Privacy Policy

1. Who We Are

YVITY is a technology platform designed to help IRDAI-registered insurance advisors build a verified professional profile, showcase their expertise, and connect with prospective clients. We are headquartered in India and operate exclusively within Indian jurisdiction.

For privacy-related inquiries, contact us at: support@yvity.com

2. Information We Collect

2.1 Information You Provide Directly

• Registration data: Mobile number and/or email address used for OTP-based sign-up.
• Profile information: Full name, professional photo (selfie), designation, city, bio, years of experience, and area of specialisation.
• Career & education: Work history, educational qualifications, and professional certifications (e.g., IRDAI licence/certificate details).
• Service listings: Insurance products and services you offer, pricing, and descriptions.
• Gallery & media: Images you upload to showcase your work or office.
• Testimonials & recommendations: Client testimonials and peer recommendations you submit or receive.
• Payment information: Billing details submitted during membership plan purchase (processed securely by Razorpay — we do not store card numbers).
• Support messages: Name, email, and message content when you contact support.
• Verification documents: IRDAI certificate and other documents uploaded for profile verification.

2.2 Information We Collect Automatically

• Usage data: Pages visited, features used, profile views, search appearances, and interaction timestamps.
• Device & technical data: IP address, browser type, operating system, and device identifiers.
• Session data: Login sessions managed via secure, HTTP-only cookies.
• Activity signals: Login frequency and engagement patterns used to calculate your YVITY Score.

2.3 Information From Third Parties

• WhatsApp (Meta): Delivery status of OTP and transactional messages sent through the WhatsApp Business API.
• Razorpay: Payment confirmation, order status, and transaction identifiers for membership purchases.

3. How We Use Your Information

• To provide the platform: Create and manage your advisor profile, enable discovery by clients, and power your YVITY Score.
• For authentication: Verify your identity via OTP (WhatsApp or email) every time you log in.
• Profile verification: Review uploaded documents to verify IRDAI credentials and approve your public profile.
• Payment processing: Process membership plan payments via Razorpay and deliver invoices by email and WhatsApp.
• Notifications: Send account updates, payment receipts, verification status, and platform announcements.
• Platform improvement: Analyse aggregate usage patterns to improve features (no personal profiling for advertising).
• Security & fraud prevention: Detect suspicious login activity and prevent unauthorised access.
• Legal compliance: Retain records as required by applicable Indian law, including the DPDP Act and IT (Intermediary Guidelines) Rules.

4. Legal Basis for Processing

Under the DPDP Act, 2023, we process your personal data on the following bases:

• Consent: You consent when you register and accept these terms. You may withdraw consent at any time by deleting your account.
• Contractual necessity: Processing required to deliver the services you signed up for (profile hosting, OTP login, payment invoices).
• Legitimate interests: Platform security, fraud detection, and aggregate analytics.
• Legal obligation: Compliance with Indian law, including responding to lawful government requests.

5. How We Store and Protect Your Data

• Infrastructure: All data is stored in Supabase (PostgreSQL) hosted on secure cloud infrastructure with encryption at rest and in transit (TLS 1.2+).
• Access controls: Production database access is restricted to server-side services only. No client-side code can access the database directly.
• Authentication tokens: Session tokens are stored in secure, HTTP-only cookies to prevent XSS theft.
• OTP validity: OTP codes expire after 10 minutes and are single-use.
• Payment security: Card and payment data is handled entirely by Razorpay (PCI-DSS compliant). YVITY never stores raw payment card details.
• Document storage: Verification documents are stored in access-controlled cloud storage, accessible only to authorised YVITY administrators.

6. Sharing Your Information

We do not sell your personal data. We share it only in the following limited circumstances:

• Public profile: Information you explicitly add to your profile (name, photo, bio, services, testimonials, gallery) is visible to anyone who visits your public profile URL.
• Service providers: Razorpay (payments), Meta/WhatsApp Business API (messaging), Resend or SMTP providers (email delivery). These processors handle data only as directed by us.
• Legal requirements: We may disclose data to law enforcement or regulatory authorities where required by law or to protect the rights and safety of YVITY and its users.
• Business transfers: In the event of a merger, acquisition, or sale of YVITY, user data may be transferred to the acquiring entity with appropriate notice to users.

7. Data Retention

• Active accounts: Data retained for the duration of your account.
• Deleted accounts: Personal data is removed within 30 days of account deletion, except where retention is required by law (e.g., financial records retained for 7 years as required by Indian accounting law).
• OTP records: Retained for 90 days for security auditing, then purged.
• Payment records: Retained for 7 years as required by Indian financial regulations.

8. Cookies and Tracking

YVITY uses essential cookies only:

• Session cookies: Maintain your login state. Deleted when you log out or close your browser.
• Preference cookies: Remember UI preferences (e.g., dark/light mode).

We do not use advertising cookies, cross-site tracking pixels, or third-party analytics services (e.g., Google Analytics) that track you across websites.

9. Your Rights Under DPDP Act, 2023

As a data principal, you have the following rights. To exercise any of these, email support@yvity.com with your registered email or phone number:

• Right to access: Request a copy of the personal data we hold about you.
• Right to correction: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data (subject to legal retention obligations).
• Right to withdraw consent: Withdraw consent at any time; this will result in account deletion and cessation of services.
• Right to grievance redressal: Lodge a complaint with our Grievance Officer (contact below) or with the Data Protection Board of India.
• Right to nominate: Nominate a trusted person to exercise your rights in the event of death or incapacity.

We will respond to verifiable requests within 30 days.

10. Children's Privacy

YVITY is intended for adults and licensed insurance professionals. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that a minor has provided us with personal data, we will delete it promptly.

11. Data Transfers

Our primary data storage is within India. Where third-party service providers (e.g., email delivery services) process data outside India, we ensure appropriate contractual safeguards are in place consistent with the DPDP Act and applicable rules.

12. Grievance Officer

In accordance with the IT Act, 2000 and the DPDP Act, 2023, our Grievance Officer can be reached at:

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or a prominent notice on the platform at least 14 days before the change takes effect. Continued use of YVITY after the effective date constitutes acceptance of the revised policy.

14. Contact Us

For any privacy-related questions or to exercise your rights, contact us at: