Privacy Policy

This Privacy Policy explains how ArivaanAI ("we", "us", "our") collects, uses, discloses, and protects personal data when you use Arivaan Chat, Arivaan Assistant, Arivaan Studio, Flash Cards, FitMind AI, Trip Planner, the Arivaan Orbit extension, the developer API, and arivaanai.com (together, the "Services").

ArivaanAI is the data controller (or, under India's law, the "Data Fiduciary") responsible for your personal data, operating from Whitefield, ITPL Main Road, Bengaluru – 560066, Karnataka, India. You can reach us at [email protected] or +91 80 4715 0000 for any privacy question or request, including grievances under India's Digital Personal Data Protection Act, 2023.

We collect the following categories of information:

We use personal data to provide and operate the Services and generate the output you request; authenticate your account and keep it secure; process payments, credits, and subscriptions; provide customer support; detect, prevent, and investigate fraud, abuse, or security incidents; comply with legal, tax, and regulatory obligations (including Indian GST and company-law recordkeeping); and send you service, security, and billing communications (and, only if you opt in, product updates).

Where GDPR/UK GDPR applies, our legal bases are: performance of a contract with you (providing the Services you sign up for); legitimate interests (security, fraud prevention, service improvement) balanced against your rights; consent (for special-category data you choose to submit, such as FitMind AI health data, and for optional marketing communications); and compliance with legal obligations (tax, accounting, law-enforcement requests).

We do not use your input, output, or other account content to train, fine-tune, or otherwise improve our own or any third party's general-purpose AI models. Your content is sent to the model provider we route your request to solely to generate the specific response you asked for, in real time.

Some requests are processed using third-party AI model providers, currently including OpenAI (United States), Alibaba Cloud's DashScope/Qwen models, and DeepSeek (each may process data outside your home country, including in the United States or China). We have contractual terms in place with these providers restricting their use of your data to providing the requested output. If a provider's own policies ever differ from this section in a way that affects you, we will disclose that clearly before routing your request to them.

ArivaanAI is based in India, and our infrastructure (currently hosted via Railway, with Render as a backup option) and our AI, payment, and email sub-processors may store or process data in India, the United States, and other countries — including transfers from the EEA, UK, Switzerland, and other jurisdictions to countries that may not have been assessed as providing an "adequate" level of protection under local law.

Where required (for example, under GDPR/UK GDPR for EEA/UK/Swiss users), we rely on appropriate safeguards for such transfers, such as Standard Contractual Clauses with our sub-processors or the sub-processor's own certified transfer mechanism. India's DPDP Act, 2023 permits transfer of personal data outside India except to countries restricted by the Central Government (none of our current sub-processor countries are restricted as of this policy's last-updated date).

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share personal data only with:

We retain personal data for as long as your account is active and as needed to provide the Services. After you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain it longer to comply with legal, tax, or accounting obligations (for example, payment and GST-related records are generally retained for the period required under Indian tax and companies law, typically up to 8 years), to resolve disputes, or to enforce our agreements.

Security and diagnostic logs are generally retained for a limited period (typically not more than 12 months) before being deleted or anonymized, unless needed longer for an active security investigation.

We use administrative, technical, and organizational measures — including encryption in transit, hashed passwords, and access controls — designed to protect personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify you and any required regulator as required by applicable law (including India's DPDP Act and, where applicable, GDPR's 72-hour supervisory-authority notification rule).

Wherever you are, you can generally ask us to: access the personal data we hold about you; correct inaccurate data; delete your account and associated personal data; export a copy of your data in a portable format; object to or restrict certain processing; and withdraw consent you previously gave (for example, for FitMind AI health data or marketing emails), without affecting processing that already occurred lawfully.

To exercise any of these rights, contact [email protected]. We will verify your identity and respond within the time required by applicable law (generally 30 days, or longer where extensions are legally permitted). We do not charge a fee for a reasonable request.

If you are a California resident, the CCPA (as amended by the CPRA) gives you the right to know what personal information we collect, use, and disclose; to delete it; to correct inaccurate information; to opt out of "sale" or "sharing" of personal information (we do not sell or share your personal information as those terms are defined by the CCPA); and to limit use of "sensitive personal information" (we only use it to provide the Services you request). We will not discriminate against you for exercising these rights.

Residents of other US states with comprehensive privacy laws (for example, Virginia's VCDPA, Colorado's CPA, and Connecticut's CTDPA) have equivalent rights of access, correction, deletion, portability, and opt-out of targeted advertising or sale (which we do not engage in), plus the right to appeal a denied request by contacting [email protected].

If GDPR or the UK GDPR applies to you, you have the rights described above, plus the right to lodge a complaint with your local data protection supervisory authority (for example, your national Data Protection Authority in the EU, or the ICO in the UK) if you believe our processing of your personal data infringes applicable law.

We have not appointed a formal Data Protection Officer; privacy inquiries and requests should be directed to [email protected]. We do not currently have an EU or UK representative appointed under Article 27 GDPR/UK GDPR; if our EEA/UK user base grows to a level requiring one, we will appoint one and update this policy.

If you are in India, the Digital Personal Data Protection Act, 2023 gives you (as a "Data Principal") the right to obtain a summary of your personal data and processing activities, to correction and erasure, to grievance redressal, and to nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

For any grievance under the DPDP Act, contact [email protected]; we aim to acknowledge and resolve grievances within the timelines the Act and its rules require. Users under 18 are treated as children under the Act, and consent-dependent features (such as FitMind AI) are only available to them with verifiable consent of a parent or lawful guardian.

Brazil (LGPD): you have rights of confirmation, access, correction, anonymization, portability, deletion, and information about data sharing, and may complain to the Autoridade Nacional de Proteção de Dados (ANPD).

Canada (PIPEDA): you have the right to access and challenge the accuracy of your personal information, and to complain to the Office of the Privacy Commissioner of Canada.

Australia (Privacy Act 1988): you have rights of access and correction under the Australian Privacy Principles, and may complain to the Office of the Australian Information Commissioner (OAIC).

If you are in a jurisdiction not specifically named in this policy, we will still honor the global baseline rights described above, plus any additional rights mandatory under your local law.

The Services are not directed to children under 13 (or under 16 in the EEA, UK, and Switzerland). Users below the age of majority in India (18) may only use consent-dependent features, such as FitMind AI, with verifiable parental or guardian consent. If we learn we have collected personal data from a child in violation of this policy, we will delete it promptly; contact [email protected] if you believe this has occurred.

We may update this Privacy Policy from time to time. We will update the "Last updated" date, and for material changes that affect your rights, we will provide additional notice (for example, by email or an in-product notice) before the change takes effect.

Questions, requests, or grievances about this Privacy Policy can be sent to [email protected], by phone at +91 80 4715 0000, or by post to ArivaanAI, Whitefield, ITPL Main Road, Bengaluru – 560066, Karnataka, India.