Privacy Policy

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract performance — processing necessary to deliver your AI-generated report following completion of the questionnaire
• Legitimate interests — processing for website security, fraud prevention, and service improvement, where these interests are not overridden by your rights
• Consent — where you have actively ticked the checkbox on our questionnaire confirming you agree to receive marketing communications from Vyasa. You may withdraw this consent at any time by clicking unsubscribe in any email or by contacting info@vyasaai.dev

For users in India: we process your data in accordance with the Digital Personal Data Protection Act 2023 (DPDPA). By completing our questionnaire, you provide explicit consent to the processing described in this policy.

For users in the United States: we do not sell your personal data to third parties. If you are a California resident, your rights under the California Consumer Privacy Act (CCPA) are described in Section 9 of this policy.

5. How We Use Your Data

We use the data we collect for the following purposes:

• To generate and deliver your personalised AI-powered monetisation report
• To send your report via email immediately upon completion of the questionnaire
• To send follow-up marketing communications about Vyasa's services, where you have provided consent
• To operate, maintain, and improve our website and questionnaire
• To monitor and analyse usage patterns for the purpose of service improvement
• To detect and prevent fraudulent or abusive use of our service
• To comply with our legal obligations

We do not use your data for automated decision-making that produces legal or similarly significant effects on you without human oversight.

6. Third-Party Services and Data Sharing

We use a limited number of third-party service providers to operate our service. Each provider is engaged under a data processing agreement and is permitted to use your data only for the specific purpose for which they are engaged.

6.1 Current Data Processors

• Anthropic, Inc. (Claude API) — used to generate your personalised monetisation report. Data passed includes your questionnaire responses. Anthropic's privacy policy is available at anthropic.com/privacy
• n8n — used to automate the workflow between your questionnaire submission, report generation, and email delivery. Data passed includes your email address and report content
• Email delivery provider — used to send your report and any consented marketing communications

6.2 Planned Future Data Processors

• GoHighLevel (CRM) — we intend to implement a CRM system in the future. When this is activated, we will update this policy and notify existing users by email before any data is transferred to this platform

6.3 Data We Do Not Share

We do not:

• Sell your personal data to any third party
• Share your data with advertisers or advertising networks
• Share your data with other creators or users of our platform
• Transfer your data to any party not listed in this policy without your prior consent, except where required by law

6.4 Legal Disclosures

We may disclose your personal data to law enforcement or regulators if legally required, or if we believe in good faith that such disclosure is necessary to protect our legal rights, prevent fraud, or comply with a judicial or regulatory proceeding.

7. International Data Transfers

Vyasa AI Ltd is registered in the United Kingdom. Our service providers, including Anthropic, Inc. and n8n, may process your data outside of the UK, EU, or India.

Where data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR Article 46, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO).

Where data is transferred outside India, we comply with the cross-border transfer provisions of the Digital Personal Data Protection Act 2023.

For more information about the specific transfer mechanisms we rely on, please contact us at info@vyasaai.dev.

8. How Long We Keep Your Data

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, and to comply with our legal obligations.

• Questionnaire responses and report data — retained for 24 months from the date of submission, after which they are permanently deleted
• Email address and marketing consent — retained until you withdraw consent or request deletion, whichever is earlier
• Website analytics data — retained for 14 months in aggregated, anonymised form
• Legal compliance records — retained for 7 years where required by UK law

When data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with you.

9. Your Rights

Depending on your location, you have the following rights in relation to your personal data:

9.1 Rights for All Users

• Right of access — you may request a copy of the personal data we hold about you
• Right to rectification — you may request that we correct inaccurate or incomplete data
• Right to erasure — you may request that we delete your personal data, subject to our legal obligations
• Right to withdraw consent — where we process your data on the basis of consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing
• Right to object to marketing — you may opt out of marketing communications at any time using the unsubscribe link in any email or by contacting info@vyasaai.dev

9.2 Additional Rights for UK and EU Users (UK GDPR)

• Right to restriction of processing — you may request that we limit how we use your data in certain circumstances
• Right to data portability — you may request your data in a structured, machine-readable format
• Right to lodge a complaint — you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have processed your data unlawfully

9.3 Additional Rights for California Users (CCPA)

• Right to know — you may request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to delete — you may request deletion of your personal information, subject to certain exceptions
• Right to non-discrimination — we will not discriminate against you for exercising your CCPA rights
• Right to opt out of sale — we do not sell personal information. No opt-out mechanism is therefore required, but you may contact us to confirm this

9.4 Rights for Indian Users (DPDPA)

• Right to access — you may request a summary of the personal data we process and the processing activities carried out
• Right to correction and erasure — you may request correction of inaccurate data or erasure of data no longer required for its original purpose
• Right to grievance redressal — you may raise a grievance with us at info@vyasaai.dev. We will respond within 30 days
• Right to nominate — you may nominate another individual to exercise your rights on your behalf in the event of your death or incapacity

9.5 How to Exercise Your Rights

To exercise any of the rights listed above, please contact us at info@vyasaai.dev with the subject line "Privacy Request". We will respond within 30 days. We may ask you to verify your identity before processing your request.

10. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to operate and improve our service.

• Strictly necessary cookies — required for the website to function. These cannot be disabled
• Analytics cookies — used to understand how visitors interact with the website. These are only set with your consent

You can manage your cookie preferences through your browser settings. Disabling analytics cookies will not affect your ability to use the questionnaire or receive your report. We do not use advertising cookies or third-party tracking pixels.

11. Data Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration. These measures include:

• Encrypted data transmission using HTTPS across all pages
• Access controls limiting who within Vyasa can access your personal data
• Regular review of our data processing practices and third-party provider agreements

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware and will notify affected individuals without undue delay where required.

12. Children's Privacy

Our service is intended for content creators and is not directed at individuals under the age of 18. We do not knowingly collect personal data from anyone under 18.

If you believe we have inadvertently collected data from a minor, please contact us immediately at info@vyasaai.dev and we will delete that data without delay.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify users who have consented to communications from us by email, at least 14 days before the changes take effect

Your continued use of our service after the effective date of any changes constitutes your acceptance of the updated policy. To request deletion of your data, contact info@vyasaai.dev.