Privacy Policy

Vagary Labs LLP · Effective Date: 2026-09-26 · Version v2.2

1. Introduction

This Privacy Policy explains how Vagary Labs LLP ("we", "our", "us") — the Data Fiduciary — collects, uses, shares, and protects personal information across our products and services. Products are released under their own brands and include (without limitation): Vagary Voice, Bellring, Aakhara, Pulseboard, and the Vagary Platform substrate (including Index of News). Individual products may publish supplemental privacy notices; this corporate policy applies in all cases as the umbrella baseline. Where a product's supplemental notice conflicts with this policy, the supplemental notice controls for the subject matter it addresses, and this policy governs everything it does not cover.

Data Fiduciary (Data Controller)

Under India's Digital Personal Data Protection Act, 2023 the entity that determines the purpose and means of processing is the Data Fiduciary, and the person the data relates to is the Data Principal. Where the EU or UK GDPR applies, those terms map to controller and data subject respectively. This policy uses the DPDP terms throughout.

Entity: Vagary Labs LLP — an Indian limited liability partnership (LLPIN ADA-4675), registered office House No. 418 Ward No. 38, Chandni Takij Road, Satna, Kotwali, Raghurajnagar, Satna - 485001, Madhya Pradesh, India
Contact email: [email protected]
Privacy contact: [email protected] (Subject line: "Privacy")
Jurisdiction: India (primary). We process data globally where users access our services.

2. Information We Collect

We collect information necessary to provide and improve our services. Categories include:

2.1 Information you provide

Account information: email address, name (optional), password (hashed), and organisation (optional).
Phone number: where a product identifies you by phone number rather than by an account, we process that number as your identifier.
Communications: messages, support requests, feedback, and survey responses you send us.
Payment information: billing details processed by our payment partners (Stripe, Razorpay); we do not store full payment card numbers.
Product-specific data: e.g. voice recordings and transcripts for Vagary Voice; user-generated content for the Vagary Platform. Products that are still in development (Bellring, Aakhara) are not available to users and collect nothing. Pulseboard is an open-source Android application that uploads its measurements to a Google Sheet controlled by whoever deploys it; those measurements do not reach Vagary Labs LLP.

2.2 Information collected automatically

Technical data: IP address, browser type, device and operating system, approximate location (city/region level), and access timestamps.
Usage data: pages visited, features used, session duration, error logs, and performance metrics.
Cookies and similar technologies: see Section 8 (Cookies).
Analytics: Google Analytics 4 (anonymised IP); see Section 5 (Third Parties).

2.3 Information from third parties

Authentication providers (Google, Microsoft, Apple) when you sign in via OAuth — we receive your email and name.
Payment processors confirming successful transactions.
Integration partners where you have authorised data sharing.

3. How We Use Your Information

We process personal information on the following lawful bases:

Performance of a contract — to deliver the products and services you request.
Legitimate interests — for security, fraud prevention, service improvement, and limited analytics.
Consent — for marketing communications, optional analytics cookies, and any product-specific use that requests your opt-in (e.g. AI training on your inputs).
Legal obligation — for tax, accounting, and statutory requirements under Indian law and applicable foreign law.

Specific uses include: account creation and authentication; delivering product features; processing payments; sending service notifications; responding to support requests; security monitoring; analytics in aggregate form; and complying with legal obligations.

4. Data Retention

We retain personal information only as long as necessary for the purposes set out in this policy or as required by law. Indicative retention periods:

Data type	Retention	Reason
Account data	Lifetime of account + 90 days	Service provision
Voice recordings (Vagary Voice)	Only as long as needed to deliver the service, then deleted or anonymised. No fixed period is published; see the Vagary Voice privacy notice for the period that applies to your account	Service delivery
Conversation transcripts	Account lifetime	Context and history
Analytics (individual)	90 days	Service improvement
Billing records	7 years	Indian tax law
Security/audit logs	1–7 years	Security and compliance

You may request earlier deletion at any time (see Section 7, Your Rights).

5. Third-Party Service Providers

We share personal information only with vetted processors who act on our instructions under written agreements. Representative categories include:

Cloud infrastructure: Hostinger (VPS), Cloudflare (DNS/CDN/Access).
AI and voice processing: OpenAI, Anthropic, Google (Gemini), Deepgram, ElevenLabs — used to power product-specific features.
Payments: Stripe, Razorpay.
Email and notification: our own Mailcow mail server on Vagary Labs infrastructure; SendGrid where required for transactional volume.
Analytics and observability: Google Analytics 4 (anonymised), Sentry/Glitchtip (error reporting), PostHog (product analytics with consent).
Advertising (Vagary Platform vertical sites only): Google AdSense (publisher ca-pub-8413532915493704) and Google Tag Manager. The Vagary Platform news verticals — indexofnews.com, attorneyatlas.com and attorneyatlas.us — are free to read and funded by advertising, so ad delivery and measurement tags run on those domains. See Google's policies.google.com/technologies/partner-sites.

We do not sell personal information.

Vagary Labs LLP does not share personal information for cross-context behavioural advertising on vagarylabs.com or on any product other than the Vagary Platform vertical sites named above. Those sites carry third-party advertising, and the ad and tag-management providers on them may process identifiers for ad delivery, measurement and personalisation. Their own controls, and the cookie notice published on those sites, govern that processing.

Google API Services Limited Use. We use several Google APIs — AdSense Management, Google Ads, Google Analytics Admin, Google Merchant Center, Google Search Console, Google Tag Manager, and YouTube Data/Analytics — to operate our own advertising, analytics, search and content-distribution accounts for the platform's products. This use accesses our own account data on those Google services, not any end user's personal Google data. Vagary Labs LLP's use and transfer of information received from these APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements: we use this data solely to operate and improve the monetization, analytics, search and content-distribution features it supports; we do not sell it; we do not transfer it to third parties except as necessary to provide or improve those features (and then only with consent or as legally required); we do not use it to serve advertising to end users; and we do not allow our employees or contractors to read it except for security or abuse-investigation purposes, to comply with law, or where it has been aggregated for internal reporting.

6. International Transfers

Vagary Labs LLP is based in India. Our own servers are hosted in India (Mumbai) and the United States (Boston), and several of our service providers operate in the United States; the full list, with each one's processing location, is published at /subprocessors. When personal data is transferred internationally, we rely on appropriate safeguards — standard contractual clauses, adequacy decisions where applicable, and additional technical measures (encryption in transit and at rest).

7. Your Rights

Subject to applicable law (including the Indian Digital Personal Data Protection Act, 2023; the EU GDPR; the UK Data Protection Act 2018; and the California Consumer Privacy Act / CPRA), you may have the following rights:

Access — request a copy of the personal data we hold about you.
Rectification — correct inaccurate or incomplete data.
Erasure — request deletion of your data ("right to be forgotten"), subject to legal retention exceptions.
Restriction — restrict processing in defined circumstances.
Portability — receive your data in a structured, machine-readable format.
Objection — object to processing based on legitimate interests, including direct marketing.
Withdraw consent — for processing that relies on your consent.
Complaint — lodge a complaint with the Data Protection Board of India or your local supervisory authority.

To exercise any of these rights, email [email protected] with the subject "Privacy Request". We acknowledge requests within 48 hours and answer them within 30 days; identity verification may be required.

8. Cookies

We use cookies and similar technologies to operate our services and to understand how they are used. Categories:

Essential cookies — required for authentication, session management, and security.
Analytics cookies — Google Analytics 4.
Preference cookies — remember your language and UI choices.
Advertising cookies — set on the Vagary Platform vertical sites only (see Section 5).

On vagarylabs.com, we do not currently run analytics or set any non-essential cookie. Should that change, we will only do so after you give consent, consistent with the consent-based lawful basis described in Section 3.

Other products set their own cookies and operate their own controls; those are described in each product's cookie notice, not here. See our Cookie Policy for the full inventory for vagarylabs.com. You can also block or delete cookies through your browser settings; disabling essential cookies may degrade service.

9. Security

We apply technical and organisational measures designed to protect personal data, including: TLS in transit, encryption at rest where appropriate, access controls based on least privilege, secret-management through a dedicated secrets vault (Infisical), 24×7 alerting on infrastructure incidents, and routine review by the Vagary Labs operations team. No system is perfectly secure; we will notify you of any breach affecting your personal data as required by law.

10. Children's Privacy

Our services are not directed at children. Where we do process the personal data of a child, we require verifiable parental or guardian consent first, as the DPDP Act requires, and we do not undertake tracking, behavioural monitoring, or advertising targeted at children. If you believe a child has provided personal information to us without that consent, contact [email protected] and we will delete it promptly.

11. Third-Party Links

Our products may link to websites and services operated by third parties. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy notices before providing personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email (to account holders) and by a notice on this page. Continued use of our services after a change becomes effective constitutes acceptance of the revised policy.

13. Contact

Questions, requests, or complaints regarding this Privacy Policy or our data practices:

Email: [email protected] (Subject: "Privacy")
Postal: Vagary Labs LLP, House No. 418 Ward No. 38, Chandni Takij Road, Satna, Kotwali, Raghurajnagar, Satna - 485001, Madhya Pradesh, India

Grievance Officer

In accordance with India's Digital Personal Data Protection framework, Vagary Labs LLP designates a Grievance Officer to receive and act on data-principal requests and complaints:

Grievance Officer: Chinmay Ramraika — [email protected]
Registered office: House No. 418 Ward No. 38, Chandni Takij Road, Satna, Kotwali, Raghurajnagar, Satna - 485001, Madhya Pradesh, India

Requests are acknowledged within 48 hours and answered within 30 days. Identity verification may be required before a request affecting personal data is actioned.

14. Governing Law

This Privacy Policy is governed by the laws of India. Disputes are subject to the exclusive jurisdiction of the competent courts located in India, without prejudice to any rights you may have under applicable mandatory law in your jurisdiction.