Privacy Policy

1. Who we are

This Privacy Policy explains how LongevityVeda ("LongevityVeda", "we") processes personal data when you use the LongevityVeda Platform. For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act") we are a Data Fiduciary, and for the purposes of the EU/UK General Data Protection Regulation ("GDPR") we are a controller, for the data described here. Providers who receive your enquiry or booking become separate, independent data fiduciaries/controllers for the data they receive and are responsible for how they use it.

2. Data we collect

• Account data: name, email address, password (stored only as a secure hash), role, phone number if you add it, and the date and version of the terms you accepted.
• Enquiry and booking data: the Provider and program, your message, preferred dates, number of guests, accommodation and add-on choices, and booking status.
• Payment data: payment status, amount, currency and the payment gateway's reference IDs. Card and bank details are entered directly with the payment gateway; we never receive or store full card numbers.
• Reviews and content: ratings, review text, optional review photos (location metadata is removed), reports, and messages you send through the Platform.
• Preferences: answers to the Find-your-experience questionnaire, saved items and search queries. Please do not enter health conditions or other sensitive details; the Platform does not need them.
• Provider data: business details, contact details, listings, verification documents (stored privately and shown only to authorised staff) and subscription records.
• Technical data: a session cookie, IP address (used for security and rate limiting), browser type and basic server logs.
• Newsletter: your email address, consent wording and confirmation status.

3. Why we use it and our legal basis

• To create and run your account and provide the Platform: performance of a contract / your consent (DPDP Act s.6), GDPR Art. 6(1)(b).
• To pass your enquiry or booking to the Provider you chose and to manage bookings and payments: at your request / contract, GDPR Art. 6(1)(b).
• To moderate reviews and content, prevent fraud and abuse, and keep the Platform secure: legitimate uses permitted by law (DPDP Act s.7) and legitimate interests, GDPR Art. 6(1)(f).
• To send service emails (password resets, booking updates): contract.
• To send newsletters: your consent, which you confirm by email and can withdraw at any time, GDPR Art. 6(1)(a).
• To meet legal obligations such as tax, accounting and responding to lawful requests: legal obligation, GDPR Art. 6(1)(c).

We do not sell personal data, and we do not use it to make decisions that have legal or similarly significant effects on you solely by automated means. The AI search feature only interprets your search words to filter listings.

4. Sharing with Providers

When you send an enquiry, we share your name, email, phone (if given), message and dates with that Provider only, so it can reply. When you send a booking request, the Provider sees your name and the booking details; your email and phone are shared once your booking deposit is paid. The Provider then handles that data under its own privacy policy. Reviews you publish are shown publicly with your first name or display name.

5. Processors and service providers

We use carefully selected processors who act on our instructions:

• Hosting: Vercel Inc. (application hosting and delivery).
• Database: Turso / ChiselStrike Inc. (managed database; our database is hosted in the AWS ap-south-1 Mumbai region).
• Email: Resend (transactional and confirmation emails), when enabled.
• Payments: Razorpay Software Pvt. Ltd. and/or Paytm Payments Services Ltd., when enabled. They process payment data as independent controllers under their own policies.
• Sign-in: Google and Apple, only if you choose to sign in with them.
• AI search: an AI language-model provider, when enabled, receives only the text of your search query.
• Maps: OpenStreetMap tiles are loaded from OpenStreetMap servers, which receive your IP address.

Some processors are outside India or the EU. Where data is transferred internationally we rely on lawful transfer mechanisms, such as the DPDP Act's provisions on cross-border transfer and, for GDPR, Standard Contractual Clauses.

6. Cookies

We use one strictly necessary session cookie to keep you signed in, and functional cookies for your comparison list and questionnaire answers. We do not use advertising or third-party analytics cookies. See the Cookie Policy.

7. Retention

• Account data: while your account is open. When you delete your account, your name, email, phone, preferences, saved items, notifications and sessions are deleted or anonymised immediately.
• Enquiries, bookings and messages: kept while your account is open so you and the Provider can refer to them; your identifying details on enquiries are anonymised when you delete your account. Booking, payment and invoice records may be kept for up to 8 years where tax and accounting law requires.
• Security and audit logs: kept only as long as needed to protect the Platform and meet legal obligations.
• Newsletter data: until you unsubscribe or ask us to delete it. Unconfirmed sign-ups never receive newsletters.
• Provider verification documents: for the life of the listing, and afterwards only as long as needed for legal claims or obligations.

8. Your rights

Depending on where you live, you have the right to access, correct, update, complete and erase your personal data; to withdraw consent at any time (without affecting earlier processing); to data portability; to object to or restrict processing; to nominate another person to exercise your rights in the event of death or incapacity (DPDP Act s.14); and to grievance redressal.

• Export: download a copy of your data at any time from Account › Privacy.
• Delete: delete your account from Account › Privacy.
• Other requests: contact us using the details below. We will respond within 30 days, or sooner where the law requires.

If you are not satisfied with our response, you may complain to the Data Protection Board of India, or, in the EU/UK, to your local data protection authority.

9. Children

The Platform is intended for adults aged 18 or over. We do not knowingly collect personal data from children. Bookings for a child must be made by a parent or legal guardian, who gives verifiable consent on the child's behalf. If you believe a child has given us data, contact us and we will delete it.

10. Security

We use encryption in transit (HTTPS), hashed passwords, role-based access controls with audit logs, private storage for documents and photos, rate limiting and signed payment webhooks. No system is perfectly secure; if a personal data breach occurs we will notify the Data Protection Board of India, affected users and other authorities as the law requires.

11. Changes

We will post changes to this policy here and update the "Last updated" date. Material changes will be notified on the Platform or by email.

12. Contact and grievance redressal

• Privacy questions and rights requests: the contact email published on this page
• Grievance Officer: to be appointed, Grievance Officer, to be published, to be published, to be published.