Anvesham
Log in

LEGAL

Privacy Policy

Effective 3 September 2026

This policy explains what personal data Partha Borthakur (sole proprietor), trading as Anvesham (“we”) collects when you use Anvesham, why, and the rights you have under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000. We are the data fiduciary for the data described here.

1. What we collect

  • Account data — email, name, password hash (never the password), and, if you sign in with Google, the identifier and profile picture Google provides.
  • Onboarding preferences — your role, industries, markets and, optionally, what you are building.
  • Usage data — companies you view, questions you ask, ideas you evaluate, what you follow and track. This powers your history, alerts and personalisation.
  • Payment records — plan, amount, transaction id and status. Card, UPI and bank details are collected by PayU, not by us.
  • Technical data — IP address, browser type and pages visited, in server logs and, if you consent, analytics.

The companies, products and market information shown in the Service are collected from public sources and concern businesses, not you. Where a public source mentions an individual (for example a founder in a press article), we display it as published and link to the source.

2. Why we use it (purposes)

  • To provide the Service: authenticate you, run the analyses you request, save your watchlist and history, and send alerts you have asked for.
  • To take payment and keep records the law requires us to keep.
  • To personalise what you see, based on the preferences you gave us and what you use.
  • To keep the Service secure, enforce usage limits and prevent abuse.
  • With your consent, to measure how the Service is used so we can improve it (analytics).

3. Legal basis and consent

We process account, usage and payment data because it is necessary to provide the Service you signed up for. Analytics cookies are set only after you consent, and you can withdraw that consent at any time using the banner or your browser settings. We do not sell personal data and do not use it for third-party advertising.

4. Who we share it with (processors)

We share personal data only with providers who process it on our behalf under contract:

  • AI model providers — the text of questions and ideas you submit, and the public company data needed to answer them, is sent to third-party AI model providers to generate analyses. It is not used by them to train models under our agreements.
  • Cloud infrastructure and database hosting.
  • Payment processing — PayU, which is an independent data fiduciary for the payment details you enter with them.
  • Sign-in — Google, if you choose to sign in with Google.
  • Analytics — Google Analytics, only if you consent.

You may request the current list of processors at pbdomains01@gmail.com. We may disclose data where required by law or to protect our rights, and to a successor in a merger or acquisition on the same terms.

5. Cross-border transfers

Some processors operate outside India. Transfers are made in accordance with the DPDP Act and any restrictions notified by the Central Government, with contractual protections in place.

6. Retention

  • Account and usage data: for as long as your account exists, and up to 90 days after deletion for backups and dispute handling.
  • Payment records: as required by Indian tax and accounting law (currently up to 8 years).
  • Research questions and idea evaluations: cached for up to 7 days for your own reuse, then retained as part of your history until you delete it or your account.
  • Server logs and backups: rotated within 14–30 days.

7. Your rights

Under the DPDP Act you may:

  • Access a summary of the personal data we hold about you and how it is processed.
  • Correct inaccurate or incomplete data, or update it (most of this you can do in your account).
  • Erase your data, subject to retention the law requires.
  • Withdraw consent for consent-based processing (analytics) at any time.
  • Nominate a person to exercise these rights on your behalf in the event of death or incapacity.
  • Raise a grievance with us, and if unresolved, with the Data Protection Board of India.

Write to pbdomains01@gmail.com. We verify identity before acting on requests and respond within the timelines the law prescribes.

8. Security

Passwords are stored as salted bcrypt hashes. Sessions use signed, HTTP-only cookies. Data in transit is encrypted with TLS. Access to production systems is restricted and logged. No system is perfectly secure; if a breach affecting you occurs we will notify you and the Data Protection Board as the law requires.

9. Children

The Service is for adults running or evaluating businesses. We do not knowingly collect data from anyone under 18.

10. Cookies

  • Strictly necessary — session cookie, theme preference, pane layout. No consent needed.
  • Analytics — Google Analytics, only after you accept the banner.

11. Changes

We will post changes here and, for material changes, notify you in the Service or by email.

12. Grievance officer and contact

Partha Borthakur, Grievance Officer — pbdomains01@gmail.com. Postal: Partha Borthakur (sole proprietor), trading as Anvesham, Christian Basti, Dispur, Guwahati - 781005, Assam, India. General support: pbdomains01@gmail.com.