Privacy Policy

BVM AI ("we", "us") is an Indian AI-powered educational platform. This policy explains, in plain language, what personal data we collect, why we collect it, who processes it on our behalf, and the rights you have under the Digital Personal Data Protection Act, 2023 (India) ("DPDP Act") and the Information Technology Act, 2000.

1. Data We Collect

• Account data — your email address, display name, and (if you create a password) a securely hashed password. If you sign in with Google, we receive your email and basic profile info from Google.
• Chat content — prompts you send and AI responses, stored against your account so you can revisit your history. Free-tier chat history is stored only in your browser (localStorage); paid-tier history is also stored on our servers.
• Uploads — PDFs and images you upload for analysis (PDF Analyzer, Flashcards, Exam Mode). These are processed by Google Gemini and the extracted text may be cached for short periods to speed up repeated requests.
• Payment data — payments are collected by Razorpay. We never see or store your card, UPI PIN, or bank credentials. We store only the Razorpay order and payment reference, the amount, the plan purchased and the payment status.
• Subscription data — your plan (free / pro / ultra), billing cycle, amount paid, and verification status.
• Usage data — feature counters (messages sent, PDFs analyzed, flashcards / exams generated per day) used for rate-limiting and quota enforcement.
• Technical logs — IP address, browser, device type, and basic request metadata captured by our hosting infrastructure for security, debugging, and abuse prevention.

We do not knowingly collect data from children under 13. The service is intended for students aged 13+ and, for users under 18 in India, with parental / guardian consent as required by the DPDP Act.

2. How We Use Your Data

• To operate the service — authenticate you, generate AI responses, store your history.
• To confirm payments through Razorpay and activate paid plans.
• To prevent fraud, duplicate submissions, and abuse.
• To enforce per-plan rate limits and feature quotas.
• To improve product quality and fix bugs.
• To comply with Indian law, including responding to lawful requests.

We do not sell your personal data. We do not share it with advertising networks. We do not use your prompts or uploads to train our own AI models.

3. Third-Party Processors

We use a small number of trusted service providers ("data processors" under the DPDP Act) to operate the platform. Your data is only shared with them to the extent needed to provide the relevant feature.

• Lovable Cloud (Supabase infrastructure) — authentication, database, file storage, and serverless functions. Your account info, chat history (paid users), uploads, payment records and subscription state are stored here.
• Google Gemini API — processes your PDF Analyzer text, Exam Mode prompts, Flashcard generation prompts and chat messages. Subject to Google's Privacy Policy.
• Sarvam AI — processes chat messages for AI responses tailored to Indian languages. Subject to Sarvam AI's Privacy Policy. For reliability, chat and study features may also be served by the Lovable AI Gateway (OpenAI models) or DeepSeek when a primary provider is unavailable; only the prompt text needed to answer you is sent.
• Razorpay — processes all card, UPI, net-banking and wallet payments. Razorpay receives your name, email and payment instrument details directly; we receive only the transaction reference and status. Subject to Razorpay's Privacy Policy.
• Google Sign-In — used only if you choose Google as your login method.

We do not currently use Google Analytics, Mixpanel, Facebook Pixel, or any third-party advertising / ad-tech network.

4. Cookies & Local Storage

We use only essential cookies and browser storage required for the service to function. See our Cookie Policy for the full list.

5. Data Retention

• Account data is retained while your account is active.
• Chat history (paid users): retained until you delete it or close your account.
• Uploads (PDFs): retained for the active session and short-term cache.
• Payment records: retained for up to 24 months (8 years where required for tax records) for fraud-prevention and audit obligations under Indian law.
• Technical logs: typically up to 90 days.

On account deletion we erase or anonymize your personal data, except records we are required to keep under law (e.g. financial records).

6. Security

We use TLS in transit, encrypted storage at rest, hashed passwords, row-level security on our database, signed access tokens for APIs, and file-type validation on uploads. No system is completely secure, but we apply reasonable safeguards.

7. Your Rights (DPDP Act, 2023)

You have the right to: (a) access the personal data we hold about you, (b) request correction of inaccurate data, (c) request erasure of your data, (d) withdraw any consent you've given, and (e) nominate another person to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email tikrushna.dev@gmail.com. We will respond within the timelines required by law.

8. Grievance Officer

As required under the IT Act and DPDP Act, our Grievance Officer for privacy-related complaints can be reached at tikrushna.dev@gmail.com. We acknowledge complaints within 48 hours and aim to resolve them within the statutory 30 days.

9. International Transfers

Our AI processors (Google, Sarvam, OpenAI, DeepSeek) may process your data on servers outside India in accordance with their own privacy terms. We rely on the contractual protections offered by these providers and on Section 16 of the DPDP Act.

10. Changes

We may update this policy. Material changes will be announced in the app or by email at least 7 days before they take effect.