Privacy Policy

1. Information We Collect

We collect information you provide directly, information generated automatically, and information from third-party services. Specifically:

2. How We Use Your Information

• Provide, operate, and maintain our platform and AI-powered features
• Process payments and manage your subscription
• Send transactional emails (receipts, security alerts, password resets)
• Send product updates and marketing communications where you have consented
• Detect, prevent, and respond to fraud, abuse, and security incidents
• Comply with legal obligations and enforce our Terms of Service
• Conduct internal analytics and product research to improve our services

Our legal bases for processing under GDPR are: performance of a contract (providing the service you signed up for), legitimate interests (security, analytics, fraud prevention), legal obligation, and consent (marketing emails).

3. Cookies and Tracking Technologies

We use the following categories of cookies:

You can manage cookie preferences through your browser settings or our in-app cookie banner. Disabling strictly necessary cookies will impair platform functionality.

4. Data Retention

We retain your data only as long as necessary for the purposes set out in this policy:

• Active accounts: For the duration of your account plus 90 days after deletion (to allow account recovery).
• Payment records: 7 years from the transaction date, as required by Indian tax law.
• Server/access logs: 90 days, then anonymised and aggregated.
• Support communications: 3 years from ticket closure.
• Deleted account data: Permanently purged within 90 days of deletion request, except data we are legally required to retain.

5. Security Measures

We implement industry-standard technical and organisational measures to protect your data:

• All data in transit encrypted with TLS 1.2 or higher
• Data at rest encrypted using AES-256
• Passwords hashed with bcrypt (work factor ≥12)
• Regular third-party security audits and penetration tests
• Role-based access controls; employee access on a need-to-know basis
• Multi-factor authentication available for all accounts

No method of transmission over the internet is 100% secure. We will notify you promptly in the event of a data breach affecting your personal data, as required by applicable law.

6. Third-Party Services

We share data with trusted service providers who process data on our behalf under strict data processing agreements:

We do not sell your personal data to third parties.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Request that we restrict processing of your data.
• Object: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email support@vervi.in with the subject line "Data Rights Request". We will respond within 30 days.

8. GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our processing of your personal data is governed by Regulation (EU) 2016/679 (GDPR). We act as the data controller for personal data you provide directly. Where we use third-party processors, we execute appropriate Data Processing Agreements (DPAs). International transfers outside the EEA are carried out under Standard Contractual Clauses (SCCs) approved by the European Commission.

You have the right to lodge a complaint with your national supervisory authority if you believe we have not handled your personal data in accordance with applicable law.

9. CCPA Compliance (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you specific rights:

• The right to know what personal information we collect, use, disclose, and sell.
• The right to delete personal information we have collected.
• The right to opt out of the sale of personal information. We do not sell personal information.
• The right to non-discrimination for exercising your CCPA rights.

To submit a verifiable consumer request, contact us at support@vervi.in.

10. Children's Privacy

Vervi is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately at support@vervi.in and we will take steps to delete such information promptly.

11. International Data Transfers

Vervi is operated from Goa, India. If you access our services from outside India, your data may be transferred to, stored in, and processed in India or other countries where our service providers operate. These transfers are made in accordance with applicable data protection laws, using appropriate safeguards such as Standard Contractual Clauses or binding corporate rules.

12. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will notify you via email or a prominent notice on the platform at least 14 days before the changes take effect. The "Effective Date" at the top of this page reflects the latest revision. Continued use of Vervi after the effective date constitutes acceptance of the updated policy.

13. Contact Us