Privacy Policy

1. Overview

BEYONDVYU (“we,” “us,” or “our”) is committed to protecting your privacy. This policy explains how we collect, use, store, process, and protect your personal data when you use our review management platform. It complies with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, along with other applicable privacy laws.

2. Data Fiduciary & Contact Information

BEYONDVYU is the Data Fiduciary under the DPDP Act. For any privacy-related inquiries, grievances, or requests to exercise your rights:

• Email: privacy@beyondvyu.com
• Grievance Officer: Contact us at privacy@beyondvyu.com — complaints will be acknowledged within 24 hours and resolved within 30 days as required by the DPDP Act.

3. Personal Data We Collect

We collect only the personal data necessary to provide our services:

• Account Data: name, email address, phone number, and password (password is hashed with bcrypt — never stored in plain text)
• Business Data: business name, address, phone number, website, Google Place ID, and Google Review URL
• Customer Feedback Data: ratings, comments, review drafts, and feedback submitted through our platform
• Usage Data: QR code scans, page visits, feature interactions, and platform activity logs
• Payment Data: Razorpay subscription and payment identifiers (we never store credit/debit card numbers, CVV, or bank account details)

4. Consent

Under the DPDP Act, we collect your personal data only after obtaining your free, specific, informed, unconditional, and unambiguous consent. You are required to:

• Explicitly consent to data processing before creating an account (no pre-ticked checkboxes)
• Accept our Privacy Policy and Terms of Service before using the platform

You may withdraw your consent at any time with the same ease as you gave it. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. To withdraw consent, visit your account settings or email privacy@beyondvyu.com.

5. Purpose of Data Processing

We use your personal data only for the following purposes:

• To create and manage your account
• To provide review management services (review requests, feedback collection, AI drafts)
• To send service-related notifications (new feedback, review reminders)
• To generate aggregated analytics and insights (anonymized where possible)
• To comply with legal and regulatory obligations
• With separate, specific consent: to send marketing updates, tips, and product announcements (you may opt out at any time)

6. Data Sharing & Disclosure

We do not sell your personal data. We share data only with:

• Razorpay (payment processing) — only Razorpay IDs are stored in our database; no financial instrument data
• Google — only when you choose to redirect customers to Google Reviews or connect Google Business Profile
• Service providers — hosting (Render), email delivery, and analytics under strict data processing agreements
• Law enforcement — only when required by applicable law or valid legal process

7. Data Localization & Storage

As required by the DPDP Act and the RBI April 2018 circular on data localization, all personal data is stored on servers located in India. Our database infrastructure uses India-region cloud services (AWS ap-south-1 / Mumbai).

8. Data Security

We implement industry-standard security measures:

• Encryption at rest (AES-256) and in transit (TLS 1.3)
• Passwords hashed using bcrypt with cost factor 12
• Token-based authentication with session expiry
• No raw PAN, CVV, or expiry stored anywhere
• Content Security Policy (CSP) headers configured
• Regular security audits and access controls

9. Data Retention

We retain your personal data for as long as your account is active. Upon account deletion, we delete or anonymize your data within 30 days unless retention is required by law (e.g., invoice records for tax purposes are retained for 7 years as required by Indian tax law).

10. Your Rights (DPDP Act)

Under the DPDP Act, you have the following rights:

• Right to know: information about the personal data collected and the purpose of processing
• Right to access: a summary of your personal data held by us and the processing activities
• Right to correction: update inaccurate or incomplete personal data
• Right to erasure: delete your personal data (subject to legal retention requirements)
• Right to grievance redressal: lodge a complaint with our Grievance Officer
• Right to nominate: nominate a person to manage your data in case of death or incapacity
• Right to withdraw consent: at any time, with the same ease as you gave it

To exercise any of these rights, email us at privacy@beyondvyu.com. We will respond within 30 days as required by the DPDP Act.

11. Cookies & Tracking

We use cookies and similar technologies to improve your experience and analyze platform usage. When you first visit our website, you will be asked to consent to non-necessary cookies. You can categorize your preferences as follows:

• Necessary: required for basic functionality (session management, authentication). Always enabled.
• Analytics: help us understand how you use our platform to improve it
• Marketing: used to deliver relevant advertisements and track campaign effectiveness

You can change your cookie preferences at any time by clicking “Cookie Preferences” in the footer. You may withdraw consent for analytics and marketing cookies at any time.

12. Children's Data

Our services are not directed at children under 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or through a notice on our platform. Continued use of BEYONDVYU after changes constitutes acceptance of the updated policy.

14. Grievance Redressal

If you have any complaints or concerns regarding your personal data, please contact our Grievance Officer:

• Email: privacy@beyondvyu.com
• Acknowledgment: within 24 hours
• Resolution: within 30 days

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India as provided under the DPDP Act.