Privacy Notice

VartiQ · version 2026-10-29 · PrayukTech

1. Who we are

PrayukTech ("we", "us") runs VartiQ, a messaging and community app. We decide why and how your personal data is used (we are the "data fiduciary" under India's Digital Personal Data Protection Act, 2023, "DPDP Act").

Registered address: Bhankrota, Jaipur. Contact: prayuktech@gmail.com.

Grievance Officer: Grievance Officer name, grievance@prayuktech.com. You can write to this person about anything in this notice (see section 9).

2. What personal data we collect, and why

We collect only what the app needs. The table lists each kind of data, what we use it for, and when we collect it.

Data	What we use it for	When
Mobile number	To create your account, send you login codes (OTP), let people who know your number find you, and keep your account secure	At sign-up and login
Email address (optional for a personal account, required for a business)	To send you a code to prove the address is yours, and for a business to show its contact email	Only if you give one
Devices you are logged in on (a name such as "Chrome on Windows", when you logged in and last used it)	To show you which devices are logged in to your account, warn you about a new login, and let you sign them out. A login ends after 30 days without use	At every login
Login PIN (only if you choose one; kept as a salted hash, never in readable form)	To ask for a second step at login, so a stolen SMS code alone cannot open your account	When you turn it on
Polls and events you create or answer in a chat (the question, options, title, date, place, details, and your votes and answers)	To count votes, show results, close polls on time and send event reminders to people in the chat. Unlike normal messages these are readable by our server and are not end-to-end encrypted	When you create or answer one
Name, username, "about" line	To show who you are to the people you chat with	At sign-up and when you edit your profile
Profile photos you add (a picture and a small thumbnail of each), and who you let see them	To show your picture next to your name to the people you choose (everyone, your contacts, or nobody; for people under 18, only people they chat with)	When you add a photo
Reports about a photo (who reported it, why, when)	To review reported photos and keep people safe	When someone reports a photo
Date of birth	To apply our age rules, to know when a young person needs a parent or guardian, and to end the parent's controls when the person turns 18	At sign-up
For people under 18: the name, relationship, mobile number and/or email of a parent or guardian; whether and when they agreed; and what they allow (calls, location sharing, being found by new people, public channels)	To ask the parent or guardian for permission, to give them the controls, and to contact them about the account	At sign-up, and when the parent or guardian decides
Email address (business accounts)	To verify a business account and contact it about its account	At business sign-up
Business details you add: category, opening hours, address, website, greeting and away messages, product catalogue with prices	To show your business profile to people who view it (these are visible to them)	When you set up a business profile
Messages: the text, the sender, the chat, the time, delivery and read status. Voice notes (audio)	To deliver your messages and show your chats on all your devices	When you send a message
Chats you belong to and the members of your groups	To deliver messages to the right people	When you start or join a chat
Status updates (text or photo)	To show them to your contacts for 24 hours, then they are removed	When you post one
Who viewed your status updates, and when	To show you who saw your status. Deleted with the status after 24 hours	When someone views a status
Developer tools, if you use them: API keys (kept only as a hash), webhook addresses and a short log of recent deliveries	To let your own software use your account and to show you whether deliveries worked	When you create a key or webhook
Channel posts and channels you create or follow	Channels are public: anyone can read them and see who owns them	When you create, post to or follow a channel
Who viewed your profile and when (last view date only)	To show you the people who looked at your profile. Kept for 90 days. You can switch this off, which also erases your list	When someone opens your profile, if both of you have the setting on
Call history: who, when, call type, how long; whether a call was recorded	To show your call history. The call itself is not stored by us	During and after a call
Device information: a name for each device, and the public encryption key of each device	To encrypt your messages for your devices and let you manage them	When you first use the app on a device
Secret code for locked or hidden chats (stored only as a one-way hash); fingerprint or face unlock credentials (public key only; your fingerprint or face never leaves your device)	To protect chats you choose to lock or hide	When you turn these on
Notification settings of each device you turn notifications on for: an address at your browser maker's push service with its keys, a short description of the browser, and what you chose to be notified about	To send you a notification for a new message or call when the app is closed. A notification says who and what kind ("Asha: New message", "Incoming video call"), never the message itself	When you turn notifications on
A location you choose to share: coordinates and how accurate they are. For a live location, only the latest position while you are sharing	To show it to the people in the chat you shared it with. We never read your location in the background or when you are not sharing	Only when you tap Share location
Your settings: theme, translation languages per chat, blocked people, privacy options, language	To keep the app the way you set it on all your devices	When you change them
Verification status (yes or no and the date)	To show the Verified badge. We do NOT store your ID number or any ID details (see section 4)	After you verify
Premium subscription: plan, period, and for each payment the amount, date, and the payment provider's payment number (a receipt)	To give you Premium features, show your receipts, and keep accounting records. Card, UPI and bank details go to the payment provider (Razorpay) and never reach us	When you buy Premium
Reports you make about a channel (reporter, channel, reason)	To review reports and keep the service safe	When you report something
Technical and security data: IP address and request details processed by our hosting and network providers; one-time login codes (kept for a few minutes, only as a hash)	To deliver the service, prevent abuse and keep it secure	Whenever you use the app

We do not read your phone's contact book and we do not upload it.
We do not sell your personal data.

3. Your messages and end-to-end encryption

Messages and voice notes that you type or record in the VartiQ web app are end-to-end encrypted. They are encrypted on your device and can only be read on the devices of the people in that chat. Our servers store the encrypted text. Our staff and administrators cannot read it.

Messages sent through the VartiQ developer API (for example by a bot or another platform), and automatic business replies, are stored as readable text.
Public channel posts, status updates, profile and business details, group names, and the names of people in a chat are visible to our servers (and to the people allowed to see them).
Locations you share in the web app are end-to-end encrypted like messages. A location shared through the developer API is stored as readable coordinates.
Profile photos are not end-to-end encrypted: the people you allow can see them, and our moderators can see a photo that has been reported.
If you turn on message translation for a chat, your app sends the text of the messages you receive to a translation service so they can be translated (see section 4).
We can see who talks to whom, when, and how often (this is "metadata"), because the service needs it to deliver messages.
If you lose all your devices and the encryption keys on them, older encrypted messages may no longer be readable by you.

Some things are not end-to-end encrypted, and we want you to know which:

4. Who we share data with

We share personal data only as needed to run the service, and only with the following. We do not sell personal data.

Other users: what the app is designed to show them: your name, "about" line, whether you are online and when you were last seen (you can limit this), your business profile, public channel posts, status updates, and messages you send to them.
Service providers (data processors) who work for us under contract: a text-message and email provider (to send login codes); a cloud hosting and network provider, including a content delivery and security provider such as Cloudflare if we use one; a database provider; a relay (TURN) provider that helps voice and video calls connect when a direct connection is not possible. Call audio and video are encrypted in transit.
An identity verification provider, only if you choose to verify. Your ID number is sent to it once to confirm it, together with the one-time code. VartiQ does not store your ID number or any ID details; we keep only that you are verified and when.
Razorpay (our payment provider), only if you buy Premium. You pay on its own page, which handles your card, UPI or bank details; we send it your VartiQ username, the plan and an order reference so the payment can be matched to you (not your name, mobile number or email), and we receive a confirmation with the amount and a payment number, and nothing else about how you paid except the kind of method (for example UPI or card).
The push services of browser makers (Google, Mozilla, Apple, Microsoft), only if you turn notifications on. Notifications pass through the push service of your browser. It can see that a notification was sent to your device and when, but a notification carries no message text.
A map service, only if you tap "Open in map" on a location someone shared: your browser or map app opens with that position, and the map service you use can then see it. VartiQ itself loads no maps.
A parent or guardian, if you are under 18: they see your name and username, can switch calls, location sharing, being found by new people and public channels on or off, and can disable or delete your account. They cannot read your messages, which are end-to-end encrypted.
A translation provider, only if you turn translation on for a chat. The text of messages you ask to be translated is sent to it and handed back. VartiQ does not store or log these texts.
Authorities, when the law requires it or to protect people from harm, for example an order from a court or a government body.
A buyer or successor, if our business is sold or merged. Your data would stay protected by this notice.

5. Voice and video calls, and call recording

Calls go directly between devices where possible, or through a relay server that passes the encrypted media along. We do not record or store calls.

Any person on a call can ask to record it, and recording starts only after every other person on the call has agreed. The recording is made and saved on the device of the person who asked, and it is never sent to us. Please respect other people's privacy and the laws that apply to recording.

6. How long we keep data

Data	How long
Account data (profile, settings, contact details)	Until you delete your account; then erased within 24 hours
Messages and voice notes	Until you or the sender delete them, or the chat's disappearing-message timer removes them; the content of the messages you sent is erased within 24 hours of deleting your account (see section 7)
Status updates and who viewed them	24 hours
Logged-in devices (name and times)	Until you sign the device out, 30 days after you last used it, or you delete your account
Login PIN (a hash) and counters of wrong guesses	Until you remove the PIN or delete your account
Polls and events	Like messages: until the sender deletes them or a disappearing-message timer removes them, or the chat or account is deleted. Your votes and answers are removed when you delete your account
Developer API keys, webhooks and their delivery log	Until you delete them or delete your account
Notification settings of a device	Until you turn notifications off on that device, log out, or delete your account (and removed at once if the browser says the device is gone)
A shared location	A location you share once is a message and is kept like one. A live location keeps only the latest position (no trail), and it is erased when the time you chose is up (at most 8 hours) or when you tap Stop sharing; the chat then shows "Live location ended"
Profile photos	Until you remove them or delete your account (then erased within 24 hours). A photo that was reported and removed by us is deleted too
Reports about a photo	Until a moderator has decided, then deleted
A parent or guardian's details (for someone under 18)	Until the young person turns 18, when the contact details are erased (we keep only that a parent or guardian agreed, and when), or until the account is deleted
Profile-view list	90 days (only the last view date is kept), or until you switch the setting off
Login codes (OTP)	A few minutes; kept only as a one-way hash
Saved chats on your own device	Until you clear them or log out
Payment records (amount, date, plan, payment number)	As long as the law requires us to keep accounting records, also after you delete your account (without your name or contact details)
Basic record of a deleted account: username, registration date, when it was permanently disabled, what you accepted (which version, when), any subscription and verification record. No chats, media or personal data	Kept after you delete your account, for as long as needed to prove consent, prevent misuse (for example someone taking over a username) and meet legal and accounting duties
Backups	Erased data may remain in our backups for up to 30 days, then they are overwritten
Security and audit logs	For as long as needed to keep the service secure, and as the law requires

7. Your rights and choices

Under the DPDP Act (and similar laws) you have rights over your personal data. In the app, go to Settings → Privacy and consent:

Access: see what data we hold about you and download a copy ("Download my data").
Correction: change your name, "about" line and other profile details yourself at any time.
Deleting your account: choose "Delete my account". Your account is permanently disabled and your login stops working immediately. Within 24 hours we erase your chats and messages you sent (including voice notes), photos and other media, and your personal data: profile, mobile number, email, encryption keys and devices, statuses, channels, product catalogue, developer keys and settings. You leave your groups. We keep only a basic inactive record that the account existed (see section 6). Messages other people received remain on their own devices only as far as they already saved them. You can sign up again at any time; that creates a brand-new account with a new registration date and none of the old data.
Withdraw consent: you can withdraw the optional consents (translation, identity verification) at any time. Withdrawing is as easy as giving it. If you withdraw your consent to this notice and the Terms, we can no longer provide the service: delete your account.
Grievance redressal: contact our Grievance Officer (section 9). If you are not satisfied, you may complain to the Data Protection Board of India, once it is in place.
Nomination: you may nominate another person to exercise these rights for you if you die or become unable to.

We reply to rights requests within 15 days, or sooner if the law requires.

8. Security, storage and transfers

Connections to VartiQ use HTTPS. Messages typed in the web app are end-to-end encrypted. Login codes and secret codes are stored only as one-way hashes.
Access to administration tools is limited to authorised staff, protected by separate sign-in, and every administrator action is recorded in an audit log. Administrators can see account details (name, username, mobile number, email, account status, and counts such as the number of chats) to run and secure the service, and they can suspend accounts or remove reported channels. They cannot read end-to-end encrypted messages.
Your data is stored on servers located in: India. Our providers may process data in other countries; where they do, we require them to protect it as this notice describes and as the law requires.
If a breach of personal data happens, we will tell the Data Protection Board of India and the people affected, as the law requires.

9. Contact and complaints

Grievance Officer: Grievance Officer name
Email: grievance@prayuktech.com
PrayukTech, Bhankrota, Jaipur

You can also write to prayuktech@gmail.com.

10. Cookies and storage on your device

The VartiQ web app uses your browser's storage only for things the app needs: to keep you logged in, to keep your device's encryption key, to remember settings such as your theme, and (if you leave it on) to keep a copy of your chats so they open faster. You can clear this in Settings → Chats on this device, and it is removed when you log out. If you turn on notifications, a small background script (a service worker) is added to your browser so notifications can be shown. Your browser asks you before the app may send notifications or read your location, and you can change both in your browser's site settings at any time.

11. Children and young people

VartiQ is for people aged 8 and over. We ask for your date of birth when you sign up, and we do not create accounts for younger children.

If you are 8 to 17 you must give the name and a mobile number or email of a parent or guardian. We send them a private link. Your account opens when they agree, and until then you cannot use it. We do this because a young person's parent or guardian should decide whether and how their child uses the service. We cannot check who a parent or guardian really is: we rely on the details you give and on the private link reaching them.

A parent or guardian can, with that link: agree or decline; switch calls, location sharing, being found by new people and public channels on or off; disable your account for a while; or delete it (section 7). By default a young person's account does not share location and cannot be found or started chats with by people they are not already chatting with. Parents and guardians cannot read messages.

We never show advertising to anyone, and we do not use children's data for tracking or profiling. At 18 the controls end and we erase the parent's or guardian's contact details.

If you are a parent or guardian and did not agree to this, or the person is not your child, open the link and choose to delete the account, or write to us (section 9).

12. If you are in the EU, the UK or another country with its own privacy law

We use your data on these grounds: to provide the service you asked for (contract); with your consent for optional things such as message translation, identity verification and, for a young person, their parent's or guardian's agreement; to keep the service secure and prevent abuse (our legitimate interest); and to keep accounting records (a legal duty).

Besides the rights in section 7 you can ask us to restrict how we use your data, to move it ("Download my data" gives you a file you can reuse), and to stop uses based on our legitimate interest. We do not make decisions about you by automated means that have legal or similarly significant effects. You may complain to your national data protection authority.

When data is processed by a provider outside your country we require the safeguards the law asks for, for example standard contractual clauses. Contact us (section 9) for a copy.

13. Changes to this notice

We will update this notice when our practices change. The version date is at the top. If a change is important, we will tell you in the app and ask you to accept again before you keep using it.