intermediary"]

3. Scope

This policy covers personal data we process when you use the DamruVani website, Studio, API and mobile apps. The Service is for people in India who are 18 or older. If you use the API to build your own application, you are responsible for your own users' personal data and must give them your own privacy notice.

4. Personal data we collect

Swipe sideways to see the whole table →

We do not collect government ID numbers, contacts, location, the content of your SMS messages or your full card / UPI details. Please do not put sensitive personal data (for example health, financial or ID details of yourself or others) into text you convert to speech.

5. Why we use it (purposes) and on what basis

Swipe sideways to see the whole table →

We do not sell personal data, use it for advertising, or build advertising profiles.

6. Consent — how we ask and how you withdraw

6.1 We ask for consent separately for each purpose that needs it, in clear language, with an itemised notice. We record which notice version you saw and when.

6.2 Withdrawing is as easy as giving consent: Settings → Privacy has a switch for each optional purpose (for example marketing emails; a phone number can be removed there too). Deleting a Voice Clone withdraws voice-clone consent. Every marketing email has an unsubscribe link. You can leave a WhatsApp group or Channel at any time.

6.3 Withdrawal stops future processing for that purpose. It does not affect processing already done. If you withdraw consent needed for a core feature, we may not be able to provide that feature.

6.4 Model training: we do not use your data for training during the Beta. If we ever offer an opt-in programme, we will explain before you join that information used to train a model cannot be removed from a model that has already been trained, and that withdrawing keeps your data out of all future training.

6.5 When India's registered Consent Managers become available, we may also let you manage consent through one. [VERIFY: Consent Manager provisions commence 13 November 2026]

7. Third-party AI processing (Google Gemini)

Status: switched off during the Beta — no text is sent to Gemini. [OWNER: keep in sync with TEXT_AI_PROVIDER at publish time] The table below describes what will happen if we switch a feature on; we will update this policy, its notice version and the processors table before that, and tell you in the Service.

When switched on, some text features send text to Google's Gemini API (paid tier):

Swipe sideways to see the whole table →

• We send only the text needed for the task, plus the list of allowed emotion tags. We do not add your name, email or account ID. The text itself may still contain personal data if you typed it — please avoid that.
• Under Google's paid-tier terms, Google does not use these prompts or responses to improve its products; it may keep them for a limited period to detect abuse, and they may be processed in any country where Google has facilities. [VERIFY: re-check Gemini API Additional Terms at launch]
• Gemini processes data for us as our Data Processor. Results are checked by our own validators; your original words are never changed without your approval.

8. Who we share personal data with

8.1 Data Processors — providers who process personal data only on our instructions, under contracts that require reasonable security safeguards (DPDP Rules, Rule 6):

Swipe sideways to see the whole table →

8.2 Independent parties that act as data fiduciaries in their own right, under their own privacy policies: Google (if you sign in with Google), Razorpay (payments, once paid plans exist; Razorpay test mode during the Beta), banks and UPI apps, Google Play (app distribution and Play Integrity), and WhatsApp / Meta Platforms (if you join our WhatsApp Channel or group). [LAWYER: Meta's role for a business-run group]

8.3 Legal disclosures. We disclose personal data when required by law — for example to courts, government agencies and law enforcement acting under valid legal authority, or to CERT-In. Under the IT Rules, we may disclose the identity of a user who violated the rules to a complainant who is a victim, in accordance with applicable law. We record every such request.

8.4 Business transfers. If our business is merged or sold, personal data may transfer to the new owner, who must respect this policy. We will tell you first. [LAWYER: DPDP has no explicit merger clause — confirm notice / consent needs]

8.5 We do not share personal data with advertisers or data brokers.

9. Where your data is stored, and transfers outside India

9.1 We plan to keep our main servers and database in India, and our GPU server is in India. [VERIFY: when the cloud server is bought]

9.2 Some processors may process personal data outside India: our encrypted backups in Cloudflare R2, Google (Firebase; Gemini only if switched on), the email provider, the error-monitoring provider, and Cloudflare's global network. Under section 16 of the DPDP Act, transfers are allowed except to countries the Central Government restricts by notification; we will stop any transfer that becomes restricted. [VERIFY: no country notified as of 24 October 2026] [LAWYER: SPDI Rule 7 requires the same level of protection, and transfer only where necessary or with consent]

10. How long we keep data

Swipe sideways to see the whole table →

Text typed into the public "try it" box on our website is not stored. [OWNER: RULES R-D-09 is still "proposed" — confirm it is implemented before publishing]

11. Deleting your account

11.1 Delete your account from Settings → Privacy, the mobile app, or /account/delete. There is a 7-day grace period in which you can cancel.

11.2 After that we delete your profile, Voice Clones (including copies cached on our GPU server), consent audio, uploads, Outputs, projects, API keys and sessions, and cancel any subscription.

11.3 What we must keep: invoices, payment, refund and credit-note records and the billing profile used on them, for the period tax and company law requires (§10). Your credit history is anonymised. Copies in backups disappear within 30 days.

11.4 We email you when deletion is complete.

12. Security

We protect personal data with reasonable security safeguards, including: encryption in transit (HTTPS / TLS) and for backups; databases, queues and storage not exposed to the public internet; private, encrypted networking to our GPU server; access controls with two-factor authentication for staff and a tamper-evident audit log; hashing of API keys and sign-in codes, and of IP addresses in our sign-in and security records (our web server access logs keep full IP addresses and browser details for 180 days for security, as Indian cyber-security directions require); masking of email, phone and text in application logs; short-lived signed links for file downloads; isolated, sandboxed processing of uploaded media; and automated security scans and tests before releases. No system is perfectly secure; we will tell you about a breach as described in §16. [LAWYER: SPDI Rule 8 refers to IS/ISO/IEC 27001 or an approved code — we are not certified]

13. Your rights and how to use them

Swipe sideways to see the whole table →

• How we identify you: to protect your account, we act on requests made while you are signed in (we may ask you to sign in again), or from your registered email address after confirming a one-time code. The identifier we need is your registered email address.
• We aim to respond within 30 days — faster than the 90-day maximum allowed by the DPDP Rules (Rule 14(3)) [VERIFY: Gazette text; applies from 13 May 2027], and within the one-month period of SPDI Rule 5(9).
• Rights may be limited where the law requires us to keep or disclose data.

14. Your duties

The DPDP Act (§15) asks you to: follow applicable law when exercising your rights; not impersonate another person when giving us information; not suppress material information when giving us personal data for an official document; not file false or frivolous complaints; and provide only verifiably authentic information when you ask for correction or erasure. [VERIFY: penalty for breach of these duties under the DPDP Act Schedule]

15. Children

The Service is only for people aged 18 or older. We do not knowingly collect personal data from children, and we do not allow cloning of a child's voice. If we learn that a user is under 18, we will suspend the account and delete their personal data, except what the law requires us to keep. If you believe a child is using DamruVani, tell us at grievance@{{DOMAIN}}.

16. Personal data breaches

If a personal data breach affects you, we will tell you without delay — by email and in the Service — in plain language: what happened (nature, extent, timing), the likely consequences for you, what we are doing to reduce the risk, steps you can take to protect yourself, and whom to contact. We will also inform the Data Protection Board as the DPDP Rules require (an initial report without delay and a detailed report within 72 hours, from 13 May 2027 [VERIFY: Rule 7 text + commencement]), and report cyber-security incidents to CERT-In within the time its Directions require (6 hours from noticing the incident [VERIFY: CERT-In Directions of 28 April 2022, still current?]).

17. Cookies and similar storage

We use only strictly necessary cookies and browser storage (sign-in, security, remembering small preferences). No advertising or tracking cookies, and no third-party analytics. Details: Cookie Policy.

18. Automated decisions

• Our moderation systems may automatically refuse a generation that appears to break the AUP.
• Voice-clone verification compares your challenge recording with the expected sentence and with your sample automatically; our team reviews some attempts manually.
• These checks do not produce legal effects such as credit or employment decisions. You can ask for a human review of any automated block through /legal/grievance.

19. Changes to this policy

When we change this policy we update the version and date at the top. For material changes we notify you by email or in the app before they take effect, and where the law requires it we ask for your consent again. Earlier versions are archived at /legal/privacy/versions.

20. Contact

Grievance Officer: {{GRIEVANCE_OFFICER_NAME}}, {{GRIEVANCE_OFFICER_DESIGNATION}}, Trinetra AI Labs Private Limited, {{REGISTERED_OFFICE_ADDRESS}} — grievance@{{DOMAIN}}. Timelines and escalation: /legal/grievance.