Privacy Policy

1. Introduction

ASHOK BANKA KUSHWAHA ("Company", "we", "us", or "our") operates the Ayra AI companion service (the "Service") accessible via our web application and Android app.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data, and describes your rights under:

• The Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025
• The Information Technology Act, 2000 and the IT (SPDI) Rules, 2011
• Other applicable Indian laws

By using the Service, you give your free, informed, specific, and unambiguous consent to the processing of your personal data as described in this policy. You may withdraw consent at any time (see Section 9).

2. Who Is the Data Fiduciary?

Under the DPDP Act, 2023, ASHOK BANKA KUSHWAHA is the Data Fiduciary — the entity that determines the purpose and means of processing your personal data.

3. What Personal Data We Collect

3.1 Data Collected at Account Creation (via Google Sign-In)

• Full name (as provided by your Google account)
• Email address (as provided by your Google account)
• Google account identifier (UID)
• Profile picture URL (if provided by Google)

3.2 Data Collected During Use

3.3 Data We Do NOT Collect

• Card numbers, banking credentials, or CVVs — handled exclusively by Razorpay and never transmitted to or stored by us.
• Precise real-time GPS location
• Biometric data (as defined under Indian law)

3.4 Data Automatically Collected

• IP address (used for rate-limiting and security; not sold)
• Browser/device type and OS version
• App version
• Crash logs and error reports

4. How and Why We Use Your Data

Under the DPDP Act, we process personal data only for the purposes listed below, which were disclosed to you at the time of consent:

We do not sell your personal data. Free-tier pages may use Google AdSense and Google Ad Manager to serve, limit, and measure advertising. Google may process cookie, device, approximate location, and ad-interaction data according to your consent choices and Google's policies.

5. Sensitive Personal Data and AI Conversation Content

We recognise that your conversations with Ayra may contain sensitive or deeply personal information. We treat conversation history with heightened care:

• It is stored in an encrypted vector database.
• Access is strictly limited to systems and personnel required to provide the Service.
• It is not used to train publicly available AI models without your separate, explicit consent.
• You may delete your conversation history at any time (see Section 9).

6. Voice Data Handling

When you use voice input ("push-to-talk"):

1. Audio is captured on your device and transmitted over an encrypted connection to our speech-to-text (STT) service.
2. The audio is transcribed in real time. We do not retain raw audio recordings beyond the duration required for transcription (typically a few seconds).
3. The resulting text transcript is stored as part of your conversation history (see Section 5).

If our data retention practice for audio changes, we will update this policy and seek fresh consent where required.

7. Data Sharing and Third-Party Processors

We do not sell your personal data to any third party. All third-party processors are bound by contractual data-processing agreements.

7.1 Cross-Border Data Transfers

Some third-party processors (including Google and AI inference providers) may process data outside India. Where data is transferred internationally, we implement appropriate safeguards (e.g., standard contractual clauses) as required by the DPDP Act and SPDI Rules.

7.2 Legal Disclosures

We may disclose personal data if required by law, court order, or government authority, or where necessary to protect the rights, property, or safety of ASHOK BANKA KUSHWAHA, our users, or the public.

8. Data Retention

After the applicable retention period, data is permanently and securely deleted from all production systems and backups.

9. Your Rights as a Data Principal (DPDP Act, 2023)

Under the DPDP Act, you have the following rights, which you may exercise by contacting us at support@ayraverse.com or through in-app settings:

9.1 Right to Access and Summary

You have the right to obtain a summary of the personal data we hold about you and how it is being used.

9.2 Right to Correction and Completion

You have the right to correct inaccurate personal data and to have incomplete data completed.

9.3 Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your personal data when it is no longer necessary, when you withdraw consent, or when you close your account. Account deletion removes all personal data (except data we are legally required to retain) within 30 days of your request.

9.4 Right to Withdraw Consent

You may withdraw your consent to processing at any time. Withdrawal will not affect the lawfulness of processing prior to withdrawal, but may result in your inability to use the Service. To withdraw consent: contact support@ayraverse.com or use Account Settings → Delete Account.

9.5 Right to Grievance Redressal

You have the right to have your grievances addressed promptly. See Section 13 for our Grievance Officer details.

9.6 Right to Nominate

Under the DPDP Act, you have the right to nominate another individual who may exercise your data-principal rights in the event of your death or incapacity. Contact support@ayraverse.com to register a nominee.

9.7 How to Exercise Rights

Submit a request to support@ayraverse.com with the subject line "Data Rights Request — [Type of Request]". We will:

• Acknowledge your request within 72 hours
• Resolve it within 30 days (or inform you if an extension is needed)

We may verify your identity before processing a request.

10. Children's Privacy and Parental Consent

The Service is intended for users 18 years of age and older. We do not knowingly collect personal data from children under 18. If a user appears to be under 18, we will:

1. Pause data processing and account access
2. Seek verifiable parental or guardian consent before resuming
3. If consent is not provided, delete the account and all associated data

If you believe your child under 18 has used the Service, contact support@ayraverse.com immediately.

11. Security of Personal Data

We implement and maintain reasonable security practices as required by the SPDI Rules, 2011, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Access controls and authentication requirements for internal systems
• Regular security audits and vulnerability assessments
• Data minimisation — we collect only what is necessary

11.1 Data Breach Notification

In the event of a personal data breach, we will:

• Notify the Data Protection Board of India within 72 hours of becoming aware of the breach
• Notify affected users promptly via email
• Take remedial steps to contain the breach

12. Cookies and Tracking Technologies

Google advertising services may use cookies or similar technologies. Where required, advertising consent is collected through Google's consent-management flow; you may revisit those choices or use your browser controls. Ayra Plus does not display ads.

13. Grievance Officer

Response timelines: Acknowledgement within 24 hours; Resolution within 30 days.

If you are not satisfied with our response, you may approach the Data Protection Board of India (once operational), the appropriate Consumer Disputes Redressal Commission, or any other appropriate authority under Indian law.

14. International Users and GDPR

If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with applicable data-protection laws:

• Legal basis for processing: We rely on your explicit consent as the primary legal basis. For subscription billing, we rely on performance of a contract.
• Your EEA/UK rights include: access, rectification, erasure, restriction of processing, data portability, and the right to object.
• Data transfers: Data may be transferred from the EEA/UK to India. We implement Standard Contractual Clauses (SCCs) or equivalent safeguards where required.
• Data Protection Officer: Contact support@ayraverse.com for GDPR-specific queries.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will revise the "Last updated" date, notify you by email and/or in-app notice, and seek fresh consent where required by law. Continued use of the Service after the effective date of the revised policy constitutes your acceptance.

16. Contact Us