This version takes effect on 13 October 2026.Until then, version 1.3 applies. What is new: the data held by apps you publish with Swarvani Cloud and our role for it (3.11–3.13, §16), the providers that serve those apps (6.2, 6.14), and how long it is kept (8.8–8.11).
1. Who we are
1.1Swarvani is operated by Swarvani AI Pvt. Ltd., registered at 910, 9th Floor, Signet The Business Hub, Akshar Chowk, Vadodara, Gujarat 390007, India. For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here.
1.2Contact for anything on this page: privacy@swarvani.com.
2. Scope
2.1This policy covers swarvani.com, app.swarvani.com, and the applications you build with Swarvani that we host on our subdomains.
2.2It does not cover third-party websites we link to.
3. What we collect
| # | Data | Where it comes from |
|---|---|---|
| 3.1 | Email address | You, at account creation |
| 3.2 | Password, stored only as a salted hash | You, if you use email sign-in |
| 3.3 | Google or GitHub account identifier and email | The provider, if you use social sign-in |
| 3.4 | Two-factor authentication secret | Generated if you turn on 2FA |
| 3.5 | Speech transcripts — the text of what is said in a session | Transcribed from your microphone |
| 3.6 | Tasks, requirements and source code generated for you | Produced by the service from 3.5 |
| 3.7 | Credit balance and ledger entries | Your usage |
| 3.8 | Payment references: order ID, payment ID, amount, status | Razorpay, after a purchase |
| 3.9 | Technical logs: IP address, browser, timestamps, errors | Automatically, on every request |
| 3.11 | Data your published app stores — the records it keeps and the files its users upload | Your app’s users, through the app (Swarvani Cloud) |
| 3.12 | Your app’s users’ accounts: email address, password stored only as a salted hash, role, and sign-in records | Your app’s users, when they sign up or sign in |
| 3.13 | Usage of your app: request counts, database and file storage size, emails sent, number of signed-up users | Measured by the service |
3.10We do not collect your name, phone number, postal address, date of birth, government identifier, or any card, UPI or bank details. Card and UPI details are entered directly into Razorpay’s checkout and never reach our servers.
4. Voice and transcripts
4.1When a session is live, your browser sends roughly five-second audio chunks to our transcription service, which forwards them to an India-based speech-to-text processing provider for Gujarati and English transcription.
4.2We never store the audio. It exists in memory for the duration of one request and is discarded. There is no recording file, no audio archive, and nothing to download or replay.
4.3We store only the resulting text, and we do not keep it. It is written to the database, used to build your tasks within seconds, and then deleted automatically — normally within an hour of the session ending, and in no case later than 3 days. We are not accumulating a transcript archive, and there is no way for you or for us to browse past conversations.
4.4We do not perform speaker identification, voice-print matching, speaker diarisation, emotion recognition, or sentiment inference. We do not create a biometric identifier from your voice, and we cannot tell who in a room said what.
4.5We do not train any AI model on your voice, your transcripts, or your code, and we do not permit our vendors to.
4.6Anyone whose voice is captured is a person whose data we process. If you run a session with other people in the room, you are responsible for telling them it is running — see clause 4 of the Terms of Service.
5. Why we process each item
| # | Purpose | Data used |
|---|---|---|
| 5.1 | Create and secure your account | 3.1–3.4, 3.9 |
| 5.2 | Turn what you say into tasks, requirements and software | 3.5, 3.6 |
| 5.3 | Meter and bill credits | 3.7, 3.8 |
| 5.4 | Keep the service up, debug failures, prevent abuse | 3.9 |
| 5.5 | Tell you about material changes to the service or these terms | 3.1 |
| 5.7 | Run the apps you publish, on your instructions: store and serve their data, sign their users in, send their verification and password-reset email | 3.11, 3.12 |
| 5.8 | Apply your app’s usage limits and tell you when it nears them, is limited, or has old data due for removal | 3.1, 3.13 |
5.6We do not use your data for advertising, for profiling, or for automated decisions that produce legal effects. We do not sell or share personal data, in the sense given to those words by the California Consumer Privacy Act or any comparable law.
6. Who we share it with
| # | Recipient category | What it gets | Where |
|---|---|---|---|
| 6.1 | Managed database and authentication provider | Account, transcripts, projects, ledger | India (Mumbai) |
| 6.2 | Cloud infrastructure and content-delivery providers | Compute, storage and hosting for your generated apps, including the databases and file storage of apps you publish (3.11, 3.12) | India (Mumbai), global CDN edge |
| 6.3 | Speech-to-text processing provider | Audio chunks, for transcription only | India |
| 6.4 | AI routing and model-access provider | Transcript text and code, routed to the relevant AI models | United States / global |
| 6.5 | Task-structuring AI model provider | Transcript text, for structuring into tasks | Global |
| 6.6 | Code-generation AI model provider | Task text and project source code, for code generation | Global |
| 6.7 | Razorpay, our payment processor | Payment amount and an internal order reference | India |
| 6.8 | Transactional email provider | Your email address, to deliver transactional email | United States |
| 6.9 | Bot-protection and edge-security provider | IP address, for bot protection on our forms | Global |
| 6.10 | Website hosting and analytics provider | IP address and page-view data, for hosting and analytics | Global |
| 6.11 | Product analytics provider | With your consent only, from your browser: pages visited, features used, approximate location from IP address, and a masked recording of your interactions (see §12.5). Regardless of that choice, our servers record that certain account events happened — a project created, a recording transcribed, a build finished, a purchase completed (with its amount and the state of supply) — against your account identifier and your email address. These are records of the service we performed for you under our contract, not browser tracking, and no transcript, prompt or project content is ever sent | United States |
| 6.14 | Email delivery provider for your published apps | Your app user’s email address and the verification or password-reset message your app sends them | India (Mumbai) |
6.12We contractually require these providers to process data only for the services we ask them to perform and to keep it secure. Providers may be added, removed or replaced over time; this page describes the current recipient categories, their roles, the data they receive and where they process it.
6.13We disclose data to law enforcement only against a valid legal demand, and we tell you unless we are legally barred from doing so.
7. Where your data goes
7.1Your account, transcripts and projects are stored in India.
7.2The AI processing providers at 6.4–6.6 and the services at 6.8–6.11 process data outside India. India permits transfer to any country not specifically restricted by the Central Government; none of these are restricted today.
7.3Our AI routing provider selects a model host dynamically for performance. We do not pin a single model host, so the physical location of AI inference varies between requests.
8. How long we keep it
| # | Data | Kept for |
|---|---|---|
| 8.1 | Speech transcripts | Deleted about an hour after the session ends. 3 days is the hard ceiling, applied by the database itself even to a session left open. |
| 8.2 | Sessions | A session goes idle after 60 minutes of silence and closes after 7 days. Its working files are deleted when it closes. |
| 8.3 | Project files and generated code | Until you delete the project |
| 8.4 | Account record | Until you ask us to delete it |
| 8.5 | Credit ledger and payment records | 8 years, as required by Indian tax and company law |
| 8.6 | Security and access logs | 1 year, as required by the DPDP Rules |
| 8.8 | Your published app’s data and its users’ accounts (3.11, 3.12) | Until you or your app deletes it, or you delete the project (8.9) |
| 8.9 | A project you delete | Offline at once, restorable for 7 days, then permanently deleted with all of its data, files and source code |
| 8.10 | Old data your app no longer uses (a replaced copy of a table, a removed column) | Removed after at least 7 days’ notice to you; a copy is kept 30 days after removal, then deleted |
| 8.11 | Usage counts (3.13) | Daily counts 90 days, monthly totals 400 days; summaries kept with the project’s accounting records |
8.7Deleting your account does not delete 8.5. We are not permitted to erase financial records on request.
9. Your rights
Under the DPDP Act you may:
9.1Access — get a summary of the personal data we hold about you and who we have shared it with;
9.2Correct, complete, update or erase — fix anything wrong, subject to 8.5;
9.3Nominate — name another person to exercise these rights on your behalf if you die or become incapacitated;
9.4Withdraw consent — at any time, as easily as you gave it. Withdrawing consent means we can no longer provide the service, so it ends your account;
9.5Complain — to us first, and then to the Data Protection Board of India.
9.6To exercise any of these, email privacy@swarvani.com from your registered address. We respond within 30 days, and never later than 90.
9.7We will not charge you, and we will not make you fill in a form, to exercise a right.
10. Grievance redressal
10.1Grievance Officer: Dhrumil Patel, Swarvani AI Pvt. Ltd., 910, 9th Floor, Signet The Business Hub, Akshar Chowk, Vadodara, Gujarat 390007, India. grievance@swarvani.com · +91 78020 32338
10.2We acknowledge every complaint within 24 hours and resolve it within 15 days. Requests to remove unlawful content are acted on within 72 hours.
10.3Privacy complaints are resolved within 90 days at the outside.
10.4If we have not resolved it, you may complain to the Data Protection Board of India.
11. Security
11.1Encryption in transit (TLS) and at rest. Passwords are hashed, never stored or recoverable in plain text.
11.2Row-level security in the database: every query is scoped to the signed-in user, enforced by the database itself and not only by application code.
11.3Optional TOTP two-factor authentication, which we recommend you turn on.
11.4Bot protection on all public forms.
11.5Access to production data is restricted to named personnel and logged.
11.6If a breach affects your personal data we will tell you without delay, describing what happened, what it means for you, what we have done, and who to contact.
12. Cookies and local storage
12.1Authentication cookies keep you signed in. Removing them signs you out.
12.2Our bot-protection provider sets a cookie when you complete a bot challenge.
12.3Our website analytics provider sets an identifier for aggregate page-view and performance analytics.
12.4Our product analytics provider sets an identifier so we can tell one visit from another and see how features are used. It is set only if you choose “Allow” on the banner we show you on your first visit. Nothing is stored and nothing is collected before you answer. If you decline, we still count the visit, but through a rotating one-way value that cannot be linked back to you or to any other visit, and nothing is written to your device. This choice governs what your browsersends. It does not switch off the account event records described at §6.11, which our servers keep whichever way you answer, because they are how we account for the service we performed for you.
12.5If you allow product analytics, we also record a playback of your interactions with the product — the pages, clicks and movements that make up a session — so we can see where the product is confusing or broken. All text and every form field are masked before the recording leaves your browser, so the content of your conversations, transcripts, email address and billing details are never captured. We do not record the billing, invoice or account settings screens at all.
12.6You can change your answer at any time by clearing this site’s data in your browser, which makes the banner appear again on your next visit. You can also withdraw consent as described in §10.
12.7Your browser’s local storage holds your theme preference, whether you have seen the intro animation, and your answer to the analytics banner.
12.8We use no advertising cookies and no cross-site tracking cookies. We do not sell your data, and we do not share it with advertising networks.
13. Children
13.1Swarvani is for users aged 18 and over. We do not knowingly collect data from anyone under 18, and we do not direct any advertising at children.
13.2If you believe a child has created an account, email privacy@swarvani.com and we will delete it.
14. AI disclosure
14.1Swarvani is an AI system. When you speak to it, you are interacting with software, not a person.
14.2AI output can be wrong. Review generated requirements and code before relying on them — see clause 7 of the Terms.
15. Users in the EU and UK
15.1We are based in India and do not target the EU, the EEA or the UK. If you use Swarvani from there, the GDPR may nevertheless apply.
15.2Where it does, our lawful bases are performance of a contract (5.1–5.3), legitimate interests in keeping the service secure (5.4), and consent (5.5).
15.3You may request access, rectification, erasure, restriction and portability, and object to processing, using the contact at 9.6.
15.4We have not appointed an Article 27 representative. If you need one to exist before you can use Swarvani, contact us before signing up.
16. Apps built on Swarvani, and their users
16.1When you publish an app with Swarvani Cloud, the data its users give it (3.11, 3.12) belongs to you, the app’s owner. For that data you are the Data Fiduciary and we are your Data Processor: we store it, serve it and send its email only to run your app, and we do not use it for anything else, train any model on it, or share it except with the providers at 6.2 and 6.14 that run the app.
16.2If you use an app built on Swarvani, its owner decides what it collects and is responsible for telling you; ask them first about your data. If they cannot be reached, or you think an app is misusing your data, write to privacy@swarvani.com and we will help.
16.3App users’ passwords are stored only as salted hashes. Each app’s data is kept apart from every other app’s, and can only be read through that app’s own access rules.
17. Changes
17.1We post any change here with a new version number and date. Material changes are emailed to registered users at least 7 days before they take effect.
18. Contact
18.1Swarvani AI Pvt. Ltd., 910, 9th Floor, Signet The Business Hub, Akshar Chowk, Vadodara, Gujarat 390007, India · privacy@swarvani.com · support@swarvani.com · +91 78020 32338