Privacy Policy

Last updated: 1 May 2026 · Effective date: 1 May 2026

1. Who We Are

Divya Maarg ("we", "us", "our", "the Platform") is operated by Tatvam, with its registered office in Bengaluru, Karnataka, India. We are a digital platform offering Vedic astrology services, dharmic life navigation tools, sacred puja bookings, and Vedic products. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website, mobile applications, and related services (collectively, the "Services").

This policy is published in compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the rules thereunder, and Razorpay's data handling requirements.

2. Information We Collect

We collect the following categories of personal data:

2.1 Information you provide directly:

• Name, phone number, email address (during signup and OTP verification)
• Date of birth, time of birth, place of birth (for kundli generation)
• Gender (for personalised astrological readings)
• Profession, family member details (optional, for context)
• Gotra, Sankalpa text, special intentions (for puja bookings)
• Shipping address (for product delivery)

2.2 Information collected automatically:

• IP address, device type, browser version, operating system
• Pages visited, time spent, click-through patterns (analytics)
• Referral source, language preference

2.3 Information from third parties:

• Payment status from Razorpay (we do not store card details)
• SMS delivery status from MSG91
• Geocoded latitude/longitude from Nominatim (OpenStreetMap)

3. Why We Collect Your Data (Lawful Basis)

Under the DPDP Act, we process your data only for these specific, legitimate purposes:

• Service delivery: Generate kundli reports, deliver paid reports, fulfil puja bookings, ship products
• Payment processing: Verify Razorpay transactions, prevent fraud, issue receipts
• Communication: Send OTPs, booking confirmations, report-ready notifications, dharmic reminders
• Legal compliance: Income tax, GST, anti-money-laundering laws, RBI guidelines
• Service improvement: Anonymous analytics to improve the platform

We do not process your data for any purpose beyond what we have stated above without obtaining fresh consent.

4. How We Share Your Data

We do not sell your personal data. We share it only with:

• Payment processors (Razorpay) — for transaction processing only
• SMS / Email vendors (MSG91, Resend, 360dialog) — to deliver communications you've opted into
• Temple partners — only your name, gotra, and sankalpa for the specific puja you booked
• AI service providers (OpenAI) — chart data is sent for narrative generation; OpenAI does not retain or train on this data per their API policy
• Cloud infrastructure (Render, Cloudflare R2) — for hosting and media storage
• Law enforcement — only when legally compelled by an Indian court order or government authority

5. Data Retention

• Account data: Retained while your account is active. Deleted within 90 days of account closure request.
• Kundli charts: Retained indefinitely as long as your account is active (you can delete individual kundlis anytime).
• Payment records: Retained for 8 years per Indian tax law.
• OTPs: Auto-deleted after 10 minutes (used) or 24 hours (unused).
• Analytics logs: Anonymized after 90 days.

6. Your Rights Under DPDP Act

You have the following rights in relation to your personal data:

• Right to access: Request a copy of all data we hold about you
• Right to correction: Update incorrect or incomplete data
• Right to erasure: Request deletion of your account and associated data
• Right to grievance redressal: Lodge complaints about how we handle your data
• Right to nominate: Designate someone to exercise your rights in your absence
• Right to withdraw consent: At any time, for any specific processing activity

To exercise any of these rights, email our Grievance Officer at privacy@divyamaarg.com. We will respond within 30 days as required by law.

7. Data Security

We implement industry-standard safeguards including:

• HTTPS/TLS encryption for all data in transit
• Encrypted database storage with role-based access control
• JWT-based authentication with httpOnly cookies
• HMAC signature verification for payment webhooks
• Regular security audits and penetration testing
• Audit logs of every administrative action

However, no system is 100% secure. We will notify affected users and the Data Protection Board within 72 hours of detecting any breach involving personal data, as required by the DPDP Act.

8. Cookies and Tracking

We use minimal cookies, all essential for service operation:

• auth_token — JWT for keeping you logged in (httpOnly, expires in 7 days)
• NEXT_LOCALE — language preference (en/kn/hi)
• We do not use third-party advertising or tracking cookies

9. Children's Privacy

Divya Maarg is intended for users 18 years and older. We do not knowingly collect data from children under 18 without verifiable parental consent, as required under the DPDP Act. If you believe we have collected data from a minor without consent, contact us immediately at privacy@divyamaarg.com.

10. International Data Transfers

Most of our data infrastructure is based in India (Render Singapore for low-latency, AWS Mumbai for backups). Some third-party services (e.g., OpenAI) process data outside India. We ensure adequate data protection safeguards are in place for such transfers, in compliance with the DPDP Act's cross-border transfer requirements.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be notified via email and prominent notice on the homepage at least 14 days before they take effect. Continued use of the Services after the effective date constitutes acceptance of the updated policy.

12. Grievance Officer

🪷 Rooted in the Mahavatar Babaji Parampara · Built with respect for your sacred journey