Who we are, and what this is
This is an electronic record under the Information Technology Act, 2000 and the rules made under it. It needs no physical or digital signature.
We are XC392 Private Limited, incorporated in India under the Companies Act, 2013, CIN U62099OD2026PTC053818. For your personal data we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023, and you are the Data Principal. Those are the Act's words for "we decide what is done with it" and "it is about you".
This document is the notice that Act requires: what we collect, why, who else sees it, how long we keep it, and what you can make us do about it. Section 10 is your rights and section 13 is the named person to write to.
What stays on your phone
- Your library lives on Your Phone ONLY. Notes, transcripts, photos, saved pages and the search index are all in the app's private storage on your device.
- The assistant's replies in chat are kept only on your phone.
- Saved links: when you save a page, your phone fetches it. The request comes from your device, not from us.
- Your own iCloud backup is on by default, and you can turn it off in Settings. Once a day your notes, transcripts, chats and photos are copied into your own iCloud Drive, under your Apple ID and Apple's terms. It is your storage: we cannot read it, and turning backup off stops future copies without deleting the ones already there.
What we hold on our servers, and why
This is the complete list. There is nothing else.
| What | Why we hold it | How long |
|---|---|---|
| Your account: email, display name and avatar from Apple or Google | To sign you in and keep your data yours | Until you delete your account |
| One row per note: its length, status, source and timestamps, with no title, no text, no audio | To run the pipeline and know what is still owed to your phone | Until you delete your account |
| Credits, purchases and per-job costs | Billing, and the financial records the law requires | Kept after account deletion where tax law requires |
| Your hashtags and the guidance you write for each | To serve you with memory optimisation | Until you delete your account |
| Messages you send the assistant | To run the chat feature | 7 days, then deleted automatically |
| The thumbs up or down you give a reply (not the actual reply) | To find out what is working | Until you delete your account |
| A feature request or bug report you send us, and any screenshots you attach | So we can read it, answer it and fix the thing | Until you delete your account |
| A deletion request, if you make one | So we can actually delete your account | Kept as the record that we did |
| Your email address, if you leave it on our website to hear about the launch | To send you that one message | Until you ask us to remove it |
Why we are allowed to hold this. You give it to us to get the thing you asked for: a note written up, a question answered, an account that is yours. That is the consent the DPDP Act asks for, given at the moment you use the feature, and you can withdraw it by stopping or by deleting your account. We ask for nothing we do not use, and we use nothing for a purpose we have not told you here.
There is no analytics SDK in Vasini. No usage tracking, no crash reporting, no advertising or attribution library, no third party watching what you do. We checked the app's dependencies: there is nothing of the kind, and when something goes wrong the error is printed to your phone's own console rather than sent to us.
On the hashtags row above: their names, the guidance you write for them and their order are copied up so the feature can run. It travels one way and is never read back into the app, so it is not a backup: a reinstall does not restore your hashtags.
On the chat row: a thread lives on your phone, and what you type is also written down here so the feature can run. That copy is deleted after seven days, by a job that runs daily. Your side of a thread stays on your phone for as long as you keep it, and the assistant's replies were never written down here at all.
On the website. vasini.ai is a set of plain pages. It sets no cookies, shows no advertising and runs no third-party analytics, so simply reading it leaves nothing with us. If you leave your email address there to hear about the launch, we store that address, the date, the country the request came from and the page that sent you, and nothing else. We do not keep your IP address or your browser's user agent alongside it. Write to us at any time and we will remove the address.
What happens when you capture something
A note is written up by AI, and that is the one moment your words leave your phone. Here is the whole journey.
- You talk, type, take a photo or save a page. It is written to your device first.
- If there is audio, it is uploaded to our server in roughly minute-long pieces while you are recording, so a long recording is not sitting in one lump at the end. We hold those pieces in a private bucket only our server can read. Short recordings skip storage entirely: it is transcribed in a single request and never stored at all.
- Our server joins the pieces, processes audio for transcripts through Vasini's models/AI Providers which returns the transcript, and deletes its own copy as soon as it has handed it over. Our contracts with these providers allow them to process this data only to provide their service to us.
- The transcript, any photo descriptions, any saved page text, your topic names and guidance, your display name, and your personal word list (names you have corrected, speaker names you have set) go to Anthropic, which returns the written-up note, its title and its topics. The word list travels so your colleagues' names come back spelled the way you spell them.
- The finished note is put in a mailbox for your phone. The moment your phone confirms it has it, we delete that row outright, and everything you wrote that rode along with the request (the title, your guidance, your word list) is stripped from the job's own record at the same time. If a phone never collects it, we delete it after 7 days.
- The audio on your own phone is deleted once the transcript exists.
Photos are sent once as images, so they can be described for your note and made searchable. They are not stored on our servers. Describing a photo spends credits, the same way transcription does. The one image we do keep is a screenshot you choose to attach to a bug report. That one is the evidence, so it is stored with the report until you delete your account.
Our diagnostic log, and what is in it
We keep a short log of the calls we make to AI providers, so we can tell why something failed. It records the shape of each call: which model, how many tokens, how long it took, what the status was.
Your words are not in it. Before anything is written down, every piece of user content is replaced with a descriptor: its length and a short fingerprint, like [masked 1842ch sha256:3f9a1c02]. That is enough to answer "did the same request go out twice" without keeping a single word. These logs are deleted after 7 days.
One exception, stated plainly: a small number of test accounts, used by us for debugging, keep the full text in that log for the same 7 days. If you are on one of those accounts you will have been told.
Who else touches your data
| Who | What they do | What reaches them | Where |
|---|---|---|---|
| Sarvam AI | Speech to text | Your audio, and the transcript they produce | India |
| Anthropic | Writes up your notes, and answers in chat | Transcripts, note text, photo descriptions, saved page text, your topic names and instructions, your display name, your chat messages | United States |
| Supabase | Our database, sign-in and the temporary audio store | Everything in the table above; audio pieces in transit | Mumbai, India |
| Fly.io | Runs our server | Data passing through, held only in memory | Singapore |
| Apple, Google | Sign-in | Your email and name, per their own terms | Per provider |
| Apple iCloud | Your own backup, when the service is active | Your library, in your account | Per Apple |
| Razorpay | Credit purchases | Payment details, which we never see | India |
We have contracts with each of them to process data only to provide their service to us.
What we never do
- We never sell your data, and we never share it for advertising. There is no advertising in Vasini.
- Nothing you capture is used to train an AI model, ours or anyone else's.
- We never read your iCloud backup. We cannot; it is in your account, not ours.
- We never look at your notes. They are not on our servers to look at.
Permissions the app asks for
Each one is asked for the first time you use the thing that needs it, never up front, and the app works without any of them.
- Microphone: only while you are capturing a note.
- Camera and photo library: only when you tap the camera or photos button, import a recording, or attach a screenshot to a bug report.
- Notifications, two kinds only: that a capture is running or paused, shown as a Live Activity on your lock screen; and that a note is ready, which shows the note's title on the lock screen. Nothing else, and never marketing.
Deleting your account
You can ask us to delete your account from Settings. We record the request and delete everything within 30 days: your account, your topics, your chat messages, your metadata rows. Your library is on your phone, so deleting the app removes that; export it first if you want to keep it.
You can call the request off from the same place any time before it is carried out. Financial records we are legally required to keep are the one exception, and they hold no note content.
Deleting one topic takes it off your phone at once, and blanks its name and your guidance for it on our mirror in the same push. What is left there is a dated row saying a topic once existed, which is what the counting needs and all it needs.
Your rights
Under India's Digital Personal Data Protection Act, 2023 (and we honour these for everyone, wherever you are), you can:
- See what we hold. The table above is the live answer; write to us for your own copy.
- Correct your account details, and delete notes, topics, threads or the whole account from inside the app.
- Take it with you. Export your entire library as a zip from the all-notes screen, in open formats, any time. You do not need our permission and we are not told.
- Withdraw consent by turning off a permission or stopping. What we lawfully did before that stays done.
- Complain, to the Grievance Officer named in section 13.
Write to us and we will answer within 15 days. We may need to check it is really you before we act on a request about someone's data; that check is the only thing we use your identity for here.
Where your data goes, and how it is kept safe
We are based in India. Processing spans India, Singapore and the United States, as the table above sets out, under the transfer rules in section 16 of the DPDP Act.
Everything travels over TLS. Your IP address is read on each request to rate-limit the service, to stop one account flooding it, and is not tied to your notes or kept as a profile of you. Our database uses row-level security, so one account cannot reach another's rows. The audio store is private with no public access and no policies at all: only our server can read it. Credentials between our services are scoped and short-lived, and passwords and keys are stripped from logs on every path. No system is perfectly secure. If personal data is breached we will tell you and the Data Protection Board of India, in the form and time the DPDP Act requires, without waiting to finish investigating first.
Children
Vasini is not for children. Under section 9 of the DPDP Act, anyone under 18 may use it only with a parent or guardian's verifiable consent, and that adult is responsible for the account.
The Act also forbids two things outright for a child's data, and both are easy for us to promise because we do neither for anyone: we do not track or behaviourally monitor, and we do not target advertising, since Vasini shows none.
We do not knowingly process a child's data otherwise. If you believe we have, write to the Grievance Officer and we will delete it.
Changes, and how to reach us
If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect. The current version always lives at vasini.ai/privacy.
Grievance Officer, appointed under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023:
- Name: Kharabela Singh
- Designation: Grievance Officer
- Address: Plot No. 467-1273, Kuanrada, Naguan, Jajpur Road, Jajapur 755019, Orissa, India
- Email: [email protected]
We acknowledge a complaint within 24 hours and resolve it within 15 days. If we do not, you can take it to the Data Protection Board of India at no cost, and that route stays open whatever this document says.
General questions, not complaints: [email protected].
This policy describes Vasini as it is built today, and will be updated as it changes.