Privacy Policy

1. Introduction

Ashtvak ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use our platform. It complies with India's Digital Personal Data Protection (DPDP) Act, 2023.

By using Ashtvak, you consent to the practices described in this Policy. If you do not agree, please discontinue use and contact us to delete your data.

2. Data We Collect

We collect the following categories of personal data:

3. Legal Basis for Processing (DPDP Act, 2023)

Under the DPDP Act, 2023, we process your personal data on the following lawful bases:

• Consent: You explicitly consent to data processing when you register for an account and provide birth details for chart generation.
• Contract performance: Processing necessary to deliver the services you have subscribed to or paid for.
• Legitimate interests: Analytics and service improvement, where such processing does not override your fundamental rights.
• Legal obligation: Compliance with applicable Indian laws, including tax and financial regulations.

4. How We Use Your Data

• Generate and display your Vedic birth chart (Janam Kundli)
• Produce AI-powered astrological readings and predictions
• Authenticate your identity via OTP
• Process payments and manage billing
• Send transactional communications (OTP, payment receipts)
• Improve platform functionality and user experience
• Respond to your queries and feedback
• Comply with legal and regulatory obligations

Ashtvak is currently a free playground: no payments are collected and phone/OTP verification is not enabled, so the payment and OTP purposes above do not apply today. They will apply if and when those features are introduced.

We do not use your data for targeted advertising. We do not sell, rent, or share your personal data with third parties for their marketing purposes.

5. Data Storage & Security

Your data is stored on secure servers located in India. We implement the following technical and organisational security measures:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for all data in transit
• OTP-based authentication with rate limiting and cooldown
• Regular security audits and penetration testing
• Access controls limiting staff access to the minimum necessary
• No storage of payment card details (PCI-DSS compliance via Razorpay)

While we take reasonable precautions, no digital system can guarantee absolute security. In the event of a data breach affecting your rights, we will notify you and the Data Protection Board of India as required by law.

6. Data Sharing

We share personal data only in the following limited circumstances:

• Service providers: Trusted third parties who help us operate the platform (Google Cloud Run for application hosting, Neon for the database, Upstash for caching, LocationIQ for city lookup, and Google Gemini for AI reading generation). Payment and SMS providers (Razorpay, SMS gateway) will apply only when paid plans and phone verification are enabled. These parties process data only as instructed.
• Legal compliance: Disclosure required by Indian law, court order, or government authority.
• Business transfer: In the event of a merger or acquisition, your data may be transferred to the successor entity under equivalent privacy protections.

7. Your Rights Under the DPDP Act, 2023

As a data principal, you have the following rights:

• Right to access: Request a copy of the personal data we hold about you.
• Right to correction: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your account and all associated data ("right to be forgotten").
• Right to withdraw consent: Withdraw consent at any time, which will result in termination of your account.
• Right to grievance redressal: Lodge a complaint with our Data Protection Officer.
• Right to nominate: Nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, email our DPO at ashtvak.help@gmail.com. We will respond within 30 days.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Birth profiles and reading data are retained for 5 years from the date of last activity, after which they are securely deleted. You can request earlier deletion at any time. Anonymised, aggregated analytics data may be retained indefinitely.

9. Cookies & Tracking

Sphuta uses essential cookies required for authentication and session management. We may use analytics tools (e.g., PostHog) to understand usage patterns. Analytics data is anonymised and not linked to individual identities. You can disable non-essential cookies via your browser settings.

10. Children's Privacy

Ashtvak is not intended for users under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided data to us, please contact ashtvak.help@gmail.com and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via the registered phone/email. Continued use after changes constitutes acceptance.

12. Contact & Data Protection Officer

For privacy-related queries, complaints, or rights requests, contact our Data Protection Officer: