Legal · effective 5 November 2026 · v2026-11-05
Privacy Notice
How VYOMIRA collects, uses, protects and deletes your personal data — and the rights you have over it.
1. Who we are
VYOMIRA is operated by VYOMIRA (“VYOMIRA”, “we”, “us”). For your personal data we are the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and, for users in the European Union or United Kingdom, the controller under the GDPR / UK GDPR. Contact our privacy team at info@cloudisoft.com.
2. Personal data we process
Data you give us
- Account data: name, email address and password (stored only as a salted hash), or your Google account identifier, name and email if you sign in with Google.
- Birth details (only when you choose to save a chart): the name you give the chart, date of birth, time of birth and how precise it is, and birthplace. You may also enter a partner’s birth details for a compatibility calculation; these are processed for that calculation only and are not stored.
- Questions and feedback: what you ask AURA, ratings, reports and saved readings.
- Support communications you send us.
Data generated by the service
- Your computed chart (planetary positions, periods and derived readings).
- Purchase records: order and payment identifiers, amount, currency, status and pack balances. We never receive or store card, UPI PIN, net-banking or wallet credentials — these are handled by our payment aggregator, PayU.
- Security and operational records: session records, hashed (non-reversible) IP identifiers for rate-limiting, and audit events. These never include your birth details, chart contents or message text.
- Strictly necessary cookies (see our Cookie Notice). We do not use advertising or cross-site tracking cookies.
Anonymous previews
If you calculate a chart without saving it, the details are processed in memory to compute the chart and returned to your browser tab. They are not stored or logged on our servers.
3. Why we process it, and on what basis
| Purpose | Data | Basis (DPDP Act / GDPR) |
|---|---|---|
| Create and secure your account | Account data, security records | Your consent (s.6 DPDP); contract (Art. 6(1)(b) GDPR) |
| Compute and show your chart, readings and reports | Birth details, chart | Your explicit consent given when you save a chart |
| Let AURA phrase answers with an AI provider | A compact summary of chart factors and your question — never your name, birth date, time or place | Separate, optional consent; withdraw any time in Settings |
| Sell and deliver message packs; refunds; tax and accounting | Purchase records, name, email | Consent and legitimate uses for compliance with law (s.7 DPDP); contract and legal obligation (GDPR) |
| Prevent fraud and abuse; keep the service secure | Security records | Legitimate uses permitted under s.7 DPDP; legitimate interests (GDPR) |
| Product updates by email | Optional consent; unsubscribe any time |
We do not sell personal data, do not use it for advertising, and do not make decisions about you that produce legal or similarly significant effects by automated means.
4. Who receives your data (processors)
We share personal data only with service providers that process it on our instructions under written contracts with appropriate security obligations:
- Hosting, database and caching providers — to run the service.
- PayU Payments Private Limited (payment aggregator regulated by the Reserve Bank of India) — to process payments. PayU collects payment details directly under its own privacy policy.
- Anthropic, PBC (AI language model provider) — only if you enable AI processing, and only the compact chart-factor summary and your question. Processing may occur outside India.
- Google — only if you choose Google sign-in.
- Transactional email provider — to send account and purchase emails.
- Authorities — where required by law, court order or to protect rights and safety.
5. Cross-border transfers
Some processors operate outside India. We transfer personal data only to countries not restricted by the Central Government under s.16 of the DPDP Act, and, for EU/UK users, under appropriate safeguards such as Standard Contractual Clauses.
6. How long we keep it
- Account, birth details, charts, conversations and reports: while your account is active. When you delete your account they are erased from our live systems immediately and from backups within 35 days.
- Purchase and invoice records: 8 years from the end of the relevant financial year, as required by Indian tax and accounting law (these are retained even after account deletion, without birth details).
- Security and audit logs: one year, as required by the DPDP Rules, 2025, and then deleted.
7. How we protect it
We maintain reasonable security safeguards appropriate to the data, including: TLS encryption in transit; application-level AES-256-GCM encryption of birth details and chart data at rest; salted password hashing; strict per-user access controls; rate-limiting; least-privilege administrative access that never displays birth details; and logging that excludes sensitive content. No system is perfectly secure; see §9 for how we handle breaches.
8. Your rights
Under the DPDP Act (ss.11–14) and, where applicable, the GDPR, you can:
- Access a summary of your data and the processing — use Settings → Export my data for a full copy.
- Correct or update it — edit your birth details at any time.
- Erase it — Settings → Delete account.
- Withdraw consent — switch off AI processing or marketing in Settings; withdrawal does not affect processing already done.
- Nominate a person to exercise your rights in the event of death or incapacity — email info@cloudisoft.com.
- Grievance redressal — see §10. If unresolved, you may complain to the Data Protection Board of India; EU/UK users may complain to their supervisory authority.
- EU/UK users additionally have rights to restriction, objection and portability.
We respond to requests within 30 days (sooner where law requires) and may verify your identity first.
9. Personal data breaches
If a breach affects your personal data, we will inform you without delay — describing what happened, the likely consequences, what we are doing and what you can do — and will report it to the Data Protection Board of India as required by the DPDP Rules, 2025, and to CERT-In within 6 hours where required by its directions.
10. Grievance Officer
Grievance Officer, VYOMIRA — info@cloudisoft.com. We acknowledge grievances within 48 hours and resolve them within one month of receipt. See Grievance Redressal.
11. Children
VYOMIRA is for adults aged 18 and over. We do not knowingly create accounts for children or process children’s data for tracking or targeted advertising. A parent or guardian may calculate a child’s chart as an anonymous preview without saving it. If you believe a child has created an account, contact us and we will delete it.
12. Changes
We will notify you of material changes by email or in-app notice before they take effect and, where the change affects a consent-based purpose, ask for fresh consent.
A Hindi version (हिन्दी) of this notice is available. Notices in other languages listed in the Eighth Schedule to the Constitution are available on request.