Privacy Policy

1. Overview

This Privacy Policy describes how Adviita ("we," "us," or "our") collects, uses, stores, and protects personal data when you use adviita.com ("the Service"). It is written to comply with India's Digital Personal Data Protection Act, 2023 ("DPDPA") and other applicable Indian laws, and — for visitors in the United Kingdom and European Economic Area — with the UK GDPR, EU GDPR and the UK Privacy and Electronic Communications Regulations. Section 3a sets out the additional rights that apply to you if you are in the UK or EEA. Where we rely on your consent for something, such as optional analytics storage, we ask for it separately and you may withdraw it at any time; continuing to use the Service is not treated as consent for those purposes. In the context of the DPDPA, Adviita acts as a "Data Fiduciary" with respect to personal data you provide to us as a user of the Service, and as a "Data Processor" with respect to personal data that visitors to your published website provide to you.

2. Information We Collect

3. Legal Basis for Processing

Under the DPDPA, 2023, we process your personal data on the following bases: (a) Consent — you provide consent when you create an account and agree to this Policy; (b) Contract performance — processing is necessary to deliver the Service you have signed up for, including hosting your website and managing your subscription; (c) Legitimate interests — we process certain technical and usage data to maintain security, prevent fraud, and improve the Service, where such interests are not overridden by your privacy rights; and (d) Legal obligation — we may process or retain data where required to comply with applicable laws, court orders, or regulatory requirements.

3a. If You Are in the UK or European Economic Area

Adviita is available worldwide and a significant number of our visitors are in the United Kingdom and the European Economic Area. Where the UK GDPR or EU GDPR applies to you, this section applies in addition to the rest of this Policy, and prevails over anything inconsistent with it. CONTROLLER: Adviita is the controller of personal data you provide as a user of the Service. Where visitors submit data through a website you have published with Adviita, you are the controller of that data and we act as your processor. LAWFUL BASIS: (a) Contract — creating and operating your account, generating and hosting your website, and processing payments; (b) Legitimate interests — securing the Service, preventing fraud and abuse, and understanding aggregate product usage, balanced against your rights; (c) Consent — optional analytics and session-replay storage described in Section 7, and any marketing emails, each of which you may withdraw at any time; (d) Legal obligation — retaining records where law requires it. COOKIES AND SIMILAR TECHNOLOGIES: Under the UK Privacy and Electronic Communications Regulations and equivalent EEA rules, storing or accessing information on your device requires your prior consent unless it is strictly necessary to provide a service you have requested. We therefore ask before setting any analytics, session-replay or attribution storage, and we do not set it if you decline. See Section 7. YOUR RIGHTS: You have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing (including processing based on legitimate interests), to data portability, and to withdraw consent at any time without affecting processing carried out before withdrawal. To exercise any of these, contact support@adviita.com. We respond within one month. INTERNATIONAL TRANSFERS: Your data may be transferred to and processed in countries outside the UK and EEA, including India and the United States. Where we do so, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, or the European Commission's Standard Contractual Clauses, together with data processing agreements with our providers. COMPLAINTS: If you are in the UK you may complain to the Information Commissioner's Office at ico.org.uk. If you are in the EEA you may complain to your national supervisory authority. We would ask you to contact us first so we can try to resolve the matter.

4. How We Use Your Information

We use the personal data we collect to: (a) create and manage your account; (b) provide, operate, and improve the Service, including AI website generation and hosting; (c) process payments and manage your subscription; (d) send you transactional emails such as login links, payment receipts, and account notifications — we do not send marketing emails without your separate opt-in; (e) respond to your support requests; (f) detect, investigate, and prevent fraudulent or unauthorised activity; (g) comply with legal obligations; and (h) analyse aggregate, anonymised usage trends to improve our product. We will never sell your personal data to third parties.

5. How We Share Your Information

We do not sell or rent your personal data. We share data only in the following circumstances: (a) Service Providers — we share data with trusted third-party vendors who process data on our behalf, including our payment processor (Dodo Payments), cloud infrastructure providers, AI model providers (for generating website content from your prompts), analytics providers (Google Analytics and, where you have accepted analytics storage, Microsoft Clarity), advertising provider (where you have accepted, Meta Platforms — see section 7), image library (Pexels), and font provider (Google Fonts). Each is bound by a data processing agreement and may only use your data for the specific purpose we have engaged them for. (b) Legal Requirements — we may disclose your data if required by Indian law, court order, or lawful request from a government authority, or where we reasonably believe disclosure is necessary to protect our legal rights, the safety of any person, or to investigate fraud. (c) Business Transfers — if Adviita is acquired, merges with, or transfers assets to another entity, your data may be transferred as part of that transaction. We will notify you via email before your data becomes subject to a materially different privacy policy. (d) With Your Consent — we may share data for any other purpose with your explicit prior consent.

6. Cross-Border Data Transfers

Your data is stored on servers operated by our cloud infrastructure providers, which may be located outside India. AI processing involves servers operated by third-party AI providers in the United States and other countries. Analytics data is processed by Google Analytics, whose servers are located in the United States, and — where you have accepted analytics storage — by Microsoft Clarity, which processes data including outside your country, and by Meta Platforms in the United States. By using the Service and consenting to this Policy, you consent to the transfer of your personal data to these countries. We take reasonable steps to ensure that any data transferred outside India is afforded a level of protection consistent with this Policy and applicable Indian law, including by entering into appropriate data processing agreements with our service providers.

7. Cookies & Local Storage

We divide browser storage into two categories: strictly necessary, and optional. STRICTLY NECESSARY (no consent required, always active): (a) Authentication cookies — to keep you signed in and maintain your session; (b) Browser localStorage — to cache your website drafts and preferences so the Service functions and you do not lose work; (c) A record of your cookie choice — so we do not ask you on every visit. These are essential to providing the Service you have asked for and cannot be switched off. OPTIONAL — ANALYTICS (only active if you accept): (a) Google Analytics 4 — to understand how visitors use adviita.com (page views, session duration, traffic sources, device and browser type). Google Analytics sets its own cookies and sends data to Google's servers in the United States. We have disabled Google Signals and ad personalisation, so this data is not used for advertising. (b) Microsoft Clarity — a product analytics and session replay tool that records how visitors interact with pages, including mouse movement, clicks, scrolling and page navigation, to help us find usability problems. Clarity data is processed by Microsoft, including on servers outside your country. Clarity masks text content by default. We do not load Clarity at all unless you accept analytics storage. (c) Attribution storage — we record, in your browser, which channel or referring site you arrived from and which page you landed on, so we can understand which of our efforts bring people to the Service. This never contains your name, email or any content you enter. OPTIONAL — ADVERTISING (only active if you accept): Meta Pixel — a tracking pixel operated by Meta Platforms (Facebook and Instagram). It sets the _fbp and _fbc cookies in your browser and reports to Meta which pages you viewed and which actions you took on adviita.com, such as starting to build a site or publishing one. We use this to measure whether our Instagram and Facebook advertising works, and to show ads to people who have visited the Service or who resemble our existing users. This is cross-site tracking and it is used for ad targeting. Meta processes this data on servers in the United States and acts as an independent controller for some of it under its own terms. We do not load the pixel at all unless you accept. YOUR CHOICE AND HOW TO CHANGE IT: When you first visit adviita.com you are asked whether to accept optional analytics and advertising storage. A single decision covers both — accepting turns all of it on, declining leaves none of it running. Declining is a single click, has no effect on the Service, and is remembered. If you decline, Microsoft Clarity and the Meta Pixel are never loaded, no attribution data is stored, and Google Analytics operates in a consent-denied mode which does not store identifiers in your browser. You can change your decision at any time via the "Cookie settings" link in the site footer; withdrawing consent stops the pixel and deletes the analytics and advertising cookies and attribution data already stored. You may additionally opt out of Google Analytics across all websites using the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout, and control how Meta uses your data for ads in the "Ad preferences" section of your Facebook or Instagram account settings. We use no advertising or remarketing tracking other than the Meta Pixel described above, and none of it runs unless you accept. You can clear cookies or localStorage through your browser settings at any time; clearing them will sign you out of the Service.

8. Your Published Website & Visitor Data

When visitors interact with websites you have published through Adviita, we collect anonymised analytics data on your behalf (page views, referrer sources, country-level location) to populate your analytics dashboard. In this context, you — the site owner — are the Data Fiduciary for your visitors' personal data, and Adviita acts as your Data Processor. You are responsible for maintaining an appropriate privacy policy on your own published website if you collect any personal data from your visitors (for example, through a contact form). Contact form submissions made by your visitors are stored securely and accessible only to you through your dashboard. We do not use your visitors' data for any purpose other than delivering this Service to you.

9. Data Retention

We retain your account data and website content for as long as your account is active. If you delete your account, we will permanently delete your personal data and site content within 30 days, except where we are required by applicable law to retain certain records (for example, financial transaction records may be retained for up to 7 years under Indian accounting law). Anonymised, aggregated usage data that cannot be linked back to you may be retained indefinitely for product improvement purposes.

10. Data Security

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption of data at rest and in transit (TLS), access controls limited to authorised personnel, regular security reviews, and secure infrastructure. However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security, and you use the Service at your own risk. You are responsible for keeping your account access secure — if you suspect unauthorised access, contact us immediately at support@adviita.com.

11. Data Breach Notification

In the event of a personal data breach that is likely to result in harm to you, we will notify you and, where required, the relevant Indian data protection authority, within the timeframe specified by applicable law. Notification will be sent to the email address on your account and will describe the nature of the breach, the data affected, the likely consequences, and the steps we are taking to address it.

12. Your Rights

Under the Digital Personal Data Protection Act, 2023, you have the following rights regarding your personal data: (a) Right to Access — you may request a summary of the personal data we hold about you and the purposes for which it is processed; (b) Right to Correction — you may request that inaccurate or incomplete data be corrected; (c) Right to Erasure — you may request deletion of your personal data and account where we are no longer required by law to retain it; (d) Right to Withdraw Consent — you may withdraw your consent to processing at any time, which will not affect the lawfulness of processing prior to withdrawal; (e) Right to Grievance Redressal — you may raise a grievance with our Grievance Officer (see Section 14) and expect a response within 48 hours and resolution within 30 days; and (f) Right to Nominate — you may nominate another individual to exercise your data rights in the event of your death or incapacity. To exercise any of these rights, contact us at support@adviita.com or use the relevant options in your account settings.

13. Children's Privacy

The Service is not intended for use by individuals under the age of 18. In accordance with the DPDPA, 2023, we do not knowingly process personal data of children under 18 without verifiable parental consent. If we become aware that a person under 18 has created an account without such consent, we will take steps to delete that data promptly. If you believe a minor is using the Service without appropriate consent, please contact us at support@adviita.com so we can take appropriate action.

14. Grievance Officer

15. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes — such as new categories of data collected or new purposes for processing — we will notify you via email at least 14 days before the changes take effect. For minor clarifications, we will update the "Last updated" date without separate notification. Your continued use of the Service after the effective date of any change constitutes your acceptance of the updated Policy.

16. Contact

For any questions about this Privacy Policy, how we handle your data, or to exercise your rights, contact us at support@adviita.com. For grievances specifically, refer to Section 14.