Privacy Policy

1. Overview

BEYONDVYU (“we,” “us,” or “our”) is committed to protecting your privacy. This policy explains how we collect, use, store, process, and protect your personal data when you use our review management platform. It is designed to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India and is aligned with the DPDP Rules, 2025 (notified November 2025; core fiduciary duties enforceable in phases through May 2027), along with other applicable privacy laws.

2. Data Fiduciary & Contact Information

BEYONDVYU is the Data Fiduciary under the DPDP Act. For any privacy-related inquiries, grievances, or requests to exercise your rights:

• Email: privacy@beyondvyu.com
• Grievance Officer: Contact us at privacy@beyondvyu.com — complaints will be acknowledged within 24 hours and resolved within 30 days as required by the DPDP Act.

3. Personal Data We Collect

We collect only the personal data necessary to provide our services:

• Account Data: name, email address, phone number, and password (password is hashed with bcrypt — never stored in plain text)
• Business Data: business name, address, phone number, website, Google Place ID, and Google Review URL
• Customer Feedback Data: ratings, comments, review drafts, and feedback submitted through our platform
• Usage Data: QR code scans, page visits, feature interactions, and platform activity logs
• Payment Data: Razorpay subscription and payment identifiers (we never store credit/debit card numbers, CVV, or bank account details)

4. Consent

Under the DPDP Act, we collect your personal data only after obtaining your free, specific, informed, unconditional, and unambiguous consent. You are required to:

• Explicitly consent to data processing before creating an account (no pre-ticked checkboxes)
• Accept our Privacy Policy and Terms of Service before using the platform

You may withdraw your consent at any time with the same ease as you gave it. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. To withdraw consent, visit your account settings or email privacy@beyondvyu.com.

5. Purpose of Data Processing

We use your personal data only for the following purposes:

• To create and manage your account
• To provide review management services (review requests, feedback collection, AI drafts)
• To send service-related notifications (new feedback, review reminders)
• To generate aggregated analytics and insights (anonymized where possible)
• To comply with legal and regulatory obligations
• With separate, specific consent: to send marketing updates, tips, and product announcements (you may opt out at any time)

6. Data Sharing & Disclosure

We do not sell your personal data. We share data only with:

• Razorpay (payment processing) — only Razorpay subscription/payment IDs are stored in our database; no card numbers, CVV, or bank details. Razorpay, as payment system operator, stores payment data in India per RBI requirements.
• Google— only when you choose to redirect customers to Google Reviews or connect Google Business Profile (subject to Google's own terms and privacy policy)
• AI providers (Google Gemini, with OpenRouter-routed DeepSeek failover) — customer feedback text you choose to process with AI features is transmitted for inference only to generate talking points, drafts, replies and insights. Primary inference is Google Gemini; if it is rate-limited or unreachable, requests fail over to DeepSeek via OpenRouter — inference only in both cases. We do not authorize use of your data to train models. See Terms §9 for details, retention, and your deletion rights.
• Meta / WhatsApp Business Platform— only if you connect a WhatsApp Business number and your customers/owners have opted in. Message content follows Meta's template and data policies; per-message rates apply. No auto-delivery happens until you connect and opt in.
• SMS provider— phone numbers and message text for review requests you explicitly send. Promotional SMS needs TRAI-registered headers/templates and recipient consent; transactional/service SMS follows your provider's DLT requirements.
• Service providers — hosting, email delivery, and analytics under strict data processing agreements
• Law enforcement — only when required by applicable law or valid legal process

7. Data Hosting & Transfers

Our database infrastructure uses India-region cloud services (AWS ap-south-1 / Mumbai), and payment data stays in India via Razorpay as required of payment system operators under the RBI April 2018 circular.

The DPDP Act (Section 16) does not impose a blanket “all personal data must always stay in India” rule — it permits transfers outside India except to countries the Central Government restricts. Where our subprocessors (e.g. Google AI inference, email delivery) process data outside India, we rely on this framework plus contractual safeguards, data minimisation, and your consent. AI inference data is not retained for training; deletion requests propagate per our processor terms.

8. Data Security

We implement industry-standard security measures:

• Encryption at rest (AES-256) and in transit (TLS 1.3)
• Passwords hashed using bcrypt with cost factor 12
• Token-based authentication with session expiry
• No raw PAN, CVV, or expiry stored anywhere
• Content Security Policy (CSP) headers configured
• Regular security audits and access controls

9. Data Retention

We retain your personal data for as long as your account is active. Upon account deletion, we delete or anonymize your data within 30 days unless retention is required by law (e.g., invoice records for tax purposes are retained for 7 years as required by Indian tax law).

10. Your Rights (DPDP Act)

Under the DPDP Act, you have the following rights:

• Right to know: information about the personal data collected and the purpose of processing
• Right to access: a summary of your personal data held by us and the processing activities
• Right to correction: update inaccurate or incomplete personal data
• Right to erasure: delete your personal data (subject to legal retention requirements)
• Right to grievance redressal: lodge a complaint with our Grievance Officer
• Right to nominate: nominate a person to manage your data in case of death or incapacity
• Right to withdraw consent: at any time, with the same ease as you gave it

To exercise any of these rights, email us at privacy@beyondvyu.com. We will respond within 30 days as required by the DPDP Act.

11. Cookies & Tracking

We use cookies and similar technologies to improve your experience and analyze platform usage. When you first visit our website, you will be asked to consent to non-necessary cookies. You can categorize your preferences as follows:

• Necessary: required for basic functionality (session management, authentication). Always enabled.
• Analytics: help us understand how you use our platform to improve it
• Marketing: used to deliver relevant advertisements and track campaign effectiveness

You can change your cookie preferences at any time by clicking “Cookie Preferences” in the footer. You may withdraw consent for analytics and marketing cookies at any time.

12. Children's Data

Our services are not directed at children under 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or through a notice on our platform. Continued use of BEYONDVYU after changes constitutes acceptance of the updated policy.

14. Data Breach Notification

If we become aware of a personal data breach, we will notify affected users without delay in clear, plain language through your account or registered contact details, describing what happened, its likely impact, what we are doing about it, and how to protect yourself. We will also notify the Data Protection Board of India without delay, with a detailed report within 72 hours as required by the DPDP Rules, 2025.

15. Grievance Redressal

If you have any complaints or concerns regarding your personal data, please contact our Grievance Officer:

• Email: privacy@beyondvyu.com
• Acknowledgment: within 24 hours
• Resolution: within 30 days

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India as provided under the DPDP Act.