Link to this notice: craivis.com/legal/dpdp · Where to act on it: Settings → Privacy in the CRAIVIS web app and mobile app, or contact@adrologic.com
Part A: Notice in English
1. Who is asking for your consent
Data Fiduciary: Adrologic Pvt Ltd, a company incorporated in India, CIN U62011RJ2023PTC088227, registered office 30/160, Sector 3, Pratap Nagar, Sanganer, Jaipur 302033, Rajasthan ("Adrologic", "we"). CRAIVIS is Adrologic's product.
Contact for questions about your personal data: Yash Khandelwal, Grievance Officer, contact@adrologic.com, +91 77338 80404, at the registered office above. (Adrologic is not a Significant Data Fiduciary and has no statutory Data Protection Officer at launch; the Grievance Officer is the person able to answer your questions under section 8(9) of the DPDP Act.)
2. What this notice is and when you see it
2.1 This notice tells you, before you give consent, what personal data we ask for, why, and how to withdraw consent, exercise your rights and complain. It is written to stand on its own. The Privacy Policy at craivis.com/legal/privacy says more, in the same order, and the two never conflict; if they appear to, tell us and we will fix it.
2.2 You see this notice, or a short version of it with a link here, at these moments (Annex 1 has the exact wording):
- When you save your first posts and create an account with an e-mail address or mobile number and a one-time code.
- When you connect a social-media channel (the platform's own login screen comes after our notice).
- When you choose a plan and pay.
- When you open a review link sent to you as an approver (with or without an account).
- When you turn on an optional feature that uses more data (the WhatsApp add-on, the SEO add-on, the "religions served" field, push notifications, product-news e-mails).
2.3 Your roles. For your own account and use of the product, Adrologic is the Data Fiduciary and you are the Data Principal. For personal data inside the content and lists you give us (people in your photos, your approvers, your agency's clients, your WhatsApp contacts), you are the Data Fiduciary and Adrologic is your Data Processor under the Data Processing Addendum; this notice does not replace the notice you must give those people, but Section 12 helps you give it.
3. The personal data we ask for, itemised, and why
Every row is a separate purpose. "Needed" means we cannot provide the service without it; "optional" means you choose, and the product works without it.
| # | Personal data | Purpose (specified) | Needed / optional | How long (summary; full table on the Data Deletion page) |
|---|---|---|---|---|
| 1 | E-mail address or mobile number; the one-time code we send (stored hashed, short-lived); passkey public key if you set one | To create your account, sign you in without a password, and send you the codes and links the account needs | Needed | While your account exists; deleted on the Data Deletion timeline |
| 2 | Your name, your organisation's name and type (business or agency), your role, your UI language and theme | To show you the right brands and permissions and address you correctly | Name optional; the rest needed | Same as row 1 |
| 3 | Your business's website address and the text and images we fetch from it when you paste the link; logo, colours, products, prices, opening hours, city, category, tone words, languages, prohibited words, your own festival and event dates | To build your brand profile and make posts, carousels, motion posts and reels for your brand, planned around your city's festivals and events | Needed for the product to work; each field editable | While the brand exists |
| 4 | Business facts pre-filled from Google Places (name, category, city, hours, photos, place ID) | To speed up your first minute; we keep only the facts you confirm and use Google photos only as a 30-day preview unless you approve them | Optional (you can type instead) | Cache at most 30 days; place ID kept with the brand |
| 5 | Photos, logos and past posts you upload | To place your own images in your posts through templates | Optional | While the brand exists |
| 6 | The identifiers of the social-media accounts you connect (account or Page ID, username, profile picture, the permissions the platform granted, connection health) and the access token the platform issues after its own login screen (held by our publishing vendor during the launch period, later by us as encrypted text; never a password, which we never ask for) | To publish the posts you approve to those accounts at the scheduled time, keep the connection alive, and read the platform's statistics for those posts | Needed for publishing; you can use the product without connecting anything | Until you disconnect, revoke on the platform, or delete |
| 7 | Every approval, rejection (with the reason you pick), caption edit, "change something" note, schedule change, and, for approvals, the time, IP address and browser or device used | To publish only what a person approved, to prove who approved what, and to learn your brand's taste so the next posts fit better (your brand's memory, "Brand Brain") | Needed | While the brand exists; a dated approval record stays for the brand's life |
| 8 | Billing name and address, country, GSTIN (optional), the plan chosen, and the subscription, mandate and invoice references our payment provider (Razorpay) gives us. Card numbers, UPI PINs and bank credentials are entered on Razorpay's pages and never reach us | To charge you what the pricing page says, issue GST invoices, set your regional price by billing country, and process refunds | Needed to buy a plan | Invoices and ledger: 8 years from the end of the financial year (statutory) |
| 9 | Which screens you use, what you tap, how long each step takes, feature flags, and error reports from your browser or device | To make the product reliable and fast and to find bugs; measured with pseudonymous identifiers | Part of running the service; non-essential analytics can be switched off in Settings → Privacy | Errors 90 days; product events 1 year |
| 10 | Your device's push-notification token and your notification preferences | To tell you when posts are ready, when a connection needs attention, and when your first post is live | Optional (the operating system asks separately) | Until you turn notifications off or delete the app |
| 11 | What you write to us by e-mail or WhatsApp Business chat | To help you | Needed if you contact us | 2 years |
| 12 | "Religions served" and similar fields in the brand profile | To avoid festival content that does not fit your business and to respect sensitive days | Optional; leave blank if you prefer | While the brand exists; delete any time |
| 13 | A consent record for any real person whose likeness appears in generated content (their name, who recorded the consent, when, proof) | To unblock generation of that person's likeness and to keep the proof the law requires | Optional (needed only for that feature) | Life of the related assets plus 1 year |
| 14 | For the WhatsApp add-on (when live): your WhatsApp Business Account identifiers, your message templates, your opted-in contacts' phone numbers and their opt-in proof | To send the template messages you approve to people who opted in to hear from you | Optional add-on; contacts' data processed for you as your processor | Until you disconnect the add-on; opt-out numbers kept on a suppression list |
| 15 | For the SEO add-on (when live): your website's crawl data, PageSpeed results and, if you connect it, read-only Google Search Console data | To score your website, list issues and recommendations, and re-check monthly; Search Console data is used only for this (Google's Limited Use rules) | Optional add-on | While the add-on is active |
| 16 | Your e-mail address for product news | To send occasional product news | Optional; off by default; separate switch | Until you unsubscribe |
Retention periods that no law sets (support messages 2 years; likeness consent records for the life of the assets plus 1 year; errors 90 days and product events 1 year; the 12-month inactivity rule in Section 10.2) are Adrologic's choices where the plan is silent, recorded with the same markers in the Privacy Policy, Section 5.
3.1 We never ask for: passwords or tokens for any platform (there is no such field), card numbers, government identity numbers, your precise location, your phone's contacts, or data from platforms you have not connected.
3.2 The goods and services this data is for (itemised): building a brand profile from your website; planning content around your location and occasions; generating captions, images, carousels, motion posts and reels; a review and approval flow on web, in the app and by link; publishing approved content to your connected social accounts through the platforms' official interfaces; reading the platforms' published statistics; billing in named units; support; and the optional add-ons in rows 14-15.
3.3 What we do not do with your data: sell it; share it for advertising; use it to train general-purpose AI models; show your brand or results in our marketing without your written agreement; or fetch anything from a social platform without your consent on that platform's own screen.
4. Who else receives it, and where it goes
4.1 We use service providers ("Data Processors") to host, generate, publish, e-mail, bill and monitor: the full list, with what each receives and where it is, is Annex C of the Data Processing Addendum and is kept current at craivis.com/legal/subprocessors. In short: our database is in Singapore, our web application in Mumbai, media storage on a global network with an Asia-Pacific jurisdiction setting, and our AI, e-mail, analytics and workflow providers are mainly in the United States (one tracing provider, from month 4, in Germany; any other location is shown per provider in that list). Your data therefore leaves India. The DPDP Act permits transfer outside India except to countries the Central Government restricts by notification; none of these countries is restricted as of the effective date, and we will stop or move a transfer if that changes.
4.2 When you approve a post, its content, caption, media and the AI-disclosure flag go to the platform you chose (Meta for Instagram, Facebook and Threads; LinkedIn; X; Bluesky; Google for Business Profile). From then on the platform processes it under its own rules as an independent Data Fiduciary.
4.3 If an agency manages your brand, the agency's members see your brand's data; if you approve through a link an agency sent you, the agency is the Data Fiduciary for your data and we act for the agency.
4.4 We disclose data when the law requires it (for example to the Data Protection Board of India or a court), to enforce our Terms, to investigate abuse, or to protect people, and we tell you unless the law forbids it.
5. Consent: what you are agreeing to, and what does not rest on consent
5.1 Consent. By taking the clear, affirmative action described in Annex 1 (pressing "Agree and continue" after this notice, or connecting a channel, or paying, or turning on an optional feature), you consent to the processing of the personal data in Section 3 for the purpose stated in the same row, and for nothing else. Consent is free, specific, informed, unconditional and unambiguous; we do not bundle it with anything you do not need, and product-news e-mails have their own switch, off by default.
5.2 Certain legitimate uses. Some processing does not rest on consent because the DPDP Act allows it without: personal data you give us voluntarily for a purpose you have not objected to (section 7(a): for example, the e-mail you type to sign in); processing we must do to comply with a law or a court order (invoices and ledger under GST and company law; a lawful disclosure request); and processing needed to respond to a medical emergency or a threat to safety.
5.3 Consent record. We record which version of this notice you saw, when, from which screen, and for which rows, so you can see it in Settings → Privacy → Consent history and so we can prove it if the Board asks (section 6(10)).
5.4 Children. CRAIVIS is for businesses and people aged 18 or over. We do not knowingly process a child's personal data and do not seek verifiable parental consent because the service is not offered to children. If you believe a child has given us data, write to contact@adrologic.com and we will delete it.
6. How to withdraw consent (as easily as you gave it)
6.1 In the product: Settings → Privacy → Consents: each row of Section 3 that rests on consent has its own switch. Turning a switch off withdraws that consent at once. Disconnecting a channel withdraws the consent in row 6 for that channel. Deleting your account or organisation withdraws everything.
6.2 By e-mail: write to contact@adrologic.com from the address on your account, or reply to a one-time code we send to your phone, and we do it for you within 2 business days.
6.3 Through a Consent Manager: see Section 9.
6.4 What withdrawal does. We stop the processing that rested on that consent within a reasonable time and delete the data unless a law requires us to keep it (Section 3, rows 8 and 13). Withdrawal does not undo processing that already happened lawfully, and it does not affect the posts already published on a platform under your account. Where the data is needed to run your account (your sign-in e-mail, row 1), withdrawal means closing the account, and we tell you so before you confirm. The consequences of withdrawal are yours to bear, and we will never make the service worse for you as a penalty for withdrawing a consent that was optional.
7. Your rights, and how to use them
| Right (DPDP Act) | What it means | How |
|---|---|---|
| Access (section 11) | A summary of the personal data we process about you, what we do with it, and the identities of every Data Fiduciary and Processor we have shared it with | Settings → Privacy → Download my data (JSON, plus media links), or write to contact@adrologic.com |
| Correction, completion, updating (section 12) | Fix or complete what is inaccurate or out of date | Edit it yourself in Settings and Brand; or write to us |
| Erasure (section 12) | Delete your personal data unless we must keep it under a law | Settings → Account → Delete my account; Settings → Organisation → Delete organisation; Brand → Delete brand; the Data Deletion page has the timelines, a confirmation code and a status link |
| Withdraw consent (section 6) | Section 6 above | Settings → Privacy, e-mail, or a Consent Manager |
| Grievance redressal (section 13) | Have a complaint heard and answered | Section 8 |
| Nominate (section 14) | Name a person to exercise your rights if you die or become unable to | Settings → Privacy → Nominee |
| Information in your language (section 5(3)) | This notice in English or any language in the Eighth Schedule of the Constitution | Section 11 |
7.1 Timing. We acknowledge a request within 2 business days and answer within 30 days; if the DPDP Rules set a shorter period for any request, that period applies. We verify who is asking through your signed-in session or a one-time code to the e-mail or phone on the account.
7.2 Data we process for someone else. If your data is in a customer's content (you are an approver, an agency's client, a WhatsApp contact, or a person in a photo), we forward your request to that customer within 2 business days and help them answer; if the customer no longer exists we act ourselves.
7.3 Your duties as a Data Principal (section 15): do not impersonate anyone, do not suppress facts you must give (for example a GSTIN you want on an invoice), do not file a false or frivolous grievance, and give only verifiably authentic information when you ask for correction or erasure.
8. Grievance redressal, then the Board
8.1 Step 1: write to our Grievance Officer. Yash Khandelwal, Adrologic Pvt Ltd, 30/160, Sector 3, Pratap Nagar, Sanganer, Jaipur 302033, Rajasthan; e-mail contact@adrologic.com; phone +91 77338 80404. Or use Settings → Privacy → Raise a grievance, which sends the same e-mail with your account reference filled in. Tell us what happened, when, and what you want us to do.
8.2 What we do. We acknowledge within 2 business days with a reference number and resolve within 30 days, in writing, saying what we found and what we did.
8.3 Step 2: the Data Protection Board of India. If you are not satisfied with our answer, or we do not answer within the period in 8.2, you may complain to the Data Protection Board of India through the Board's online portal or as the Board's rules direct. The Act asks you to exhaust our grievance route first (section 13(3)). The Board can direct us and impose penalties.
8.4 For breaches. If a personal-data breach affects you we tell you without delay, in plain words, what happened, the likely consequences, what we did, and what you can do; we intimate the Board without delay and file its detailed report within 72 hours, as the DPDP Rules require, following our breach runbook.
9. Consent Managers
9.1 A Consent Manager is a company registered with the Data Protection Board of India that lets you give, manage, review and withdraw your consents to many Data Fiduciaries from one place, through an interoperable platform, without itself seeing your data.
9.2 Our position. The Consent Manager provisions of the DPDP Rules commence on 14 Nov 2026 by the plan's research (Appendix A6). Until Consent Managers are registered and operating, consent is given and withdrawn directly with us under Section 6. From the day a Consent Manager you use is registered with the Board and offers a documented interoperable interface, we will accept consents and withdrawals through it as if you had made them in Settings → Privacy, and we will record them in your consent history. We will list the Consent Managers we interoperate with at craivis.com/legal/dpdp/consent-managers.
9.3 A Consent Manager does not change who is responsible: Adrologic remains the Data Fiduciary for your account data and answers your grievances under Section 8.
10. How long we keep it, and erasure when you go quiet
10.1 The Data Deletion page has the single retention table: in short, while your account or brand exists plus 30 days readable after cancellation; then erasure from live systems within 30 days (target 7) and from backups within 30 more; invoices and ledger for 8 years under company and tax law; a permanent audit trail of identifiers for brand transfers.
10.2 Inactive accounts. If you neither sign in nor hold a subscription for 12 months, we treat the purpose as no longer served and erase your account, after e-mailing you at least 48 hours before so you can sign in and keep it (the DPDP Rules' erasure-with-notice mechanism as the plan describes it in §13.3).
11. Languages
This notice is available in English and Hindi now (Part B is the Hindi text). You may ask for it in any other language listed in the Eighth Schedule to the Constitution of India by writing to contact@adrologic.com; we provide it within 30 days. The Hindi user interface arrives in Week 13 of our build; the Hindi text of this notice is available from Day 30 whatever the interface language.
12. If you are a business giving this notice to your own people
Because you are the Data Fiduciary for the people in your content and lists, you must give them a notice too. To help: the magic-link review page carries a built-in notice to approvers (Annex 1, item 4); the WhatsApp add-on stores opt-in proof per contact and refuses lists without it; the consent-record dialog for real-person likeness records who consented and when; and the Data Processing Addendum sets out what we do as your processor. Agencies must name Adrologic (CRAIVIS) as processor in their own notices to clients (Terms, Section 15.6).
13. Changes to this notice
We version this notice and keep prior versions at craivis.com/legal/dpdp/history. A change that adds a purpose or a category of data is shown to you as a fresh notice and needs a fresh consent before that processing starts. Other changes are announced 30 days ahead by e-mail and in-product; changes required by law may take effect sooner. Our policy-watch process reviews the DPDP Rules and the Board's notifications every quarter and within 7 days of any announcement.
भाग B: हिंदी सारांश (DPDP सहमति-सूचना)
यह सूचना क्या है। यह डिजिटल व्यक्तिगत डेटा संरक्षण अधिनियम, 2023 (DPDP Act) की धारा 5 के अंतर्गत हमारी सहमति-सूचना का हिंदी सारांश है। पूरी सूचना ऊपर भाग A में अंग्रेज़ी में है। आप यह सूचना संविधान की आठवीं अनुसूची की किसी भी भाषा में contact@adrologic.com पर लिखकर माँग सकते हैं।
हम कौन हैं (डेटा न्यासी / Data Fiduciary)। CRAIVIS भारत में पंजीकृत कंपनी Adrologic Pvt Ltd (CIN U62011RJ2023PTC088227; पंजीकृत कार्यालय 30/160, Sector 3, Pratap Nagar, Sanganer, Jaipur 302033, Rajasthan) का उत्पाद है। आपके खाते और उत्पाद के उपयोग से जुड़े डेटा के लिए Adrologic "डेटा न्यासी" है और आप "डेटा प्रधान" (Data Principal) हैं। आपके कंटेंट के अंदर जो लोग हैं (आपकी फ़ोटो में लोग, आपके अनुमोदक, आपकी एजेंसी के ग्राहक, आपके WhatsApp संपर्क) उनके लिए आप डेटा न्यासी हैं और हम आपके "डेटा प्रोसेसर" हैं।
हम कौन-सा डेटा माँगते हैं और क्यों (हर पंक्ति एक अलग उद्देश्य है)।
- ईमेल या मोबाइल नंबर और एक बार का कोड (OTP) — खाता बनाने और बिना पासवर्ड के लॉगिन कराने के लिए। आवश्यक।
- आपका नाम, व्यवसाय का नाम और प्रकार, आपकी भूमिका, भाषा — सही ब्रांड और अनुमतियाँ दिखाने के लिए। नाम वैकल्पिक, शेष आवश्यक।
- आपकी वेबसाइट का पता और उससे लिया गया टेक्स्ट व चित्र; लोगो, रंग, उत्पाद, कीमतें, समय, शहर, श्रेणी, भाषाएँ, आपके अपने त्योहार व आयोजन — आपके ब्रांड के लिए पोस्ट, कैरोसेल, मोशन पोस्ट और रील बनाने के लिए। उत्पाद के काम करने के लिए आवश्यक; हर फ़ील्ड बदली जा सकती है।
- Google Places से पहले से भरे व्यावसायिक तथ्य — पहले मिनट को तेज़ करने के लिए; हम केवल वही रखते हैं जिसकी आप पुष्टि करते हैं। वैकल्पिक।
- आपके अपलोड किए लोगो, फ़ोटो और पुरानी पोस्ट — टेम्पलेट के ज़रिए आपके अपने चित्र पोस्ट में लगाने के लिए। वैकल्पिक।
- आपके जोड़े गए सोशल मीडिया खातों के पहचान-चिह्न और वह एक्सेस टोकन जो प्लेटफ़ॉर्म अपनी लॉगिन स्क्रीन के बाद देता है — आपकी स्वीकृत पोस्ट प्रकाशित करने और उनके आँकड़े पढ़ने के लिए। हम कभी आपका पासवर्ड नहीं माँगते; ऐसा कोई फ़ील्ड है ही नहीं। प्रकाशन के लिए आवश्यक।
- आपकी हर स्वीकृति, अस्वीकृति (कारण सहित), कैप्शन संपादन, और स्वीकृति का समय, IP पता व डिवाइस — केवल वही प्रकाशित करने के लिए जिसे किसी व्यक्ति ने स्वीकृत किया, यह सिद्ध करने के लिए कि किसने स्वीकृत किया, और आपके ब्रांड की पसंद सीखने (Brand Brain) के लिए। आवश्यक।
- बिलिंग नाम, पता, देश, GSTIN (वैकल्पिक), चुना गया प्लान और Razorpay के सब्सक्रिप्शन/मैंडेट/चालान संदर्भ — भुगतान लेने, GST चालान देने और रिफ़ंड के लिए। कार्ड नंबर, UPI PIN या बैंक विवरण Razorpay के पन्नों पर भरे जाते हैं और हम तक कभी नहीं पहुँचते। प्लान खरीदने के लिए आवश्यक।
- उपयोग और त्रुटि-डेटा (कौन-सी स्क्रीन, कितना समय, कौन-सी त्रुटि) — उत्पाद को विश्वसनीय बनाने के लिए। गैर-आवश्यक एनालिटिक्स Settings → Privacy में बंद किए जा सकते हैं।
- पुश सूचना का डिवाइस टोकन — "पोस्ट तैयार हैं", "कनेक्शन पर ध्यान दें" बताने के लिए। वैकल्पिक।
- ईमेल या WhatsApp पर हमें लिखी बातें — आपकी मदद के लिए। 2 वर्ष तक।
- "जिन धर्मों के ग्राहकों की सेवा करते हैं" जैसे फ़ील्ड — ऐसा त्योहार-कंटेंट टालने के लिए जो आपके व्यवसाय को शोभा न दे। पूरी तरह वैकल्पिक; खाली छोड़ सकते हैं।
- किसी वास्तविक व्यक्ति की छवि AI से बनाने के लिए उसकी सहमति का रिकॉर्ड — उस सुविधा को खोलने और कानूनन ज़रूरी प्रमाण रखने के लिए। वैकल्पिक।
- WhatsApp ऐड-ऑन (जब चालू हो): आपके WhatsApp Business खाते के पहचान-चिह्न, टेम्पलेट, और आपके opt-in संपर्कों के नंबर व उनकी सहमति का प्रमाण — केवल उन लोगों को संदेश भेजने के लिए जिन्होंने आपसे संदेश पाने की सहमति दी। वैकल्पिक ऐड-ऑन।
- SEO ऐड-ऑन (जब चालू हो): आपकी वेबसाइट का क्रॉल-डेटा, PageSpeed परिणाम और (यदि जोड़ें) केवल-पढ़ने योग्य Google Search Console डेटा — वेबसाइट का स्कोर, समस्याएँ और सुझाव देने के लिए। वैकल्पिक ऐड-ऑन।
- उत्पाद-समाचार ईमेल के लिए आपका ईमेल — वैकल्पिक; डिफ़ॉल्ट रूप से बंद; अलग स्विच।
हम क्या नहीं करते। आपका डेटा बेचते नहीं; विज्ञापन के लिए साझा नहीं करते; उससे सामान्य AI मॉडल प्रशिक्षित नहीं करते; आपकी लिखित सहमति के बिना आपके ब्रांड या परिणाम अपने प्रचार में नहीं दिखाते।
डेटा कहाँ जाता है। हमारा डेटाबेस और वेब ऐप भारत में हमारे अपने सर्वर पर हैं (Contabo से लिया गया), और AI, ईमेल, एनालिटिक्स जैसे सेवा-प्रदाता अमेरिका (और एक जर्मनी) में हैं; पूरी सूची craivis.com/legal/subprocessors पर है। इसलिए आपका कुछ डेटा भारत के बाहर जाता है, हालाँकि मुख्य रिकॉर्ड भारत में ही रहता है, जिसकी DPDP अधिनियम अनुमति देता है (केंद्र सरकार द्वारा प्रतिबंधित देशों को छोड़कर)। पोस्ट स्वीकृत होने पर वह उस प्लेटफ़ॉर्म (Meta, LinkedIn आदि) के पास जाती है, जो उसे अपने नियमों से संभालता है।
सहमति। इस सूचना के बाद "सहमत हूँ और आगे बढ़ें" दबाकर, कोई चैनल जोड़कर, भुगतान करके या कोई वैकल्पिक सुविधा चालू करके आप ऊपर बताई पंक्तियों के उसी उद्देश्य के लिए सहमति देते हैं, और किसी अन्य के लिए नहीं। सहमति स्वतंत्र, विशिष्ट, सूचित, बिना शर्त और स्पष्ट है। कुछ प्रोसेसिंग सहमति पर नहीं, कानून की अनुमति पर टिकी है (जैसे GST के लिए चालान रखना)। हम रिकॉर्ड रखते हैं कि आपने कब, किस स्क्रीन पर, इस सूचना का कौन-सा संस्करण देखकर सहमति दी; आप इसे Settings → Privacy → Consent history में देख सकते हैं।
सहमति वापस लेना (उतना ही आसान जितना देना)। Settings → Privacy → Consents में हर पंक्ति का अपना स्विच है; स्विच बंद करते ही सहमति वापस हो जाती है। चैनल हटाने से उस चैनल की सहमति वापस होती है। आप contact@adrologic.com पर लिखकर भी वापस ले सकते हैं; हम 2 कार्यदिवसों में कर देते हैं। वापस लेने के बाद हम वह प्रोसेसिंग रोक देते हैं और डेटा मिटा देते हैं, सिवाय उसके जिसे रखना कानूनन ज़रूरी हो। पहले से कानूनी रूप से हुई प्रोसेसिंग या पहले से प्रकाशित पोस्ट इससे प्रभावित नहीं होतीं। यदि डेटा खाता चलाने के लिए ज़रूरी है (जैसे लॉगिन ईमेल), तो सहमति वापस लेने का अर्थ खाता बंद करना है, जो हम पुष्टि से पहले बता देते हैं।
आपके अधिकार। (1) अपने डेटा का सारांश और यह जानना कि किन-किन को साझा किया गया (Settings → Privacy → Download my data); (2) सुधार, पूर्णता और अद्यतन; (3) मिटाना (Settings → Account → Delete my account; समय-सीमा Data Deletion पृष्ठ पर); (4) सहमति वापस लेना; (5) शिकायत निवारण; (6) अपनी मृत्यु या अक्षमता की स्थिति के लिए नामिती (nominee) नियुक्त करना (Settings → Privacy → Nominee); (7) यह सूचना अंग्रेज़ी या आठवीं अनुसूची की किसी भाषा में पाना। हम 2 कार्यदिवसों में पावती और 30 दिनों में उत्तर देते हैं। आपके कर्तव्य: किसी का रूप न धरें, ज़रूरी तथ्य न छिपाएँ, झूठी शिकायत न करें।
शिकायत। पहला चरण: हमारे शिकायत अधिकारी को लिखें: Yash Khandelwal, Adrologic Pvt Ltd, 30/160, Sector 3, Pratap Nagar, Sanganer, Jaipur 302033, Rajasthan; ईमेल contact@adrologic.com; फ़ोन +91 77338 80404; या Settings → Privacy → Raise a grievance। हम 2 कार्यदिवसों में संदर्भ संख्या के साथ पावती और 30 दिनों में लिखित उत्तर देते हैं। दूसरा चरण: संतुष्ट न हों, या समय पर उत्तर न मिले, तो आप भारतीय डेटा संरक्षण बोर्ड (Data Protection Board of India) में उसके ऑनलाइन पोर्टल से शिकायत कर सकते हैं; अधिनियम के अनुसार पहले हमारा शिकायत-मार्ग पूरा करना होता है।
डेटा भंग (breach)। यदि कोई डेटा भंग आपको प्रभावित करे, तो हम आपको बिना देरी सरल भाषा में बताते हैं कि क्या हुआ, क्या परिणाम हो सकते हैं और आप क्या कर सकते हैं; बोर्ड को तुरंत सूचना और 72 घंटे में विस्तृत रिपोर्ट देते हैं।
सहमति प्रबंधक (Consent Manager)। बोर्ड में पंजीकृत सहमति प्रबंधक के ज़रिए भी आप हमें सहमति दे और वापस ले सकेंगे, जिस दिन से वह पंजीकृत होकर काम करने लगे; तब तक सहमति सीधे हमारे साथ Settings → Privacy में संभाली जाती है।
कितने समय तक। खाता या ब्रांड रहने तक, और रद्द करने के बाद 30 दिन पढ़ने योग्य; फिर लाइव सिस्टम से 30 दिनों में (लक्ष्य 7 दिन) और बैकअप से 30 और दिनों में मिटाना; चालान और लेजर कानूनन 8 वर्ष। यदि 12 महीने तक न लॉगिन हो और न सब्सक्रिप्शन, तो कम से कम 48 घंटे पहले ईमेल करके हम खाता मिटा देते हैं।
बच्चे। यह सेवा 18 वर्ष से कम आयु के लोगों के लिए नहीं है; हम जानबूझकर किसी बच्चे का डेटा नहीं लेते।
यदि आप अपने लोगों को यह सूचना देने वाले व्यवसाय हैं। आपके कंटेंट और सूचियों में जो लोग हैं, उनके लिए आप डेटा न्यासी हैं; उन्हें सूचना देना आपकी ज़िम्मेदारी है। समीक्षा-लिंक वाले पृष्ठ पर अनुमोदकों के लिए सूचना पहले से है; WhatsApp ऐड-ऑन हर संपर्क का opt-in प्रमाण रखता है; एजेंसियाँ अपनी सूचनाओं में Adrologic (CRAIVIS) को प्रोसेसर के रूप में नामित करें।
परिवर्तन। नया उद्देश्य या नया डेटा जोड़ने पर हम नई सूचना दिखाते हैं और नई सहमति लेते हैं; अन्य परिवर्तन 30 दिन पहले ईमेल और ऐप में बताए जाते हैं। पुराने संस्करण craivis.com/legal/dpdp/history पर रहते हैं।
Annex 1: Where consent is asked, and the words on the screen (English at launch; Hindi with the Hindi UI in Week 13, reviewed by the founder before release)
| # | Screen | Rows of Section 3 | Affirmative action | Copy shown above the button |
|---|---|---|---|---|
| 1 | "Save your posts" sheet on the first right-swipe: e-mail or phone + OTP (§6.4 step 4) | 1, 2, 3, 7, 9 | Button "Agree and continue" after the itemised list; a second, unticked switch for product news (row 16) | "To save these posts we create an account with your e-mail or phone and a one-time code, keep your brand profile and what you approve, and measure how the product works. We never ask for your social media passwords. We do not sell your data or train AI on it. [Full notice] · [Product news by e-mail: off]" |
| 2 | "Connect Instagram / Facebook / Threads / LinkedIn" tile, before the platform's own login (§6.4 step 5; §2 #22) | 6 | Button "Continue to {platform}"; the platform's consent screen follows | "Connecting lets CRAIVIS publish the posts you approve to this account and read their results. You sign in on {platform}'s own screen; we never see your password. Disconnect any time in Brand → Channels. [What we store]" |
| 3 | Checkout sheet (§6.4 step 5; §12.2) | 8 | Button "Pay and connect" | "Razorpay collects your payment details on its own page; we receive only a reference, the last 4 digits and the card country, to bill you and set your regional price. Refund rule: full refund within 7 days if you publish nothing. [Refund policy] · [Full notice]" |
| 4 | Magic-link review page /r/{token} and its white-label equivalents (§6.8) |
7 (for the approver) | The first tap on Yes / No / "Change something" | Footer, always visible, no dismissal needed: "This page is run by CRAIVIS (Adrologic Pvt Ltd) for {agency or brand name}, who is responsible for your data. We record your decision, the time, your IP address and device so the brand knows who approved. [Notice] · [Remove me as an approver]" |
| 5 | Brand profile: "religions served" and other optional fields (§9.1) | 12 | Filling the field | Inline help: "Optional. Used only to avoid festival content that does not fit your business. Leave blank if you prefer; delete any time." |
| 6 | Push notifications (app; §6.10) | 10 | The operating system's own prompt after our explainer | "We send at most one non-urgent notification a day and none between 22:00 and 08:00. Change this in Settings." |
| 7 | WhatsApp add-on setup (§2 #1; §11.1) | 14 | Button "Connect my WhatsApp Business account" via Meta's Embedded Signup; a separate confirmation that every contact opted in | "Messages go only to contacts who opted in to hear from you, using templates Meta approved, billed per message at Meta's rate + 20% from your prepaid wallet. You are responsible for the opt-ins; we keep the proof you give us. [Notice] · [Business Messaging Policy]" |
| 8 | SEO add-on setup (§2 #8; §7.1) | 15 | Button "Audit my website"; Google's own consent screen if Search Console is connected | "We crawl your public website and read PageSpeed data. Connecting Search Console is optional and read-only; that data is used only for your report (Google Limited Use). [Notice]" |
| 9 | Real-person likeness consent dialog (§9.5 gate 3) | 13 | Button "Record consent" with name, date and proof | "Only with this record will the product generate this person's likeness. You confirm the person agreed to appear in your marketing. The AI label cannot be switched off for this content." |
| 10 | Settings → Privacy (every surface) | all | Switches per consent; "Download my data"; "Delete my account"; "Nominee"; "Raise a grievance"; "Consent history" | The complete list of Section 3 with the version and date of the consent given |
Annex 2: Data Fiduciary details block (rendered on every consent screen's "Full notice" link and at the foot of this page)
| Item | Value |
|---|---|
| Data Fiduciary | Adrologic Pvt Ltd (India), CIN U62011RJ2023PTC088227 |
| Registered office | 30/160, Sector 3, Pratap Nagar, Sanganer, Jaipur 302033, Rajasthan |
| Product | CRAIVIS, craivis.com |
| Grievance Officer | Yash Khandelwal · contact@adrologic.com · +91 77338 80404 |
| Support | contact@adrologic.com |
| Notice link | craivis.com/legal/dpdp (English) · craivis.com/hi/legal/dpdp (Hindi) · other Eighth Schedule languages on request |
| Withdraw consent / exercise rights | Settings → Privacy in the web app and mobile app; contact@adrologic.com; a registered Consent Manager once operating (Section 9) |
| Complain to the Board | Data Protection Board of India, through its online portal, after our grievance route |
| Version | 1.0, effective 21 September 2026; history at craivis.com/legal/dpdp/history |