The short version
- We collect what we need to make your reels: your name, email, phone, what your business does, and the photos, clips and text you give us.
- Your photos and text are sent to AI providers so they can write the script, speak the voiceover and build the video. Under their business terms, your content is not used to train their models.
- We never sell your data.
- WhatsApp and marketing messages go out only if you tick the box. You can untick it any time.
- We don’t see your card or UPI details — Razorpay handles payment.
1Who is responsible for your data
The Marketing Craft (proprietor T S K Pavan Kumar), operating the Tvaritha service, is the Data Fiduciary for the personal data described here, under the Digital Personal Data Protection Act, 2023. This policy covers www.tvaritha.com, app.tvaritha.com and everything we do through them.
Where your reel includes a photo of another person, or your business information includes staff or customer details, you are responsible for having their consent; we process it on your instruction.
2What we collect
You give us
- Account details — name, email address, mobile number, password (stored only as a cryptographic hash, never in readable form).
- Business profile — business name, what you sell, location, customers, pricing, tone and anything else you enter during onboarding or in your brand profile. If you upload a poster or give us a website address, we read it to fill these in for you.
- Media — photos, video clips and logos you upload.
- What you want the reel to say — the idea text you type or speak, and your language and voice choices.
- Billing details — GSTIN, registered business name and state, when you give them for an invoice.
- Support messages — what you write to us by email, WhatsApp or the in-app problem report.
Created as you use Tvaritha
- Generated scripts, voiceovers, captions, hashtags and rendered videos.
- Credit balance, credit ledger, recharge history and GST invoices.
- Subscription status for auto-posting.
- Access tokens for social accounts you connect, held by our posting provider.
- Technical logs — IP address, device and browser type, pages and actions, timestamps, and error records.
- Your consent record — what you agreed to, when, and from where.
What we do not collect
We never receive your card number, CVV, UPI PIN, net-banking credentials or bank account number. Those go straight to Razorpay. We only get back a payment ID, amount, method and status.
3Why we use it
| What | Why |
|---|---|
| Account details | To create and secure your account, sign you in, and send service messages. |
| Business profile | To ground every reel in your actual business, so the script sounds like you and not like a template. |
| Media and idea text | To generate the script, voiceover, captions and video you asked for. |
| Payment records | To grant credits, issue GST invoices and meet tax and accounting obligations. |
| Social tokens | To publish to the accounts you connected, when you ask us to. |
| Logs | To keep the service running, find and fix faults, prevent abuse and fraud, and see which features are used. |
| Phone number | Service messages always. Marketing on WhatsApp or SMS only if you opted in. |
We do not sell your personal data, and we do not share it with data brokers. We use Meta’s and Google’s advertising and analytics tools to measure and improve our own ads (see section 13); these receive limited activity data and a hashed, irreversible form of your email or phone for matching. Apart from that, we do not share your personal data with advertisers.
4Consent, and how to withdraw it
We process your data on the consent you give when you create an account and use the service, and to perform our contract with you. Consent for marketing messages is separate and optional — see section 8.
You can withdraw consent at any time by writing to support@tvaritha.com. Withdrawing the consent we need to run the service means we can no longer provide it, so we will close your account. Withdrawing marketing consent changes nothing else.
5How AI processing works
Making a reel means sending your content to AI services that we don’t own:
- Your idea text and business profile, and the photos you uploaded, go to a large language model, which reads them and writes the script and caption.
- The script text goes to a speech service, which returns the voiceover audio in the voice and language you picked.
- If you asked Tvaritha to create visuals because you had no photo, your description goes to an image generation service.
- Your media and audio go to a video rendering service, which assembles the finished reel.
We use the business or API tiers of these services. Under those terms, content we send is processed to return a result and is not used to train their models. Each provider keeps content briefly for abuse monitoring in line with its own policy.
Automated generation is not a decision that produces legal effects for you — nothing is approved, refused or scored about you. You are always the one who decides whether a reel gets published.
6Who we share data with
We share only what each provider needs, and only to run the service:
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Database, authentication, file storage | Account details, business profile, media, generated content |
| Render | Application hosting | Requests and logs |
| Anthropic, Google, OpenAI | Script and caption generation; reading posters and websites | Idea text, business profile, uploaded photos |
| ElevenLabs | Voiceover and music | Script text |
| JSON2Video | Video rendering | Media, audio, captions |
| Upload-Post | Publishing to social platforms | Social account tokens, the video and caption |
| Meta, Google, LinkedIn | The platforms you publish to | Whatever is in the post you publish |
| Razorpay | Payments and subscriptions | Name, email, phone, amount, payment details you enter with them |
| Resend | Transactional email | Name, email, invoice contents |
| WhatsApp Business (Meta) | WhatsApp messages, if you opted in | Name, phone number |
| Meta Pixel & Conversions API; Google Ads & Analytics | Measuring and improving our own advertising | Pages visited and actions such as sign-up, first reel and recharge; a hashed (irreversible) form of your email and phone, used only for matching |
We may also disclose data where the law requires it — to a court, tax authority or law-enforcement agency acting under lawful process — and to our accountant or legal adviser under a duty of confidence. If the business is ever sold or reorganised, data may transfer with it, and we will tell you.
7Data leaving India
Some of the providers above process data on servers outside India. Where that happens we rely on the provider’s contractual commitments to protect the data, and we transfer only to countries not restricted by the Government of India under the Digital Personal Data Protection Act, 2023.
8WhatsApp, SMS and email
Service messages — sign-up, password reset, payment receipt, GST invoice, a reel or post finishing or failing, support replies, notices about changes — are part of the service and go to every account holder.
Marketing messages — tips, reminders, offers, feature news — are sent on WhatsApp, SMS or email only to people who have opted in. That opt-in:
- is a tick box you choose yourself, never pre-ticked and never bundled into the terms;
- tells you plainly that Tvaritha (The Marketing Craft) will message you on the number you gave;
- is not a condition of signing up, of getting free credits or of buying anything;
- is recorded with a timestamp so we can show when and how you gave it.
To stop them: reply STOP to any WhatsApp message, switch marketing messages off on your Account page, click unsubscribe in an email, or write to support@tvaritha.com. We act promptly. We keep a suppression record of your number afterwards so we don’t message you again by mistake.
9Connected social accounts
When you connect Instagram, Facebook, YouTube, LinkedIn or Google Business Profile, our posting provider holds an access token for you. We use it only to publish what you asked us to publish, and only while auto-posting is on. When you disconnect, cancel, let the subscription lapse, or close your account, we delete the posting profile and the tokens it holds. Content already published stays on the platform — remove it there if you want it gone.
10How long we keep it
- Account and business profile — while your account is open, then deleted or anonymised within 90 days of closure.
- Uploaded media and finished reels — while your account is open, or until you delete the post. Deleted files leave backups within 30 days.
- Payment records, GST invoices and the credit ledger — for 8 years, as tax law requires. These are kept even after you close your account.
- Consent and opt-out records — for as long as we may contact you and for 3 years after, so we can evidence what you agreed to.
- Technical logs — up to 12 months.
11Your rights
Under the Digital Personal Data Protection Act, 2023 you can ask us to:
- tell you what personal data of yours we hold and who we have shared it with;
- correct or complete anything inaccurate — most of it you can edit yourself in the app;
- erase data we no longer need for the purpose you gave it for, or where you withdraw consent;
- stop marketing messages;
- nominate someone to exercise these rights if you die or become incapacitated.
Write to support@tvaritha.com. We will verify it is you, and reply within 30 days. There is no charge. If you are not satisfied with our answer, escalate to our Grievance Officer below, and after that you may complain to the Data Protection Board of India.
12Security
We protect your data with encrypted connections (HTTPS/TLS), hashed passwords, access controls limiting who on our side can reach production data, daily database backups, rate limiting, and separation of our test and live environments. Payment details never touch our servers.
No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as the law requires.
13Cookies, analytics and advertising
We use browser storage for things the app needs to work: keeping you signed in, remembering your language and voice preferences, and holding a reel in progress. Clearing your browser storage signs you out.
We also use advertising and analytics tools on our website and app — the Meta Pixel and Meta’s Conversions API, and Google’s advertising and analytics tags. These record actions such as visiting a page, signing up, making your first reel, or recharging, and share this activity with Meta and Google so we can measure how our own ads perform, reach people who have shown interest in Tvaritha, and avoid showing “sign up” ads to people who already have an account. Where an action can be tied to an account — for example a recharge — we send a hashed, irreversible form of your email or phone so the measurement is accurate; we never send these in readable form, and the hash cannot be turned back into your details. We do not use these tools to make any automated decision about you.
Your choices: you can limit this through your browser’s tracking or “Do Not Track” settings, by declining non-essential cookies where your browser or an in-app banner offers the choice, and by opting out of personalised ads in your Meta ad preferences and Google ad settings. You can also write to support@tvaritha.com and we will help.
14Children
Tvaritha is for businesses and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.
15Changes
We will update this policy as the service changes. The date at the top shows the current version. For material changes we will notify you by email or in the app before they take effect.
16Grievance Officer
For any privacy question, request or complaint, contact our Grievance Officer. We acknowledge within 24 hours and aim to resolve within 15 days.