Privacy Policy

1. What we collect

Account data: your email address and password (stored as a salted hash, never in plain text).

Business data: the business name, website, industry, location, services, and competitor names you provide during onboarding, so we can measure how AI systems describe your business.

Query and measurement data: the AI-search queries we generate for your business, the responses AI providers return, and the mentions/citations/scores we extract from those responses.

Payment data: subscription and payment status. Card/UPI/bank details are collected and processed directly by our payment processor, Razorpay -- we never see or store your full payment instrument details.

Sole-proprietor business names: where your business is a sole proprietorship, we treat the business name as personal data (a conservative classification, given it can identify an individual) and apply the same rights and retention rules to it as to your account data.

2. Who we share it with

To measure your AI visibility, we send your business name, competitor names, industry, and location (never your account email or password) to the AI providers we query on your behalf:

• OpenAI (ChatGPT)
• Google (Gemini)
• Anthropic (Claude)
• Perplexity

Each provider acts as a Data Processor under the DPDP Act and processes this data under its own published terms of service. As of this policy's last update, none of these providers train their models on data submitted via their API by default -- we recheck this quarterly. We do not send account credentials or payment details to any AI provider.

If your business has a physical location, we send your business name and location to the Google Places API to find nearby competitors for the Local Competitor Map and Maps vs AI Gap features. This only runs for businesses that use those features, and only your business name and location are sent -- never account credentials.

Razorpay processes your payment information directly, under its own privacy policy and PCI-DSS compliance, to handle subscription billing.

We do not use any other third-party service that receives your personal or business data, beyond the AI providers, Google Places, and Razorpay named above, and the advertising/search connectors described in Section 8. (We use Google Sheets internally for our own operational tracking -- it never receives customer data.)

Under the DPDP Act, Vimarsh remains solely responsible as Data Fiduciary for how these processors handle your data, even though we do not control their infrastructure directly -- we rely on their published terms rather than negotiating individual data processing agreements at our current scale.

3. How long we keep it

Raw AI provider responses (the full text/JSON an AI system returned) are retained for 90 days, then permanently deleted. Ninety days gives enough history to investigate a disputed measurement or debug an extraction issue, without indefinitely holding a large, unpredictable payload that can contain names or details an AI system chose to include beyond what we asked.

Extracted scores and metrics (mention rate, recommendation rate, sentiment, AI Visibility Score, and similar computed numbers) are retained indefinitely while your account is active, because tracking your visibility trend over time is the core purpose of the product.

Account and business data is retained until you delete your account (see Section 5) or your account has been inactive long enough that it becomes subject to our standard data lifecycle review.

Payment records are retained for as long as required by Indian tax and accounting law, even after account deletion -- this is a documented exception to the deletion process below.

4. Correction

You can correct your business name, industry, location, or competitor list at any time from your account. A correction updates your current profile and all future measurements; it does not rewrite historical AI responses already stored (we cannot alter the historical record of what an AI system actually said), but past measurements affected by an error can be flagged as superseded on request.

5. Deletion

You can request account deletion from Account Settings. Deletion requires re-entering your password, then enters a 14-day cooldown during which you can restore your account in full. After 14 days, your account, business data, and all associated measurements are permanently and irreversibly deleted from our primary database, with the payment -records exception noted in Section 3.

6. Cookies and tracking

Vimarsh uses exactly one cookie: a functional, httpOnly session cookie that keeps you signed in. It is not used for advertising, analytics, or cross-site tracking, and no third-party tracking script or analytics tag runs on this site. Because we use no non-essential cookies, we do not operate a separate cookie-consent banner or Cookie Policy -- this section is the complete and accurate statement of our cookie usage.

7. Your rights under the DPDP Act

You have the right to access, correct, and erase your personal data, and to withdraw consent at any time (which will trigger account deletion, since the product cannot function without the data you provided). The DPDP Rules, 2025 were notified on November 13, 2025, with core enforceable obligations commencing May 13, 2027; we design our data handling to meet those obligations in advance rather than waiting for the compliance date.

8. Advertising and search console connections

If you choose to connect Google Search Console, Google Ads, or Meta (Facebook/Instagram) Ads, you grant Vimarsh read-only access to that account via the provider's own OAuth consent screen. We only request the minimum scope needed to read your own performance data (for Meta Ads, the ads_read permission) -- we never request or use permission to post, spend, or modify anything on your connected accounts.

What we store: the connected account/customer ID, an encrypted OAuth access token (and refresh token, where the provider issues one), and the campaign-level or search performance data the provider returns (for example: campaign names, impressions, clicks, spend, messaging-conversation counts, or search queries/impressions). Tokens are encrypted at rest with a key dedicated to that connector and are never visible to Vimarsh staff in plain text.

What we do with it: this data is shown only to the business that connected the account, inside that business's own Vimarsh dashboard, to summarize ad spend and search performance alongside your AI visibility measurements. It is never sent to the AI providers listed in Section 2, never sold, and never shared with any other Vimarsh customer.

Disconnecting: you can disconnect any of these accounts at any time from the relevant page in your dashboard. Disconnecting revokes the token at the provider (where supported) and permanently deletes the stored token and connection record from our database immediately -- it is not a soft flag.

If you use ChatGPT Ads, you provide your own API key directly (there is no OAuth flow for this provider); the same encryption-at-rest and immediate-deletion-on-disconnect rules apply to that key.

9. Grievance officer / contact

For any privacy question, correction, deletion, or grievance request, contact: [email protected]. We aim to acknowledge every request within 7 days.