Privacy Policy

Amazia Technologies (OPC) Private Limited ("Chitravala," "we," "us," or "our") runs Chitravala, an AI studio for Indian celebrations. You give us photos, your voice and text, and we use AI to make invites, greetings, posts, short videos and voice notes. Because that often involves faces and family moments, this Privacy Policy explains plainly what we collect, why, who helps us process it, how long we keep it, and the rights you have. It is written in line with:

• Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it — India
• Information Technology Act, 2000 and the rules made under it, including the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as amended for synthetically generated information
• General Data Protection Regulation (GDPR) — for users in the European Economic Area
• Reserve Bank of India (RBI) guidelines for Payment Aggregators — once paid plans go live
• Consumer Protection (E-Commerce) Rules, 2020

1. Information We Collect

1.1 Information You Provide

• Google sign-in — when you choose "Continue with Google", Google shares your name, email address, profile picture and Google account ID with us. We use them to create your account and log you in. We never see your Google password and get no access to your Gmail, contacts or files. (Phone and email one-time-code sign-in exist in our system but are switched off at launch. If we turn them on, we will collect your phone number or email for that purpose.)
• Photos you upload — for example a family photo for an invite, an old photo to restore or colourise, or a portrait for an art effect. These photos often show faces, including faces of people other than you.
• "My face" reference photos (Identity) — if you choose to save up to 10 reference photos so we can keep a person's look consistent across creations. You can delete them at any time.
• Text you type — your brief ("Aarav's 5th birthday, Sunday 4 pm, Kothrud"), template fields such as names, dates, places and messages, voice-note scripts, edit instructions, project names and Explore titles.
• Voice recordings for typing by voice — when you tap the mic, we send the clip to our speech-to-text provider to turn it into text. We do not keep the recording (see §5).
• Preferences — site language, copy language, preferred voice, pace and style, and notification choices.
• Face consent — when you confirm that you have the consent of the people shown in a photo, we record that confirmation (see §1.4).
• Reports and support messages — the content of any report you file and any support conversation with us (in the app, by email or on WhatsApp).
• Billing details — only once paid plans launch: the name, state, address and optional GSTIN you enter for GST invoices.

1.2 What We Create for You

• Your creations — the images, videos and voice notes made for you, the text layers on them, and your edit history.
• Coins — your coin balance, coin buckets and a ledger of every coin you receive, spend, are refunded or that expires.
• Shares — the links you create (/s/<code>), whether each is public or private, and any Explore post you submit.

1.3 Information Collected Automatically

• Device and browser data — user agent, operating system, screen size and language.
• IP address — used for rate limiting, abuse prevention and security. Where we store it for these purposes, we store a one-way hash, not the address itself.
• Device ID cookie — a random ID (cv_did) used only to prevent abuse such as farming free coins with many accounts. We store only a hash of it.
• Product events — for example "visited", "made a creation", "shared", "claimed daily coin". These carry IDs, keys and counts only — not names, phone numbers, prompts or photos. Visitors who are not signed in are counted by a random anonymous ID kept in the browser.
• Error reports — if our error tracking is switched on, we send technical error details with personal data removed (see §3).
• Cookies and browser storage — see our Cookie Policy.

1.4 Faces, Voices and Consent

• Face consent records. When you tick the consent box on a job, upload a photo with consent, or add an Identity reference photo, we save a record of: your account, the time, what it was for, which photos, the version of the consent wording you saw, a hash of your IP address and your browser's user agent. We keep this record as proof that consent was given.
• No face recognition. We do not run face recognition to identify who someone is, and we do not build a faceprint database. Photos with faces are passed to AI models only to make the creation you asked for.
• Voices. Voice notes are made with synthetic voices from a fixed catalogue. We do not clone your voice or anyone else's.

1.5 Information from Third Parties

• Google — the sign-in details in §1.1.
• Payment processor (when payments launch) — Razorpay will share limited transaction details with us (transaction ID, amount, method type, status). We will not receive or store your full card number, CVV or UPI PIN.
• Referral links — if you arrive through a friend's referral link, we record the referral code to credit the reward.

1.6 What We Do NOT Collect

• Aadhaar, PAN or other government ID numbers (please do not upload them)
• Card numbers, CVV or UPI PIN (these go directly to the payment processor)
• Face templates or voiceprints for identifying people
• Precise location (GPS)

Please do not put sensitive personal details (health, religion, caste, political views, financial details) of yourself or others in your text unless they are really needed for your creation.

2. How We Use Your Information

• Make what you asked for — turn your brief, photos, template choices and voice into images, videos and voice notes; lay out your text; and let you edit, download and share them.
• Keep names off image prompts — names, dates, places, prices and handles are drawn by us as text layers on top of the design. Our system strips them out before a prompt is sent to an image or video model. They are still processed by our own servers, by our text models (to understand your brief and to check it for safety) and by the voice provider when you ask for a voice note that says them.
• Sign you in and keep your account secure.
• Run coins — give signup and daily coins, take coins when a creation starts, refund them automatically when it fails, and (once payments launch) process plans and coin packs and send GST invoices.
• Keep the service safe — automated moderation of text, uploads and results; rate limits; abuse and fraud prevention; acting on reports; enforcing our Acceptable Use Policy.
• Label AI content — add "Made with AI" metadata to every file you export.
• Improve the service — understand which features and templates work, using product events and aggregated counts.
• Talk to you — service messages, security alerts, support replies and, if you have not turned them off, occasional updates such as festival reminders.
• Comply with the law — respond to lawful requests and keep records the law requires.

2.1 We Do Not Train Our AI on Your Content

We do not use your photos, voice, text or creations to train our own AI models. We ask our text-model gateway (OpenRouter) to route our requests only to providers that do not collect or train on the data. Third-party model providers act under their own terms; see §3.

2.2 We Do Not Sell Your Data

We do not sell, rent or trade your personal data, and we do not use it for targeted advertising.

3. Who Processes Your Data

We share data only with service providers that help us run Chitravala, and only as much as each one needs:

Providers may change as we improve the service. The current list is available on request at support@chitravala.com.

We may also disclose data when required by law, a court order or a lawful request from a government authority, to protect the safety of a person, or as part of a merger or sale of the business (with this policy continuing to apply).

3.1 What Others Can See

• Private by default. Your creations are private to your account.
• Share links. If you create a share link, a public link opens for anyone who has it (and they can pass it on); a private link opens only for you. You can switch a link between public and private at any time.
• Explore. If you submit a creation to the public Explore gallery, it is shown only after our team approves it. Making the share private, or deleting it, removes it from Explore.

4. Data Security

• TLS encryption for all data in transit, and encryption at rest by our storage and database providers
• Signed, time-limited links for files instead of public file addresses
• Hashing of IP addresses and device IDs we keep for abuse checks
• Rate limiting on sign-in, creation, upload and other sensitive endpoints
• Automated moderation of uploads, text and results
• Least-privilege admin access with role-based permissions and an audit log of every admin action
• Security headers and regular dependency patching

No system is perfectly secure. If a personal-data breach occurs, we will notify affected users and the Data Protection Board of India as the DPDP Act requires, and report to CERT-In within 6 hours of discovery as required by the CERT-In Directions, 2022.

5. Data Retention

6. Your Rights

Under the DPDP Act 2023, the IT Rules and (for EU users) the GDPR, you have these rights:

• Access and portability — use Download my data in Account to get a zip file of your profile, coin history, creations (with the text on them), shares and your original files. Prompts are not included because they are internal.
• Correction — change your name, language and other details in Account, or ask us to correct anything else.
• Erasure — use Delete account in Account. Your account is closed straight away: running creations are refunded, your share links become private and your Explore posts are withdrawn. After 30 days, your files, creations, Identity photos and shares are deleted and your personal details are removed. The coin ledger, payment records and invoices are kept without your personal details, as the law requires.
• Withdraw consent — delete a photo, an Identity reference photo or a creation, make a share private, or turn off updates in Account. Withdrawing consent does not affect processing already done.
• Nominate — under the DPDP Act you may nominate a person to exercise your rights if you die or become unable to. Email us to do so.
• Grievance — complain to our Grievance Officer (§11) and, if not satisfied, to the Data Protection Board of India.

You can also email support@chitravala.com for any request. We acknowledge within 24 hours, aim to resolve within 15 working days, and every data request is due no later than 30 days after we receive it.

7. Cookies

We use only the cookies needed to run the site, plus a small anonymous ID in your browser for counting visits. We do not use advertising cookies. See our Cookie Policy.

8. Children

Chitravala accounts are for people aged 18 or older. Under-18s may use Chitravala only through a parent's or guardian's account, under their supervision.

Parents often make invites with their children's photos and names, for example for a birthday. A parent or guardian may upload photos of their own child for this purpose. We process that data only to make the creation the parent asked for. We do not track children, build profiles of them or show them targeted advertising. Our moderation blocks any sexual or exploitative content involving minors.

If you believe a child has an account, or that a child's data has been uploaded without a parent's consent, email grievance@chitravala.com and we will act within 7 working days.

9. International Data Transfers

Some of our providers (for example Cloudflare, MongoDB Atlas, OpenRouter and AI model providers) may process data on servers outside India. We transfer data only as permitted under the DPDP Act and, for EU users, with appropriate safeguards such as Standard Contractual Clauses. Data is encrypted in transit.

10. Changes to This Policy

We may update this Privacy Policy. Material changes will be announced by email or an in-app banner with at least 14 days' notice. Continued use of Chitravala after a change takes effect means you accept the updated policy.

11. Grievance Officer

Questions about this policy?

Email us at support@chitravala.com or call +91 92050 27129.

Amazia Technologies (OPC) Private Limited · 180, Gurgaon, Haryana, India – 122018