Legal
Privacy policy
Effective 26 October 2026 · version 2026-10-26
The short version. Your check-in stays on your device unless you choose to save it. If you save it, we keep it to show you your Map and nothing else. We never sell your data, never use what you tell us for advertising, never show it to a partner, and you can export or delete everything at any time.
1. Who we are
ELOVIYA (eloviya.com) is operated by Nexivara, a sole proprietorship run by Karan Bindal, D 102, Green Oak Apartment, Meera Marg, Banipark, Jaipur 302016, Rajasthan, India. We are the controller (GDPR) and Data Fiduciary (India's Digital Personal Data Protection Act, 2023) for the personal data described here.
Privacy questions and requests: hello@eloviya.com. Grievance Officer (DPDP): Karan Bindal, hello@eloviya.com.
2. What we collect, why, and our legal basis
| Data | Why | Legal basis |
|---|---|---|
| Check-in answers kept on your device (closeness, what changed, quick-read answers, the name you give the other circle) | To show your first read and tonight's suggestion | Stored only in your browser at your request. We don't receive it unless you save. |
| Saved check-in answers (closeness, what changed, quick-read answers, whether a safety pause happened). We never store your partner's name. | To keep your Map so it's here next time | Your explicit consent (GDPR art. 6(1)(a) and 9(2)(a), because answers about a relationship may reveal special-category data; DPDP s.6). Withdraw any time by deleting. |
| Email address (optional), and one-time sign-in links and codes (stored only as hashes, valid 15 minutes) | To confirm it's yours, let you open your saved Map on any device, and, only if you opt in, tell you when programs open. An email is attached to a Map only after you confirm it from your inbox. | Consent (GDPR art. 6(1)(a); DPDP s.6) |
| Email address you give us to hear when programs open (early-access list) | To email you when programs open, and occasional updates you agreed to | Consent (GDPR art. 6(1)(a); DPDP s.6). Withdraw any time. |
| Records of your consents (what, when, policy version, a salted hash of your IP) | To prove consent was given and honour withdrawals | Legal obligation (GDPR art. 6(1)(c), 7(1)); DPDP s.6(10) |
| Rights requests (email, request type, your message) | To handle your request | Legal obligation (GDPR art. 6(1)(c)); DPDP s.11–14 |
| Security logs (salted IP hash, request counts) | To prevent abuse and keep the service secure | Legitimate interests (GDPR art. 6(1)(f)); DPDP s.7 (legitimate uses) |
| Anonymous analytics (pages viewed, device type, country, speed), only with cookie consent | To improve the site | Consent (GDPR art. 6(1)(a); ePrivacy art. 5(3)) |
Analytics events never include your answers, names, free text or anything about safety. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (GDPR art. 22). The first read is a simple, explainable summary of your own answers, not a judgment.
3. Who processes it for us
We use a small number of processors, under written data processing agreements:
- Vercel Inc.: hosting and, with consent, privacy-friendly analytics. Our functions run in Singapore.
- Neon (Databricks, Inc.): our Postgres database, hosted in Singapore (AWS ap-southeast-1), encrypted at rest and in transit.
- Zoho Corporation (ZeptoMail and Zoho Mail): sends sign-in and confirmation emails, and hosts our support inbox. Emails never mention relationships or anything from your check-in, and open and click tracking is switched off.
When payments open, Razorpay (India) and Stripe (elsewhere) will process payment details directly; we never see full card numbers. We'll update this list before any new processor receives personal data.
4. International transfers
Data is stored in Singapore. If you are in the EEA, UK or Switzerland, transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) in our processors' agreements, with supplementary measures including encryption. For India, transfers follow the DPDP Act and any restrictions notified under s.16.
5. How long we keep it
- Saved check-ins and email: until you delete them, or 24 months after your last visit, whichever is first.
- Early-access email: until you unsubscribe or ask us to delete it, and no longer than needed once programs open.
- Session cookie: 180 days, or until you sign out or delete.
- Sign-in links and codes: expire after 15 minutes; used or expired ones are kept up to 30 days for security, then deleted.
- Consent records: for as long as the consent applies plus 3 years, to evidence it.
- Rights requests: 3 years after they are resolved.
- Security logs: rolling, up to 30 days.
6. Your rights
You can, free of charge:
- access a copy of your data and receive it in a portable format;
- correct it, or delete it (“right to be forgotten”);
- withdraw consent at any time, as easily as you gave it, without affecting earlier processing;
- restrict or object to processing, including any direct marketing;
- under DPDP, nominate someone to exercise your rights in case of death or incapacity, and seek grievance redressal;
- complain to a supervisory authority: your local EU data protection authority, the UK ICO (ico.org.uk), or the Data Protection Board of India, after first contacting our Grievance Officer.
On the device where you saved your Map, export and delete work instantly at Your data. From anywhere else, use the request form on the same page. We respond within 30 days (GDPR) and within the period prescribed under the DPDP Rules, and may ask you to confirm it's you.
7. Children
ELOVIYA is for adults 18 and over. We don't knowingly process children's data; if we learn we have, we delete it.
8. Security
TLS everywhere, encryption at rest, strict security headers, hashed session tokens, salted IP hashes, rate limits, and least-privilege access. Partner data is separated by design: nothing private is ever exposed to a partner. If a breach is likely to affect you, we'll notify you and the relevant authorities as the law requires (within 72 hours under GDPR, and as prescribed under DPDP).
9. Cookies
See the cookie policy. Optional cookies stay off until you opt in, and you can change your mind any time from “Cookie settings” in the footer.
10. Changes
If we change this policy in a way that matters, we'll say so on the site and, where consent is the basis, ask again. Each consent we hold records the policy version it was given under.