Privacy Policy — Arvitta

This Privacy Policy explains how Arvitta (Sole Proprietorship, operated by Vivek Mishra, with its principal place of business at House No. 4/17, Street No. 06, Saket Block, Mandawali, Delhi - 110092) collects, uses, stores, and protects your information when you use the Arvitta service (the "Service") at https://arvitta.com, https://app.arvitta.com, and related properties.

This policy is governed by India's Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and applicable rules.

1. Information we collect

1.1 Information you provide

Account information: name, email, phone, firm name (when you sign up)
Notice files: PDF documents you upload
Client data: client names, PAN, GSTIN, contact information you enter
Payment information: billing details (handled exclusively by Razorpay)

1.2 Information we collect automatically

Log data (IP address, browser type, pages visited, timestamps)
Usage statistics (number of notices processed, feature usage)
Authentication tokens managed by our identity provider (Keycloak)

2. How we use your information

To provide the Service: process your notices, generate AI drafts, store your data
To improve the Service: analyse aggregate usage patterns (never personal content)
To communicate with you: account notifications, billing, support replies
To comply with legal obligations
To prevent fraud and abuse

We do not train AI models on your uploaded notices, drafts, or client data. Your content is processed by AI providers solely to generate output for you, and is not retained by them for model training.

3. Third parties we share data with

We share limited data with the following service providers, all under contractual data-processing agreements:

Anthropic (Claude AI): notice text is sent for classification and draft generation. Anthropic processes the data per their Privacy Policy and does not retain it for model training.
Razorpay: payment processing. Card details are entered directly on Razorpay's servers — Arvitta never sees your card number or CVV.
Cloud infrastructure (Oracle Cloud Infrastructure): hosts our application and database in India.
Email delivery (SMTP service): transactional emails (welcome, draft-ready notifications, billing).

We do not sell your data. We do not share it with advertisers.

4. Data retention

Your account data and notice history are retained as long as your account is active.
If you delete your account, we delete or anonymise your data within 30 days, except where retention is required for legal compliance (e.g., tax records, payment audit trails).
Backups are retained for 30 days and then automatically purged.

5. Data security

All connections to our servers use HTTPS (TLS 1.2 or higher).
Data at rest is encrypted (AES-256).
Access to production systems is limited to authorised personnel and audited.
Authentication is handled by Keycloak with PKCE-secured OAuth 2.0.

While we take reasonable measures to protect your data, no system is 100% secure. You are responsible for keeping your password confidential.

6. Your rights

Under the DPDP Act 2023, you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Erase your data (subject to legal retention requirements)
Withdraw consent
File a complaint with the Data Protection Board of India

To exercise these rights, email us at vivek.mishra@arvitta.com. We respond to verified requests within 30 days.

7. Cookies

Arvitta uses essential cookies for authentication and session management. We do not use advertising or tracking cookies. We do not embed third-party analytics that profile users.

8. Children's data

Arvitta is intended for use by professional Chartered Accountants and Company Secretaries. We do not knowingly collect data from individuals under 18. If we learn that we have collected such data, we delete it immediately.

9. Changes to this policy

We may update this policy from time to time. We will notify you of material changes via email or in-app notification. Continued use of the Service after changes constitutes acceptance.

10. Contact

For privacy-related questions, contact us at:
Email: vivek.mishra@arvitta.com
Address: House No. 4/17, Street No. 06, Saket Block, Mandawali, Delhi - 110092

For data-protection grievances, you can also approach the Data Protection Board of India once it is operational.