Privacy Policy

Last updated: 1 May 2026 · Effective date: 1 May 2026

1. Who We Are

Divya Maarg ("we", "us", "our", "the Platform") is operated by TATVAM AI LABS PRIVATE LIMITED, with its registered office in Bengaluru, Karnataka, India. We are a digital platform offering Vedic astrology services, dharmic life navigation tools, sacred puja bookings, and Vedic products. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website, mobile applications, and related services (collectively, the "Services").

This policy is published in compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the rules thereunder, and Cashfree's data handling requirements.

2. Information We Collect

We collect the following categories of personal data:

2.1 Information you provide directly:

• Name, phone number, email address (during signup and OTP verification)
• Date of birth, time of birth, place of birth (for kundli generation)
• Gender (for personalised astrological readings)
• Profession, family member details (optional, for context)
• Gotra, Sankalpa text, special intentions (for puja bookings)
• Shipping address (for product delivery)

2.2 Information collected automatically:

• IP address, device type, browser version, operating system
• Pages visited, time spent, click-through patterns (analytics)
• Referral source, language preference

2.3 Information from third parties:

• Payment status from Cashfree Payments (we do not store card details)
• SMS delivery status from MSG91
• Geocoded latitude/longitude from Nominatim (OpenStreetMap)

3. Why We Collect Your Data (Lawful Basis)

Under the DPDP Act, we process your data only for these specific, legitimate purposes:

• Service delivery: Generate kundli reports, deliver paid reports, fulfil puja bookings, ship products
• Payment processing: Verify Cashfree transactions, prevent fraud, issue receipts
• Communication: Send OTPs, booking confirmations, report-ready notifications, dharmic reminders
• Legal compliance: Income tax, GST, anti-money-laundering laws, RBI guidelines
• Service improvement: Anonymous analytics to improve the platform

We do not process your data for any purpose beyond what we have stated above without obtaining fresh consent.

4. How We Share Your Data

We do not sell your personal data. We share it only with:

• Payment processors (Cashfree Payments) — for transaction processing only
• SMS / Email vendors (MSG91, Resend, 360dialog) — to deliver communications you've opted into
• Temple partners — only your name, gotra, and sankalpa for the specific puja you booked
• AI service providers (OpenAI) — chart data is sent for narrative generation; OpenAI does not retain or train on this data per their API policy
• Cloud infrastructure (Render, Cloudflare R2) — for hosting and media storage
• Law enforcement — only when legally compelled by an Indian court order or government authority

5. Data Retention

• Account data: Retained while your account is active. Deleted within 90 days of account closure request.
• Kundli charts: Retained indefinitely as long as your account is active (you can delete individual kundlis anytime).
• Payment records: Retained for 8 years per Indian tax law.
• OTPs: Auto-deleted after 10 minutes (used) or 24 hours (unused).
• Analytics logs: Anonymized after 90 days.

6. Your Rights Under DPDP Act

You have the following rights in relation to your personal data:

• Right to access: Request a copy of all data we hold about you
• Right to correction: Update incorrect or incomplete data
• Right to erasure: Request deletion of your account and associated data
• Right to grievance redressal: Lodge complaints about how we handle your data
• Right to nominate: Designate someone to exercise your rights in your absence
• Right to withdraw consent: At any time, for any specific processing activity

To exercise any of these rights, email our Grievance Officer at team@taatvam.com. We will respond within 30 days as required by law.

7. Data Security

We implement industry-standard safeguards including:

• HTTPS/TLS encryption for all data in transit
• Encrypted database storage with role-based access control
• JWT-based authentication with httpOnly cookies
• HMAC signature verification for payment webhooks
• Regular security audits and penetration testing
• Audit logs of every administrative action

However, no system is 100% secure. We will notify affected users and the Data Protection Board within 72 hours of detecting any breach involving personal data, as required by the DPDP Act.

8. Cookies and Tracking

We use minimal cookies, all essential for service operation:

• auth_token — JWT for keeping you logged in (httpOnly, expires in 7 days)
• NEXT_LOCALE — language preference (en/kn/hi)
• We do not use third-party advertising or tracking cookies

9. Children's Privacy

Divya Maarg is intended for users 18 years and older. We do not knowingly collect data from children under 18 without verifiable parental consent, as required under the DPDP Act. If you believe we have collected data from a minor without consent, contact us immediately at team@taatvam.com.

10. International Data Transfers

Most of our data infrastructure is based in India (Render Singapore for low-latency, AWS Mumbai for backups). Some third-party services (e.g., OpenAI) process data outside India. We ensure adequate data protection safeguards are in place for such transfers, in compliance with the DPDP Act's cross-border transfer requirements.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be notified via email and prominent notice on the homepage at least 14 days before they take effect. Continued use of the Services after the effective date constitutes acceptance of the updated policy.

For readers in India

India's Digital Personal Data Protection Act, 2023 governs your data, and the rights set out in section 6 above are yours under that Act: to know what we hold, to have it corrected or completed, to have it erased, to nominate someone to exercise your rights, and to a grievance redressal process. Your consent to notifications and marketing is separate from your account and can be withdrawn at any time in the app, as easily as it was given.

If our Grievance Officer does not resolve your complaint to your satisfaction, you may approach the Data Protection Board of India.

For readers in the European Union / EEA

Where you are located in the EU or EEA, we process your personal data as a controller under the EU General Data Protection Regulation (GDPR), in addition to the protections described above.

Our legal bases (Article 6)

• Contract — creating your birth chart, delivering a reading you bought, fulfilling a puja booking or product order, and running your membership.
• Consent — daily guidance and cosmic alert notifications, marketing messages, and any optional personalisation. You may withdraw consent at any time in the app without affecting anything already done.
• Legitimate interests — keeping the service secure, preventing fraud and abuse, and improving the product; balanced against your rights, and never used for the categories below.
• Legal obligation — retaining financial records for tax and accounting.

Special category data (Article 9)

Your birth date, time and place are ordinary personal data, not special category data. However, two parts of our service can involve information that is special category: what you freely type into Ask My Kundli or into a question for Guruji (people sometimes mention health, relationships or beliefs), and the fact that you book a puja, which may reveal religious practice. Where that happens we rely on your explicit consent under Article 9(2)(a), given by choosing to send that message or make that booking. You are never required to disclose such details to use the app, and you can delete this content at any time.

Your rights (Articles 15-22)

• Access a copy of your data, and receive it in a portable, machine-readable format
• Correct inaccurate data, or complete data that is incomplete
• Erasure ("right to be forgotten"), subject to our legal retention duties
• Restrict or object to processing, including profiling based on legitimate interests
• Withdraw consent at any time
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects

Automated processing

Your chart is computed by an astronomical calculation engine and parts of the wording are generated with AI language models. This is content, not decision-making: nothing in Divya Maarg makes an automated decision that has a legal or similarly significant effect on you. Guidance given in Guruji's name is written by a human being.

International transfers

We are based in India. Your data is therefore transferred outside the EEA, and some processors (for example our AI provider and our cloud storage provider) may process it in other countries. Such transfers are made under the applicable safeguards permitted by EU law, including standard contractual clauses with our processors. You may ask us for details of the safeguards in place.

Complaints

We would like the chance to put things right first — please write to our Grievance Officer below. You also have the right to lodge a complaint with the data protection supervisory authority of the EU member state where you live, work, or where the issue arose.

For readers in the United Kingdom

Where you are located in the United Kingdom, we process your personal data as a controller under the UK GDPR and the Data Protection Act 2018, in addition to the protections described above.

Our legal bases (Article 6)

• Contract — creating your birth chart, delivering a reading you bought, fulfilling a puja booking or product order, and running your membership.
• Consent — daily guidance and cosmic alert notifications, marketing messages, and any optional personalisation. You may withdraw consent at any time in the app without affecting anything already done.
• Legitimate interests — keeping the service secure, preventing fraud and abuse, and improving the product; balanced against your rights, and never used for the categories below.
• Legal obligation — retaining financial records for tax and accounting.

Special category data (Article 9)

Your birth date, time and place are ordinary personal data, not special category data. However, two parts of our service can involve information that is special category: what you freely type into Ask My Kundli or into a question for Guruji (people sometimes mention health, relationships or beliefs), and the fact that you book a puja, which may reveal religious practice. Where that happens we rely on your explicit consent under Article 9(2)(a), given by choosing to send that message or make that booking. You are never required to disclose such details to use the app, and you can delete this content at any time.

Your rights (Articles 15-22)

• Access a copy of your data, and receive it in a portable, machine-readable format
• Correct inaccurate data, or complete data that is incomplete
• Erasure ("right to be forgotten"), subject to our legal retention duties
• Restrict or object to processing, including profiling based on legitimate interests
• Withdraw consent at any time
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects

Automated processing

Your chart is computed by an astronomical calculation engine and parts of the wording are generated with AI language models. This is content, not decision-making: nothing in Divya Maarg makes an automated decision that has a legal or similarly significant effect on you. Guidance given in Guruji's name is written by a human being.

International transfers

We are based in India. Your data is therefore transferred outside the UK, and some processors (for example our AI provider and our cloud storage provider) may process it in other countries. Such transfers are made under the applicable safeguards permitted by UK law, including standard contractual clauses with our processors. You may ask us for details of the safeguards in place.

Complaints

We would like the chance to put things right first — please write to our Grievance Officer below. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

For readers in the United States (California and similar state laws)

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you the rights below. We extend the same treatment to residents of other US states with comparable privacy laws.

Notice at collection

We collect these categories of personal information, for the purposes described earlier in this policy:

• Identifiers — name, phone number, email address, account identifiers
• Commercial information — readings, packs, memberships, pujas and products you purchase
• Internet activity — how you use the app and site, device and diagnostic information
• Geolocation (coarse) — your birth place as you enter it, and your general region for showing the right legal terms and time zone
• Inferences — the astrological interpretation drawn from your birth details
• Sensitive personal information — only if you volunteer it in a chat message or a question for Guruji, or reveal religious practice by booking a puja

We do not sell or share your personal information

Divya Maarg does not sell your personal information, and does not share it for cross-context behavioural advertising, as those terms are defined by the CCPA. We have not done so in the preceding twelve months. Because we do not sell or share, there is nothing to opt out of — but the request page below is open to you regardless.

Sensitive personal information is not used for inference

We use sensitive personal information only to provide the service you asked for — answering your question, or arranging your puja. We do not use or disclose it to infer characteristics about you, so the "limit the use of my sensitive personal information" right has no additional effect here. You may still delete that content at any time.

Your rights

• Know — what we collect, why, and who receives it
• Access — a copy of the specific pieces of information we hold
• Delete — subject to exceptions such as completing a transaction and complying with law
• Correct — inaccurate personal information
• Non-discrimination — exercising any of these rights never changes your price or service

We respond to verifiable requests within 45 days, extendable once by a further 45 days where reasonably necessary, and will tell you if we need the extension. We verify a request by matching it to the account it comes from; an authorised agent may act for you with written permission.

Grievance Officer

🪷 Rooted in the Mahavatar Babaji Parampara · Built with respect for your sacred journey