Draft, not yet reviewed by counsel. This text describes what the platform does today and is being finalised. Items in [square brackets] are still to be filled in.
Privacy notice
Draft version 0.1, last updated 20 October 2026.
1. Who we are
VROWTH is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS], India (“we”, “us”). You can reach us at support@vrowth.in. Our grievance officer is [NAME], [EMAIL ADDRESS], [PHONE].
2. Whose data, and our role
VROWTH is software sold to agencies (“franchises”), who use it for their own clients. We therefore handle three kinds of people’s data:
- Agency staff and the agency itself. For this data we decide why and how it is used.
- An agency’s clients and their contacts. These people use the client portal.
- The clients’ own customers and audiences: buyers, people who book or register, and people who comment on an Instagram post. For this data the agency and its client decide why it is collected, and we process it on their instructions. [Counsel to confirm the roles under the Digital Personal Data Protection Act, 2023.]
3. What we collect
- Account: email address, role, the agency’s name, and the legal profile an operator enters (legal name, address, GSTIN, PAN).
- Sign-in: we send a one-time link to your email. There are no passwords.
- Licence and credit purchases: amounts, GST, invoice details and the payment reference and status from Razorpay. We never receive card or UPI numbers.
- Payment records. For all three kinds of payment on the platform (licences and credits, agency fees, and clients’ sales) we keep one record of the amount, GST, status, the payment account and the product. This record holds no buyer personal data. The platform operator sees only totals and statuses for clients’ sales; an agency sees payments for its own clients; a client sees its own.
- Orders and invoices: a buyer’s name and email and the details the law requires on a tax invoice or bill of supply.
- Instagram, when a client connects an account: the account id and username, an access token (stored encrypted), comments on the client’s posts that trigger an automation, the commenter’s id and username, and the messages we send for the client. The text of a comment is kept only while its automation run is waiting to be processed.
- Leads and contacts: Instagram ids and usernames, names, emails, tags, notes and the source of each lead, as entered or captured for the agency or client.
- Bookings and webinars: name, email and the time slot. If a client connects Google Calendar, an event is created in the client’s calendar, which can show the buyer’s name; the Google token is stored encrypted.
- Content and media: scripts and briefs, public Reels that our data providers return, and, only with a recorded consent, voice or face recordings and the videos made from them. These are kept in private, encrypted storage.
- Funnel analytics: counts of events such as page views and conversions on a client’s pages, stored in our own database.
- Technical: IP address and request details for security and rate limiting, and error logs.
4. Cookies
We set only the cookies needed to sign you in and to connect accounts: your session (two cookies), the sign-in link check, and short-lived (about ten minutes) cookies while you connect Instagram or Google Calendar. We do not use advertising or third-party analytics cookies.
5. Why we use it
To provide the service you or your agency signed up for, to bill and issue invoices, to keep the platform secure, and to meet legal duties such as tax record keeping. Where the law requires consent we ask for it, and you can withdraw it. [Counsel to set out the legal bases.]
6. Who we share it with
We use these service providers to run the platform:
- Supabase: database and sign-in (hosted in Mumbai, India).
- Vercel: hosting of the web application.
- Railway: the scheduler that runs background jobs.
- Cloudflare R2: private file storage (invoices, media).
- Resend: sending our emails.
- Razorpay: payments. Each agency, client and VROWTH uses its own Razorpay account.
- Meta (Instagram): when a client connects Instagram.
- Google: when a client connects Google Calendar.
When an AI or media feature is switched on we may also send the relevant text, audio or video to: DeepSeek, Zhipu AI, Alibaba Cloud (language and vision models); Groq (transcription); ElevenLabs (voice); D-ID and fal.ai (avatar and video); Pexels (stock footage); and Apify (collecting public Reels). We keep this list current. Some of these providers are outside India, so personal data may be transferred abroad. [Counsel to confirm the transfer wording and the processor agreements.]
We do not sell personal data. An agency may export a list of the email addresses of people who engaged with a client, to use in that client’s own advertising. The agency is responsible for telling those people and for honouring objections.
7. How long we keep it
| Data | Kept for |
|---|---|
| Leads and contacts | The agency sets 30 to 3,650 days; the default is 730 days |
| Automation runs that were sent | 30 to 365 days, set by the agency |
| Skipped or failed automation runs, and markers of deleted records | 30 days |
| Unpaid, abandoned orders | 7 days |
| Public Reels collected by Discover | 180 days since last seen |
| Records of calls to AI providers | 400 days |
| Security counters (rate limiting) | About 2 days |
| Orders, invoices and payment records | As long as tax and accounting law requires; they are not erased on request |
| Consent records for voice and face | Kept as evidence, including after a consent is withdrawn [counsel to confirm the period] |
8. Your rights
You can ask to see, correct or erase your personal data, to withdraw consent, or to complain. Contact the agency or business you dealt with, or write to support@vrowth.in. An agency can erase a lead from its records, export a copy of a client’s data, and erase the personal data of all of a client’s customers; orders, invoices and payment records are kept (section 7). If you connected Instagram, you can also remove our access in Instagram, which sends us a deletion request. We aim to answer within [30] days. [Counsel to confirm the response times and any rights under the Digital Personal Data Protection Act, 2023.] You may also complain to the Data Protection Board of India once it is operating.
9. Security
Instagram and Google tokens, payment-account credentials and private media are encrypted with a key kept outside the database. Each agency’s data is separated from every other agency’s at the database level. Every payment webhook is signature-checked before it is processed, and reads of stored credentials are logged. No system is perfectly secure; if there is a breach that affects you we will tell you as the law requires.
10. Children
VROWTH is for businesses and is not meant for anyone under 18. [Counsel to confirm.]
11. Changes
We will update this notice when the platform changes and show the new date at the top.