Privacy Policy

1. What Alvida does

Alvida is a posthumous message delivery service operated from India. You write personal messages for people you care about, and we deliver them automatically if our system determines — through a series of missed check-ins — that you are no longer reachable. This policy explains exactly what data we collect to make that work, why we collect it, who sees it, where it is stored, and what rights you have over it.

By creating an account, you agree to the collection and processing of your data as described in this policy. Where processing is based on consent, you may withdraw that consent at any time as described in Section 13. Where processing is necessary to provide the service, it will cease when you delete your account.

2. Minimum age

Alvida is intended for users who are 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If we become aware that a minor has created an account, we will delete that account and all associated data promptly. If you believe a minor has registered, please contact us at hello@alvida.in.

3. What we collect

We collect the following categories of personal data:

• Account information: your email address, full name, and optionally your phone number. Your phone number is kept private and used solely for account-related communications if you choose to provide it.
• Message content: the title, body text, voice recordings, and photo attachments you create and store on Alvida. This content is yours — we treat it as strictly confidential.
• Recipient information: the names and email addresses of people you designate to receive your messages. This data is stored solely to enable delivery and is never used for any other purpose.
• Activity signals: the date and time of your last login and your last check-in response. These signals are used exclusively to determine whether your messages should be delivered. After 15 consecutive missed check-ins, delivery is triggered.
• Payment information: if you purchase a paid plan, payment is processed securely by Razorpay. We do not store your card number, CVV, or any payment instrument details on our servers.
• Technical data: your IP address, browser type, device type, and operating system, collected automatically by our infrastructure (Supabase, Vercel) when you use the service. This data is used for security, fraud prevention, and service reliability.
• Session data: authentication tokens and cookies used to keep you signed in. See Section 9 for details.
• Error and diagnostic data: if the application encounters an error, anonymised diagnostic information may be captured by our error monitoring service (Sentry) to help us fix the issue. This may include page URLs and error stack traces.

4. Legal basis for processing

Under the Digital Personal Data Protection Act 2023 (DPDP Act), we process your data on the following grounds:

• Contractual necessity: account data, message content, recipient data, and activity signals — required to provide the core service you signed up for.
• Contractual necessity: payment processing — required to fulfil your purchase of a paid plan.
• Legitimate interest: technical and diagnostic data — necessary to keep the service secure and operational.
• Consent: Account-related communications — only sent if you provide your phone number. You may remove your phone number at any time in Settings.

5. How we use your data

• To send you periodic check-in emails to confirm you are reachable.
• To deliver your messages to your designated recipients when the delivery condition is met.
• To manage your account and authenticate your identity.
• To process payments and issue invoices for paid plans.
• To contact you about security issues, service changes, or policy updates.
• To diagnose and fix technical errors in the service.

We do not read, analyse, or use your message content for any purpose other than delivery. We do not use your data for advertising. We do not sell your data to any third party, ever.

6. Who can see your messages

Only you can access your messages while your account is active. No Alvida employee reads your message content — access controls are in place to enforce this technically, not just by policy. Your designated recipients receive your messages only when the delivery condition is triggered. Recipients access their messages via a private, unique link — no account or login is required.

Our infrastructure providers (Supabase for database storage) may have technical access to encrypted data as part of operating their services. We rely on their security and compliance certifications, and we share only what is necessary for them to perform their function.

7. Recipient data — a special note

When you add a recipient, you provide us with their name and email address. Recipients are not registered users of Alvida and have not consented to being in our system. We want to be transparent about how we handle their data:

• Recipient data is stored solely to enable delivery of your messages when triggered.
• We never contact recipients before delivery is triggered, except to deliver messages.
• We never use recipient data for marketing, profiling, or any secondary purpose.
• Recipients may contact us at hello@alvida.in to request removal of their data from our systems. We will honour such requests unless they conflict with your instructions as the account holder.
• By adding a recipient, you confirm you have the right to share their contact details with us for the purpose of delivering your message.

8. Third-party services

We use the following third-party services to operate Alvida. Each receives only the minimum data necessary for their function:

• Supabase — database and user authentication. Data is stored on servers in the EU and US. Privacy Policy
• Vercel — application hosting and content delivery. Privacy Policy
• Resend — transactional email delivery (check-ins, message notifications, verification emails). Privacy Policy
• WATI — WhatsApp Business API. Not yet active — no data is currently shared with WATI. Planned for a future update. Privacy Policy
• Razorpay — payment processing for paid plans. Card and banking data is handled entirely by Razorpay and never touches our servers. Privacy Policy
• Sentry — error monitoring and diagnostics. May capture anonymised technical data when application errors occur. Privacy Policy

9. Cross-border data transfers

Some of our third-party service providers store and process data outside India — specifically in the United States and the European Union (Supabase, Vercel, Resend, Sentry). By using Alvida, you acknowledge and consent to your data being transferred to and processed in these jurisdictions. We take reasonable steps to ensure these providers maintain adequate data protection standards, including reviewing their compliance certifications and data processing agreements.

10. Data security

We take reasonable and appropriate measures to protect your data:

• All data in transit is encrypted using TLS (HTTPS).
• Data at rest is encrypted by our database provider (Supabase).
• Access to production systems is restricted to authorised personnel only.
• Authentication uses industry-standard session tokens with expiry.
• Passwords are never stored in plain text.

No system is completely immune to security risks. In the event of a data breach that is likely to result in a risk to your rights, we will notify affected users and the relevant authorities as required under applicable law without undue delay.

11. Cookies and session data

Alvida uses essential cookies and session tokens to keep you signed in and to maintain a secure session. These are strictly necessary for the service to function — you cannot opt out of them while using Alvida. We do not use advertising cookies, tracking pixels, or third-party behavioural analytics. We use Vercel Analytics for aggregate, cookieless traffic measurement (page views and general usage patterns). No personal data is attached to these analytics.

12. Data retention

• Active accounts: your data is retained for as long as your account remains active.
• Account deletion: when you delete your account, all your personal data — including messages, voice recordings, photo attachments, recipient records, and account information — is permanently deleted within 30 days.
• Delivered messages: once your messages have been delivered to recipients, they remain accessible to those recipients via their private link. This access is retained indefinitely so recipients can revisit your messages. If you wish to revoke this, contact us before delivery is triggered.
• Payment records: transaction records are retained for 8 years as required by Indian tax law.
• If Alvida shuts down: in the event that Alvida ceases operations, we will give users a minimum of 90 days' notice by email, provide a data export of all messages and account data, and securely delete all data before shutdown. No data will be sold or transferred to a third party as part of any wind-down.

13. Your rights

Under the Digital Personal Data Protection Act 2023 and applicable Indian law, you have the following rights:

• Right to access: request a summary of the personal data we hold about you.
• Right to correction: request correction of inaccurate or incomplete personal data.
• Right to erasure: request deletion of your account and all associated data.
• Right to data portability: download all your messages and recipient data at any time from the Settings page using the "Download my data" feature.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time by removing your phone number in Settings. Withdrawal does not affect processing already carried out.
• Right to nominate: under the DPDP Act, you may nominate an individual to exercise your data rights on your behalf in the event of your death or incapacity. To register a nominee, contact us at hello@alvida.in.
• Right to grievance redressal: if you are dissatisfied with how we handle your data, you may raise a complaint with our Grievance Officer (see Section 15).

To exercise any of these rights, contact us at hello@alvida.in. We will acknowledge your request within 48 hours and resolve it within 30 days of receipt.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will notify you by email at least 14 days before the changes take effect. The updated policy will also be posted on this page with a revised "Last updated" date. Continued use of Alvida after the effective date constitutes acceptance of the updated policy.

15. Grievance Officer

In accordance with the Information Technology Act 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2011, we have appointed a Grievance Officer to address complaints and concerns regarding the processing of your personal data.

If you are not satisfied with our resolution, you may escalate your complaint to the Data Protection Board of India once constituted under the DPDP Act 2023.

16. Governing law

This policy is governed by the laws of India, including the Information Technology Act 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2011, and the Digital Personal Data Protection Act 2023. Any disputes arising under this policy shall be subject to the exclusive jurisdiction of the courts of India.

17. Contact

For general questions about this policy, write to us at hello@alvida.in. For complaints or data-related requests, contact our Grievance Officer at grievance@alvida.in.