Who is responsible
This policy explains how Vaayam handles personal data when you visit our website, use our free tools, create an account, connect a data source, or use Vaayam's AI marketing intelligence service (the Service).
The India-based Vaayam operator identified in your order, invoice, or account correspondence decides why and how this personal data is used. It is the controller under the EU and UK General Data Protection Regulation (GDPR) and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act).
- Privacy contact and grievances: support@vaayam.com
If an organisation gave you your Vaayam access (for example, a domain shared with you), that organisation decides who can see the domain's data.
What we collect
Account
Your email, a password (stored only as a hash by our authentication provider), sign-in times, your plan and subscription status, your privacy choices, and the messages you send us. Payments are handled by Razorpay; we receive billing identifiers and status, never card numbers.
Workspace data
The domains, competitors, keywords, countries, languages, prompts and settings you give us, and what Vaayam produces from them: search-result snapshots, rankings, traffic measurements, AI-assistant answers and mentions, backlink and technical audits, recommendations, a content calendar, drafts and your Assistant chats.
Google Search Console (only if you connect it)
Your connected Google email, the property you choose, read-only search performance (queries, pages, clicks, impressions, position) and an encrypted authorisation token. Vaayam cannot change your site.
Free tools, devices and usage
For Brand Check and CiteRadar: the domain, brand and results, and your email only if you ask for the report by email. From your browser: IP address, browser and device details, and, only if you accept analytics cookies, the pages and features you use. Product analytics never receives your email address.
Where it comes from
From you and your organisation; your browser; services you connect, such as Google Search Console; search, AI and marketing data providers; our payment and authentication providers; and public web and search results. Some measurements and insights are inferred from these sources rather than given by you.
Why we use it, and on what basis
We use personal data only for these purposes, each with a basis in law:
| Purpose | Data | GDPR basis | DPDP basis |
|---|---|---|---|
| Your account, domains, scans, reports and support | Email, password (hashed by our auth provider), domains, keywords, competitors, settings | Contract (Art. 6(1)(b)) | Consent given at signup for these purposes (s. 6) |
| AI analysis, the Assistant and content drafts | Domains, keywords, prompts, your questions, brand brief | Contract (Art. 6(1)(b)) | Consent given at signup (s. 6) |
| Reading Google Search Console | Google email, read-only token, search performance | Consent (Art. 6(1)(a)); withdraw by disconnecting | Consent (s. 6); withdraw by disconnecting |
| Account, security and billing emails | Email address | Contract (Art. 6(1)(b)) | Consent given at signup (s. 6) |
| The Vaayam Pulse newsletter | Email address | Consent (Art. 6(1)(a)); unsubscribe any time | Consent (s. 6); unsubscribe any time |
| Product analytics (PostHog) | Pseudonymous id, email domain, pages, clicks | Consent (Art. 6(1)(a) and ePrivacy); cookie banner | Consent (s. 6); cookie banner |
| Security, abuse prevention and logs | IP address (kept hashed where possible), device, events | Legitimate interests in a secure service (Art. 6(1)(f)) | Security safeguards the Act requires (s. 8(5)) |
| Payments, invoices and tax records | Plan, subscription status, Razorpay ids | Contract; legal obligation (Art. 6(1)(b), (c)) | Compliance with law (s. 7) |
| Free tools (Brand Check, CiteRadar) | Domain, brand, results; your email only if you ask for the report | Legitimate interests; consent for follow-up emails | Consent (s. 6) |
Where we rely on consent you can withdraw it as easily as you gave it: in Settings › Privacy, through Cookie settings in the footer, by disconnecting Search Console, or with the unsubscribe link. Withdrawal does not affect what was done before.
AI and search providers
Vaayam sends limited inputs, such as prompts, keywords, domains, public web content, your Assistant questions and brand brief, to AI and search-data providers so they can return results or analysis. We show a short notice wherever this happens. We use these providers' business APIs, not their consumer apps.
Do not put confidential personal data, credentials or secrets into keywords, prompts or other free text. Vaayam makes no decisions about you based solely on automated processing that have legal or similarly significant effects; AI outputs are suggestions for you to review.
How long we keep it
We keep data only as long as needed for the purpose it was collected for. A weekly job deletes data when its period ends.
Account
| Data | Kept for | Why |
|---|---|---|
| Account email, password (hashed by our auth provider), plan and billing status | Until the account or domain is deleted | Needed to provide the account; deleted with it. |
| Consent records for an account | Until the account or domain is deleted | Proof of consent; deleted with the account. |
| Consent records for people without an account (hashed email) | 3 years | Proof of consent for three years. |
| Privacy requests and their outcome | 3 years | Evidence that rights requests were handled. |
| Privacy requests from the public form never confirmed by email | 2 days | Nobody confirmed them; the link expires after 48 hours. |
| Record that an account was deleted (hashed email only) | 3 years | Evidence that a deletion was carried out. |
Workspace data
| Data | Kept for | Why |
|---|---|---|
| Domains, competitors, keywords, Search Console data, reports and actions | Until the account or domain is deleted | Needed to provide the service; deleted with the domain or account. |
| Search-result snapshots | 120 days | Rank history views read 120 days. |
| Daily Search Console rows per query and page | 120 days | Charts show 90 days, with a month of margin. |
| Full text of AI assistant answers | 30 days | Shown only for recent runs; the mention results are kept. |
| Activity log of background jobs | 30 days | A recent-history view. |
| Skipped calendar entries | 12 months | So a skipped keyword is not planned again within a year. |
| Content allowance ledger | About 13 months | Current-month limits plus a year for support. |
Assistant and content
| Data | Kept for | Why |
|---|---|---|
| Assistant chats | 12 months | Deleted 12 months after the last message, or earlier when you delete them. |
| Brand brief, article settings and drafts | Until the account or domain is deleted | Your content; deleted with the domain or account. |
Communications
| Data | Kept for | Why |
|---|---|---|
| Newsletter send log | 12 months | Delivery troubleshooting. |
| Email delivery events (bounces, complaints) | 12 months | Delivery troubleshooting and suppression. |
| Feature requests and feedback | 2 years | Product planning for two years. |
| Domain-sharing invites (invitee email) | 90 days | Kept 90 days after they expire, are accepted or revoked. |
Free tools
| Data | Kept for | Why |
|---|---|---|
| CiteRadar results | 90 days | Back the public share pages. |
| Brand Check reports and the email they were sent to | 120 days | Reports expire after 90 days. |
| SERP simulator searches | 30 days | Short-term abuse prevention. |
Security and operations
| Data | Kept for | Why |
|---|---|---|
| Processed payment webhooks (no payment details) | 90 days | Duplicate protection. |
| Signup verification codes (hashed email, IP and browser) | 2 days | Abuse prevention. |
Deleting your account in Settings › Privacy deletes everything after 7 days (sign in before then to undo). Free accounts nobody has signed in to for 24 months are deleted after a 30-day email warning. Encrypted backups roll over within 30 days. Razorpay keeps invoices for as long as Indian tax law requires.
Security and international transfers
We protect data with access controls, per-account database rules, private storage, encryption in transit and of stored Google tokens, hashing of identifiers we do not need in plain form, and logging. No system is perfectly secure; if a breach affects you we will tell you and the authorities as the law requires.
Vaayam is operated from India, and some providers process data in the USA or EU (see the table above). For transfers out of the EU or UK we rely on the European Commission's standard contractual clauses (and the UK addendum). We follow any transfer restrictions the Government of India notifies under the DPDP Act.
Your rights
Whichever law applies to you, you can ask us to:
- see the personal data we hold and how we use it, and who we share it with;
- correct, complete or update it;
- delete it;
- restrict its use (pause processing of a domain) or object to a use, such as analytics;
- receive it in a portable, machine-readable format;
- withdraw consent at any time;
- nominate someone to use your rights if you die or cannot act (DPDP Act); and
- complain to us, and then to a regulator.
How
Most rights are self-serve in Settings › Privacy: download your data, change your email, turn analytics off, pause a domain, add a nominee, file a request, or delete your account. Without an account, or if you cannot sign in, use the privacy request form or email support@vaayam.com. We answer within 30 days and may ask you to confirm your identity first. Requests are free unless they are clearly unfounded or excessive.
Complaints
Write to us first at support@vaayam.com; we will try to resolve it within 30 days. If you are not satisfied you can complain to the Data Protection Board of India; in the EU, to the data protection authority where you live or work; or in the UK, to the Information Commissioner's Office (ico.org.uk). When making a request you must not impersonate anyone or give false information.
Children
Vaayam is a business service for people aged 18 or older; everyone confirms this at signup. We do not knowingly process data of anyone under 18. If you believe a child has given us personal data, email support@vaayam.com and we will delete it.
Changes and contact
We will post changes here and update the date above (notice version 2026-10-16). For a material change we will also tell signed-in users and, where the law requires, ask again for consent.
Contact: The India-based Vaayam operator identified in your order, invoice, or account correspondence. Privacy and grievances: support@vaayam.com. Please do not send passwords or payment details.
Use of the Service is also governed by our Terms of Use.