Legal

Privacy Policy

Virorah Private Limited · Last updated: 12 September 2026 · Effective: 12 September 2026

Contents

1. Who We Are — Data Fiduciary 2. What We Collect 3. How We Use Your Data 4. Anonymisation Before AI Processing 5. Legal Basis for Processing — DPDP Act 2023 6. Data Storage and International Transfer 7. Third-Party Processors 8. Data Retention 9. Your Rights Under DPDP Act 2023 10. Security 11. Cookies and Local Storage 12. Children's Data 13. Changes to This Policy 14. Grievance Officer and Contact

1. Who We Are — Data Fiduciary

Virorah Private Limited ("Virorah", "we", "us") is the Data Fiduciary for the Virorah Vantage platform under the Digital Personal Data Protection Act 2023 (DPDP Act). This means we determine the purposes and means of processing your personal data.

You, as the user of the Platform, are the Data Principal under the DPDP Act.

Our registered office is in Gurugram, Haryana, India. Contact: info@virorah.com

2. What We Collect

We collect only what is necessary to provide and improve the Platform. Here is a complete breakdown:

Data Category	Specific Data	How Collected	Why
Identity & Access	Email address, name, and authentication method (email/password or Google OAuth), via Clerk. A unique account identifier is used internally to link your records across the Platform.	Provided by you at sign-up, managed by Clerk, Inc.	To authenticate you, secure your account, and associate your records with it
MERIDIAN Profile	State/region, industry, organisation type, organisation size, HR seniority level, union status, HR function, policy guardrail settings	Provided by you during onboarding	To calibrate AI outputs to your professional reality
Case Data	Case narratives as you type them, case type, PACT assessment results, status, retrospective notes	Provided by you when using the ER Case Navigator	To build your Case Library and generate your monthly Debrief
Debrief Data	AI-generated monthly debrief content, case statistics	Generated by the Platform based on your case data	To deliver your monthly professional reflection
Usage Data	Session data stored in browser sessionStorage (access status, MERIDIAN data for current session)	Auto-generated during use	To maintain your session without requiring repeated login
Payment Data	Subscription tier and payment status. Payments are designed to be processed by Razorpay; Virorah does not store card details. This Policy will be updated to confirm live payment processing once fully deployed.	Via Razorpay, once payment processing is live	To manage your subscription

What we do NOT collect: Your employer's name, or the names of colleagues or employees you mention in your case narratives — the Platform does not require or prompt for these, though nothing currently prevents you from typing them yourself (see Section 4). We do collect your own name and email address, via Clerk, as part of account authentication — this is required to sign in and cannot be avoided while using the Platform.

3. How We Use Your Data

We use your data exclusively for the following purposes:

Service Delivery: To provide calibrated AI assessments, frameworks, and intelligence outputs based on your MERIDIAN profile and inputs
Case Library: To store and display your case records for your professional reference
Monthly Debrief: To generate your monthly professional reflection from your case data
Platform Improvement: We do not currently run aggregated usage analytics. If we introduce this in future, it will be limited to anonymised, aggregated patterns — never individual case content — and this Policy will be updated first.
Subscription Management: To manage your subscription, process payments (via Razorpay), and communicate about your account
Legal Compliance: To comply with applicable Indian law, including the DPDP Act 2023 and the IT Act 2000

We do not use your data for advertising. We do not sell your data to any third party. We do not use your individual case narratives or outputs to train AI models.

4. Anonymisation Before AI Processing

Before any text you write is sent to our AI processing layer (Anthropic's Claude API), the Platform automatically identifies person names, company names, and specific locations, and replaces them with role-consistent placeholders — for example, "Manager A" and "Employee B" rather than real names, inferred from context so the underlying diagnostic still makes sense. This applies across every AI-powered tool on the Platform: the ER Case Navigator, HR Data Storyteller, Stakeholder Influence, Policy Compass, Conversation Simulator, and ARIA.

      What happens if anonymisation cannot be completed
      This step fails closed: if the anonymisation process cannot produce a safe result after a brief automatic retry, the Platform blocks that request entirely rather than sending your original text unredacted. You will see an error asking you to try again, not a silent fallback.
    

For ARIA and the Conversation Simulator specifically — both ongoing conversations rather than single submissions — the Platform anonymises each new message as it is sent. Earlier turns in the same conversation are not re-processed on every new message, since they were already anonymised when originally sent.

Separately: your original text, exactly as you typed it, is stored in your own Airtable record and is not shared with any third party beyond what is described in Section 7. Only the anonymised version is sent to Anthropic.

5. Legal Basis for Processing — DPDP Act 2023

Under the Digital Personal Data Protection Act 2023, Virorah processes your personal data on the following legal bases:

Consent (Section 6, DPDP Act 2023): By creating a MERIDIAN profile and using the Platform, you provide free, specific, informed, and unambiguous consent to the processing of your personal data as described in this Policy. You may withdraw consent at any time by deleting your account and data from the Platform.
Legitimate Use for Contract Performance: Processing necessary to deliver the Platform services you have subscribed to.
Legal Obligation: Processing necessary to comply with applicable Indian law.

You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal. To withdraw consent, use the "Delete All My Data" function in the Data & Privacy section of the Platform.

6. Data Storage and International Transfer

Your data is stored using the following infrastructure:

Airtable (US servers): Your MERIDIAN profile, case records, and debrief data are stored in Airtable, a cloud database service. Airtable's servers are located in the United States (AWS us-east-1). By using the Platform, you explicitly consent to this cross-border transfer of your personal data to the United States.
Browser Storage: Your session data (access status, current-session MERIDIAN profile) is stored in your browser's sessionStorage and localStorage. This data never leaves your device except as described above.
Anthropic (US servers): Anonymised text — with person names, company names, and locations replaced with role-consistent placeholders as described in Section 4 — is processed by Anthropic's Claude API, with servers in the United States. Under Anthropic's API terms, this data is not used to train their models.

Virorah takes reasonable contractual and technical measures to ensure that cross-border transfers are made only to jurisdictions or entities that provide an adequate level of data protection. However, you should be aware that data protection laws in the United States differ from those in India.

7. Third-Party Processors

Virorah shares your data only with the following third-party processors, solely for the purposes described:

Processor	Data Shared	Purpose	Location
Anthropic, Inc.	Anonymised text (person names, company names, and locations replaced with role-consistent placeholders — see Section 4), MERIDIAN parameters (state, industry, org type)	AI processing and output generation	United States
Airtable, Inc.	Account identifier, MERIDIAN profile, case records, debrief records	Data storage and retrieval	United States
Razorpay Software Pvt. Ltd.	Payment details, once payment processing is fully live. Card information is processed directly by Razorpay; Virorah receives only payment status.	Payment processing	India
Clerk, Inc.	Email address, name, authentication method (email/password or Google OAuth). Clerk manages your sign-in session and account security. No case or MERIDIAN data is shared with Clerk.	Authentication and identity management	United States
Resend, Inc.	Email address, monthly debrief content. Used solely to deliver your Monthly Debrief notification to your inbox.	Transactional email delivery	United States

We do not share your data with any other third party, including advertisers, data brokers, analytics companies, or marketing platforms.

8. Data Retention

We retain your data for as long as your account is active. Specifically:

MERIDIAN Profile: Retained until you delete it or delete your account
Case Records: Retained until you delete individual cases or delete your account
Debrief Records: Retained until you delete your account
Post-deletion: After you delete your account or all data, records are permanently deleted from Airtable within 30 days. Browser localStorage and sessionStorage data is deleted immediately upon your request or when you clear your browser data.
Legal Hold: Where Virorah is required by law to retain certain data, it will be retained for the legally required period and then deleted.

9. Your Rights Under DPDP Act 2023

As a Data Principal under the DPDP Act 2023, you have the following rights:

Right to Access

View all personal data held about you. Available in the Data & Privacy section of the Platform.

Right to Correction

Correct inaccurate or incomplete personal data. Update your MERIDIAN profile at any time via onboarding.html.

Right to Erasure

Delete all your data permanently. Use "Delete All My Data" in Data & Privacy. Deletion is permanent and irreversible.

Right to Portability

Export all your data in JSON format. Use "Export All My Data" in Data & Privacy at any time.

Right to Withdraw Consent

Withdraw your consent to data processing at any time by deleting your data. Withdrawal does not affect prior processing.

Right to Grievance Redressal

Raise a grievance with our Grievance Officer at info@virorah.com. We will respond within 48 hours.

To exercise any of these rights, visit the Data & Privacy section of the Platform or contact us at info@virorah.com.

10. Security

Virorah implements the following technical and organisational security measures:

All data in transit is encrypted using HTTPS/TLS
Access to Airtable data is restricted via API key authentication
Text is anonymised — person names, company names, and specific locations replaced with role-consistent placeholders — before it reaches Anthropic's Claude API, across every AI-powered tool on the Platform (Section 4)
This step fails closed: if anonymisation cannot be completed safely, the request is blocked rather than sent unredacted
Browser sessionStorage is cleared on sign-out

No system is completely secure. In the event of a data breach that poses a risk to your rights, Virorah will notify affected users as required by the DPDP Act 2023 and report to the Data Protection Board of India within the prescribed timeframe.

11. Cookies and Local Storage

The Platform does not use advertising cookies, tracking cookies, or third-party analytics cookies. The Platform uses:

Browser sessionStorage: To maintain your session (access status, current MERIDIAN profile). Cleared when you close your browser or sign out.
Browser localStorage and Clerk session storage: Clerk, our authentication provider, manages sign-in session data in your browser to keep you logged in. This is managed by Clerk directly, not by Virorah's own servers.

The Platform does not use Google Analytics, Meta Pixel, or any other third-party tracking technology.

12. Children's Data

The Platform is intended for use by adults (18 years and above) in a professional capacity. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided data to the Platform, please contact us at info@virorah.com and we will delete it immediately.

13. Changes to This Policy

Virorah may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Where changes are material, we will notify you via the Platform with at least fifteen (15) days' notice before the changes take effect.

The date of the most recent revision is indicated at the top of this Policy. Continued use of the Platform after the effective date of a revised Policy constitutes your acceptance of the revised terms.

14. Grievance Officer and Contact

In accordance with the Information Technology Act 2000 and the DPDP Act 2023, the details of the Grievance Officer are as follows:

Name: Kumar Vivek
Designation: Founder & Grievance Officer, Virorah Private Limited
Address: Gurugram, Haryana, India
Email: info@virorah.com
Response time: Within 48 hours of receipt of grievance

If you are not satisfied with our response, you have the right to approach the Data Protection Board of India once it is constituted and operational under the DPDP Act 2023.