The short version: we collect the minimum data needed to run our services, never sell it, and delete it on your request.
Who we are
This Privacy Policy applies to thevikalp.com and the services operated by The Vikalp ("we", "us"), including:
- Refine - AI photo sharing and personal cloud storage
- The Vikalp Form - form builder and data collection service
- This website and its contact form
The Vikalp operates from Churi, Banethi, Kotputli-Behror, Rajasthan 303105, India. Contact: [email protected].
What we collect
- Account data: email address and name when you register for a service.
- Content you upload: photos, files, and form submissions you store or process through our services. You keep ownership of your content.
- Face data (Refine only): when face search is used, we compute numerical face embeddings from uploaded photos. Embeddings are mathematical vectors, not images, and are used solely to match faces within your own albums. They are deleted when you delete the related photos or your account, or on request.
- Contact form data: name, email, subject, message. Protected by Cloudflare Turnstile to prevent spam.
- Server logs: IP address, request timestamp, user agent - kept briefly for security and abuse prevention.
What we do not do
- We do not sell personal data.
- We do not use your photos or files to train machine learning models.
- We do not run third-party advertising trackers on this site.
Third-party processors
We rely on a small set of providers to operate:
- Cloud infrastructure and databases (hosting provider, managed PostgreSQL)
- Cloudflare (captcha/Turnstile protection)
- Email delivery for transactional email
Each processes data only on our instructions.
Legal basis and consent (India)
We process personal data under the Digital Personal Data Protection Act, 2023 (DPDP Act), based on your consent given at sign-up or form submission. You may withdraw consent at any time, which may end the relevant service.
Your rights
You can request at any time:
- Access to the personal data we hold about you
- Correction of inaccurate data
- Erasure of your data (including face embeddings)
- Withdrawal of consent
Send requests to [email protected]. We respond within 30 days.
Retention
- Account and content data: kept while your account is active; deleted within 30 days of account deletion.
- Server logs: rolling 30-day retention unless needed for an ongoing security incident.
- Form submissions: kept until the form owner deletes them.
Children
Our services are not directed at children under 18, and we do not knowingly collect their personal data. If you believe a child's data reached us, contact us and we will delete it.
Security
Data is transmitted over TLS, passwords are hashed, access tokens are stored hashed, and uploads are validated before processing. No system is perfect; if a breach affects you, we will notify you as required by law.
Grievance officer
Per the DPDP Act, our grievance officer is Deepak Kumar Yadav, reachable at [email protected] with the subject "Grievance". We acknowledge grievances within 72 hours and aim to resolve them within 30 days.
Changes
We update this policy as services change. Material changes are announced on this page with a new "Last updated" date.