VartaForge ("we", "us") is an editorial AI platform serving Indian-language newsrooms. This policy describes what personal data we collect, why we collect it, who we share it with, and the rights you have over it.
Plain-language summary: we collect the minimum we need to operate the product. We do not sell data. We do not use one customer's Voice Card to serve another. You can ask us to delete your data and we will honour that within 30 days.
1. What we collect
Account data
- Name, email, role, and the publication you work at - provided when you sign up or book a demo.
- Hashed password (we never store the plaintext).
- Login times and approximate IP, used for session security and abuse triage.
Usage data
- Topics and prompts you submit, articles you generate, headlines you accept or reject, edits you make.
- Per-org metering for billing (article counts, audio minutes, voice cards, languages enabled).
Marketing-site data
- Contact-form and demo-form submissions: name, email, organization, role, and any details you choose to add.
- Referrer and page URL at the time of submission, used solely to improve where we focus our outreach.
2. How we use it
- To deliver the product (generate articles in your voice, store and surface them, bill correctly).
- To respond to inquiries and book demos.
- To detect and prevent abuse, fraud, and spam.
- To comply with applicable laws (India IT Act, sector-specific regulations).
We do not sell personal data, share it for advertising, or train any cross-tenant model on it. See the Voice Card Property Policy for the specific commitments around Voice Card data.
3. Voice Card data
The corpus you upload (articles already published by your masthead) is processed only to build the Voice Card for your organization. The Voice Card itself - signature phrases, persona blend, headline patterns, structural shapes - belongs to you. We do not use it to serve any other customer.
You can export the Voice Card and the raw corpus at any time. You can delete either; deletion is purged from primary stores within 24 hours and from indexes / backups within 30 days.
4. Cookies and local storage
The marketing site (vartaforge.com) sets one localStorage key
(vf-theme) to remember your light / dark preference.
No third-party trackers, no analytics fingerprinting, no ad
pixels.
The studio (studio.vartaforge.com) uses an HTTP-only session cookie for authentication and a localStorage entry for UI preferences. No third-party cookies.
5. Sub-processors
We rely on a small number of third-party services to deliver the product:
- Google (Gemini) - LLM inference. Prompts and outputs transit through Gemini for generation. Google's data-handling terms apply (no training on API customer data per their published policy).
- Hosting providers - infrastructure for the API and database. We use providers with India-region presence where available.
- Email - transactional email for password resets, notifications, billing.
A complete and current list is available on request to [email protected]. We notify customers in writing before adding new sub-processors that materially affect data handling.
6. Your rights
You have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Request deletion (subject to our legitimate-interest retention for fraud / billing records).
- Export your data in a portable format.
- Object to specific uses, where applicable.
To exercise any of these, write to [email protected]. We respond within 30 days.
7. Retention and deletion
- Account data: kept while your account is active. Deleted within 30 days of account closure (subject to billing-record retention required by law).
- Generated articles + Voice Cards: kept until you delete them. We do not auto-purge; the customer controls retention.
- Marketing-site lead submissions: kept for 24 months for sales follow-up, then anonymised.
- Logs: rolling 90-day retention for operational logs; up to 24 months for security and audit logs.
8. Security
- TLS in transit; encryption at rest for primary stores.
- Per-org data isolation; tenant-scoped queries enforced at the application layer.
- Role-based access for our team; production access is logged and audited.
- Vulnerability disclosure: write to [email protected]. We acknowledge within 48 hours.
9. Changes to this policy
Material changes are notified via email to account holders at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
10. Contact
Privacy questions: [email protected]. All other matters: [email protected].