Privacy Policy

Welcome to Vaayu ("we", "our", or "us"). Vaayu is an AI-powered Indian music generation platform operated by Vaayu Technologies Private Limited, a company incorporated under the Companies Act, 2013, with its registered office in India.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you access or use our website at vaayus.com and any related services (collectively, the "Service"). It is drafted in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and its rules, as applicable in India.

By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

We collect the following categories of personal data:

a) Information you provide directly

• Account information: name, email address, password (stored in hashed form), and profile details.
• Payment information: billing name, address, and payment method details (processed securely by our payment partner; we do not store raw card data).
• User-generated content: song descriptions, prompts, and preferences you submit to generate music.
• Communications: messages you send us via contact forms, email, or support channels.

b) Information collected automatically

• Device and browser information: IP address, browser type and version, operating system, device identifiers.
• Usage data: pages visited, features used, clicks, session duration, and error logs.
• Cookies and similar tracking technologies (see Section 7 below).

c) Information from third parties

• If you sign in via Google, Apple, or any other third-party provider, we receive basic profile information (name, email, profile picture) from that provider.

We use your personal data for the following purposes:

• To create and manage your Vaayu account.
• To process your song generation requests and deliver the resulting audio.
• To process payments and manage your subscription.
• To send you transactional emails (account verification, receipts, password resets).
• To send you product updates and promotional communications — you may opt out at any time.
• To improve, personalise, and expand our AI models and Service features.
• To detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• To comply with applicable Indian laws, regulations, court orders, and government requests.
• To enforce our Terms of Service.

Under the DPDP Act, 2023, we process your personal data on the following grounds:

• Consent: where you have given us explicit consent (e.g., marketing emails, optional analytics).
• Contract: where processing is necessary to perform our contract with you (e.g., delivering generated songs, billing).
• Legitimate interests: where we have a legitimate business interest that does not override your rights (e.g., fraud prevention, service security, product analytics).
• Legal obligation: where we are required to process data to comply with Indian law.

We do not sell your personal data. We may share it only in the following circumstances:

• Service providers: trusted vendors who assist us with cloud hosting (RunPod, AWS, GCP), payment processing (Razorpay), email delivery, and analytics — bound by data processing agreements.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, subject to equivalent privacy protections.
• Legal requirements: where required by Indian law, court order, or a request by a competent government authority.
• Protection of rights: where disclosure is necessary to protect the rights, property, or safety of Vaayu, our users, or the public.

We do not transfer your personal data outside India unless adequate data protection safeguards are in place as required under the DPDP Act.

We retain your personal data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

• Account data is retained for the duration of your account and for up to 3 years after deletion, unless a longer period is required by law.
• Generated audio files are retained for 90 days after creation. After that, they are permanently deleted unless you have downloaded them.
• Payment records are retained for 7 years as required under the Income Tax Act, 1961.

We use cookies and similar technologies to operate the Service, remember your preferences, and understand how you use Vaayu.

• Essential cookies: required for the Service to function (session management, authentication). Cannot be disabled.
• Analytics cookies: help us understand usage patterns (e.g., page views, feature adoption). You may opt out via our cookie banner.
• Marketing cookies: used to show you relevant promotions. You may opt out at any time.

You can control cookies through your browser settings. Disabling non-essential cookies will not prevent you from using the core Service.

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access: obtain a summary of the personal data we hold about you and how it is processed.
• Right to correction: request correction of inaccurate or incomplete personal data.
• Right to erasure: request deletion of your personal data, subject to our legal retention obligations.
• Right to grievance redressal: raise a grievance with our Data Protection Officer and receive a response within a reasonable time.
• Right to nominate: nominate another person to exercise your rights on your behalf in the event of your death or incapacity.
• Right to withdraw consent: withdraw consent at any time for processing based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact our Grievance Officer (see Section 11). We will respond within 30 days as required by applicable law.

Vaayu is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal data without verifiable parental consent, we will delete it promptly. If you believe a minor has registered, please contact us immediately.

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction, including:

• TLS/HTTPS encryption for all data in transit.
• AES-256 encryption for sensitive data at rest.
• Access controls and role-based permissions for our internal team.
• Regular security audits and vulnerability assessments.

However, no method of transmission over the internet is 100% secure. In the event of a personal data breach, we will notify affected users and the relevant authority as required under applicable Indian law.

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the details of our Grievance Officer are:

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will notify you of material changes by email or by posting a prominent notice on the Service at least 15 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

This Privacy Policy is governed by and construed in accordance with the laws of India. Any disputes arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts in India.