Privacy Policy

Nayvelle (nayvelle.club) is the Data Fiduciary for the personal data described in this policy, within the meaning of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025. This notice is given under section 5 of the DPDP Act and rule 4(1) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

Our contact for questions about your personal data is the Grievance Officer & Data Protection Contact, reachable at grievance@nayvelle.club (see Grievance Redressal).

• No advertising. We do not show ads and do not build advertising profiles.
• No selling or renting data. Not to advertisers, data brokers or anyone else.
• No third-party trackers. No analytics SDKs, tracking pixels or cross-site cookies.
• No manipulative feed. Your feed is chronological from people and spaces you choose.
• No AI training on your content. We do not use or license your posts to train AI models.
• Photo metadata stripped. Images are re-encoded in your browser before upload, removing EXIF data such as GPS location.

We do not intentionally collect sensitive categories such as health, biometric, financial account, caste or religious data. If you choose to share such information in your own posts, it is processed only to show it to the audience you select.

We process personal data on the basis of your consent (section 6 of the DPDP Act), given when you create an account, and for certain legitimate uses permitted by section 7 (such as complying with law or a court order). We use your data only to:

• create and secure your account, and keep you signed in;
• show your content to the audience you choose and show you content from people and spaces you follow;
• deliver messages, calls, notifications and emails you asked for (welcome and security alerts);
• process purchases you make and prevent payment fraud;
• detect spam, abuse and security incidents, and enforce our Terms and Community Guidelines;
• respond to your requests, complaints and grievances;
• comply with Indian law, including the IT Act, 2000, the IT Rules, 2021 and lawful Government orders.

We never use your data for advertising, profiling for marketing, or automated decisions with legal effect on you.

Every post has an audience — Public, Contacts, Close Friends or Private — and a scope (your home timeline, a group, an event or a page). Access rules are enforced inside the database itself (row-level security), not just in the app, so content is only ever returned to people your setting allows.

• Public posts may be seen by anyone, including signed-out visitors and search engines.
• Group, event and page content is visible to members according to that space’s privacy setting.
• Your name, handle and avatar are visible to other users so they can find and recognise you.
• Story viewers and reaction lists are visible to the author.

You can change audiences, profile visibility and who can contact you in Settings → Privacy & Visibility.

We use a small number of Data Processors under contracts that require them to process personal data only on our instructions and to protect it (section 8(2) of the DPDP Act):

We also disclose data when required by law — for example, on a lawful written order from an authorised Government agency under rule 3(1)(j) of the IT Rules — and we push back on requests that are overbroad or not legally valid.

Our providers operate data centres in India and other countries, so your data may be processed outside India. Section 16 of the DPDP Act permits such transfers except to countries the Central Government has restricted by notification; we do not transfer personal data to any restricted country. Wherever data is processed, the protections in this policy apply.

• While your account is active: we keep your data so the Service works.
• When you delete something: it is removed from the Service immediately, and media files are deleted from storage.
• Stories: disappear from the tray after 24 hours unless you save them to a highlight.
• When you delete your account: your profile, content, media and messages you sent are deleted immediately. Registration information and records of removed content are retained for 180 days where rule 3(1)(g)–(h) of the IT Rules requires, then erased.
• Security and access logs: retained for up to one year to detect and investigate breaches, as required by the DPDP Rules, 2025, unless a longer period is required by law.
• Purchase records: retained as required by Indian tax and accounting law.

Under section 8(7) of the DPDP Act we erase personal data once its purpose is served and no law requires us to keep it.

Under Chapter III of the DPDP Act you have the right to:

• Access a summary of your personal data and processing, and the identities of those we have shared it with (section 11). Use Download my data in Settings → Privacy & Visibility → Your data rights for an instant copy.
• Correct, complete and update your data (section 12) — edit your profile any time.
• Erase your data (section 12) — delete individual items, or use Delete my account to erase everything.
• Withdraw consent at any time, as easily as you gave it (section 6(4)). Withdrawing consent means deleting your account; it does not affect processing done before withdrawal.
• Grievance redressal through our Grievance Officer (section 13).
• Nominate a person to exercise your rights in the event of your death or incapacity (section 14) — email privacy@nayvelle.club with the nominee’s name and contact.

For any request we cannot handle in-app, email privacy@nayvelle.club from your account email address. We respond within the period prescribed under the DPDP Rules and in any case within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India after first using our grievance process (section 13(3)).

Nayvelle is for people aged 18 and over. We do not knowingly process the personal data of children and do not carry out tracking, behavioural monitoring or targeted advertising directed at children (section 9 of the DPDP Act). If you believe a child has an account, report it to safety@nayvelle.club and we will delete it.

• All traffic is encrypted in transit with TLS; data is encrypted at rest by our infrastructure providers.
• Passwords are stored only as salted hashes; sensitive actions require re-entering your password.
• Row-level security in the database enforces audience and membership rules on every query.
• Uploaded files are type-checked, served with strict content headers and authorised per request.
• Staff access to production data is limited, logged and used only for support, safety and legal compliance.

We use only strictly necessary first-party cookies to keep you signed in and protect against request forgery, and your browser’s local storage for preferences such as theme and for the offline app shell. We use no advertising, analytics or third-party cookies, so there is nothing to opt out of.

If we change this policy in a way that affects how we use your personal data, we will notify you in the app and by email before the change takes effect and, where the DPDP Act requires, ask for your consent again.