Privacy Policy

• Operator: NAP Designs
• Product: Vaklipi — audio & video transcription service
• Registered contact: hello@napdesigns.com
• Grievance Officer / Data Protection Contact: Pratham, NAP Designs · hello@napdesigns.com

2.1 Account data

• Your email address (used for account identity and login OTP delivery)
• Optional display name if you set one
• User-configurable settings: retention window, custom vocabulary, theme, referral link

2.2 Content you upload

• Audio and video files you upload for transcription
• URLs you submit (e.g. YouTube links you ask us to transcribe)
• Transcripts generated by our engines from those files
• Edits you make to those transcripts
• Optional AI-derived outputs you opt into per job: chapters, speaker labels, translations, PII-redacted variants, chat Q&A history

2.3 Usage and technical data

• Job metadata: title, duration, detected language, chosen engine, status, timestamps, error codes
• Rate-limit counters tied to your IP address (temporary, pruned nightly)
• Server logs: request paths, response codes, worker events for each transcription job
• Aggregate usage analytics (page views, feature clicks) — never tied to file content
• Error reports (if we have Sentry enabled)

2.4 Payments (when Pro launches)

• Razorpay order and payment identifiers, purchased minutes, amount and status
• We do not receive or store your card number, UPI PIN, CVV, or any other raw payment credential — those go directly to Razorpay.

2.5 Waitlist and marketing

• Email address and the source form (landing, footer, exit-intent) if you join the Pro waitlist.

• To provide the Service: authenticate you, run transcription pipelines, deliver exports, honor your retention settings.
• To bill and reconcile: track minute balances via an append-only ledger; process purchases through Razorpay (Pro tier).
• To communicate: send transactional emails (login OTPs, job completion, receipts). No unsolicited marketing.
• To improve reliability: aggregate metrics, error rates, cost telemetry. Never uses your file content.
• To prevent abuse: rate limits, spend caps, fraud detection using minimal necessary signals.

Legal basis (DPDP Act): primarily your consent given at signup and per-job. Some uses (fraud prevention, meeting legal obligations, protecting our legitimate business operations to the limited extent permitted) rely on other lawful grounds under the Act.

• Primary storage: Supabase-managed Postgres and Storage in AWS ap-south-1 (Mumbai, India).
• Application hosting: Vercel (Mumbai region, bom1) for the web app and Railway for the worker service.
• Cross-border transfers: some transcription requests are routed to Groq (audio processed on US infrastructure) when the detected language is non-Indic. For Indic languages we route to Sarvam AI (India). See Section 5 for the full list of sub-processors.

We share the minimum data required with these processors. Each is contractually bound to confidentiality and to purposes we specify.

We do not sell your personal data to anyone. We do not share it with advertisers.

• Source audio/video files: auto-deleted after your configured retention window (default 30 days) by a scheduled job.
• Transcripts, chapters, translations: retained until you delete them individually or delete your account.
• Job metadata, ledger entries, event logs: retained for the life of your account for audit and dispute resolution; anonymized after deletion where required by law.
• Rate-limit counters: pruned nightly (rows older than 48 hours removed).
• Waitlist emails: retained until Pro launches or you unsubscribe/request removal.
• Payment records (Pro): retained for 8 years to meet Indian financial-record-keeping requirements.

• We do not train any model on your audio, transcripts, or edits.
• We do not sell your data.
• We do not share your data with advertisers or data brokers.
• We do not read your transcripts for any purpose beyond providing features you enable.

You have the right to:

• Access — see what personal data we hold about you. Available in-app via the dashboard and CSV export; email us for anything not covered there.
• Correct — fix inaccurate data. Most fields are editable in-app; email us for the rest.
• Erasure — request deletion of your data or your whole account. Full purge (including storage objects) within 24 hours.
• Data portability — download your transcripts in TXT, SRT, VTT, DOCX and PDF; download job metadata as CSV.
• Withdraw consent — you can withdraw consent for optional AI features at any time; core-service consent is required to keep the account open.
• Nominate — nominate another individual to exercise your rights on your behalf in case of death or incapacity, per Section 14 of the DPDP Act. Contact us to record a nomination.
• Grievance — raise a complaint with our Grievance Officer (contact below). Acknowledged within 72 hours, resolved within 30 days.

To exercise any of these, email hello@napdesigns.com.

• All traffic uses TLS 1.3.
• Storage, database and backups are encrypted at rest.
• Every table has row-level security so a user can access only their own data.
• Service-role keys are held only by our backend/worker and never exposed client-side.
• Access to production infrastructure is limited to the founder and rotated regularly.

If we become aware of a personal-data breach that affects you, we will notify the Data Protection Board of India and the affected users promptly, as required by the DPDP Act. The notification will describe the nature of the breach, the data affected, likely consequences, and the steps you can take.

• Essential cookies for session and authentication (Supabase Auth cookies).
• Local storage for UI preferences (theme, onboarding-dismissed flag, exit-intent throttle).
• No third-party advertising or tracking cookies.

Vaklipi is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has an account, contact us and we will delete it.

We send transactional emails (login OTPs, job completion, payment receipts). We do not send marketing emails unless you have joined the Pro waitlist or explicitly opted in; you can unsubscribe at any time from within the email.

Transcription and AI outputs are automated. No decision that produces a legal or similarly significant effect on you is made solely by automated processing.

If we make material changes we will update the “Last updated” date at the top and, where reasonably possible, notify you by email or in-app before the change takes effect. Continuing to use the Service after that constitutes acceptance of the updated policy.

For any privacy question, data-rights request or complaint:

• Grievance Officer: Pratham, NAP Designs
• Email: hello@napdesigns.com
• Response SLA: Acknowledged within 72 hours; resolved within 30 days
• Escalation: If unresolved, you may raise a complaint with the Data Protection Board of India constituted under the DPDP Act 2023.