Privacy
Policy
This Privacy Policy explains how ArviK Media collects, uses, stores, and protects your personal information. We believe in plain language — so we've written this to be actually readable, not just legally defensible.
Table of Contents
The Short Version
Before you read the full policy, here's what matters most — in plain English:
We never sell your data. Your personal information is never sold, rented, or traded to advertisers, data brokers, or any third party for commercial purposes.
We never store your card details. Payment processing is handled by PCI-DSS certified partners. ArviK only receives a masked transaction reference.
Your data stays in India. All personal data is stored on servers located in India, governed by Indian law.
You can delete everything. You have the right to request permanent deletion of your data at any time. We process deletion within 30 days.
We don't serve children. ArviK is for users aged 18 and above. We do not knowingly collect data from minors.
You control your communications. You can opt out of all marketing emails and SMS at any time from your account settings.
Who We Are
ArviK Media is an Indian technology company that operates the ArviK platform — a hybrid eCommerce marketplace built exclusively for content creators. We provide creators with tools to build their own branded online store, sell digital and physical products, manage shipping, receive payments, and grow their business.
For the purposes of this Privacy Policy, "ArviK", "we", "us", and "our" refer to ArviK Media and its platform, accessible at arvikmedia.com and through the ArviK mobile app (iOS and Android).
"You" or "user" refers to any individual who accesses or uses the ArviK platform — whether as a creator (someone who sells on ArviK), a buyer (someone who purchases from ArviK stores), or a visitor (someone who browses without an account).
ArviK Media is registered in India and is subject to Indian law, including the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and applicable RBI guidelines.
Data We Collect
We collect only what's necessary to operate and improve the platform. Here is a complete and transparent account of everything we collect and how.
| Data Type | When Collected | Why We Need It |
|---|---|---|
| Phone number | Account registration | Primary account identifier; OTP authentication |
| Full name | Profile setup | Displayed on your store; invoicing; support identification |
| Email address | Optional, during setup | Account recovery; transaction receipts; newsletters (opt-in) |
| Profile photo & banner | Store customisation | Displayed publicly on your creator store |
| Store @handle & bio | Store setup | Your public store URL and description |
| Product content | When listing products | Product name, description, images, price, files for sale |
| UPI ID / bank account | Payout setup | Required to settle creator earnings weekly |
| Aadhaar / PAN (masked) | KYC for payouts >₹50K/month | RBI regulatory requirement for financial transactions above threshold |
| Delivery address | At checkout (buyers) | Required for physical product shipping |
| Support messages | When contacting support | Resolving issues; improving support quality |
| Data Type | How Collected | Purpose |
|---|---|---|
| IP address | Every visit/login | Security; fraud detection; geographic analytics |
| Device type & OS | App / browser metadata | App optimisation; bug detection |
| Browser type & version | Browser headers | Platform compatibility |
| Pages visited & click patterns | Analytics cookies / SDKs | Understanding platform usage; improving UX |
| Session duration & timestamps | Server logs | Security monitoring; usage analytics |
| Referral source | UTM parameters / referrer header | Creator analytics (where their buyers came from) |
| App crash reports | Mobile crash SDK | Fixing bugs and improving app stability |
How We Use Your Data
We use your personal data only for the purposes described below. We do not use your data for any purpose you would find unexpected or objectionable.
We share aggregated store analytics (visit counts, conversion rates, traffic sources, revenue charts) with the creator who owns that store. This data is presented to the creator about their own store's performance — buyers are never individually identified to creators.
Legal Basis for Processing
Under the DPDP Act 2023, we process your personal data on the following legal bases:
| Processing Activity | Legal Basis |
|---|---|
| Account creation and platform access | Consent (you agree to our Terms during signup) |
| Processing orders and payments | Contract performance (necessary to fulfil your order) |
| Weekly creator payout settlement | Contract performance (our obligation to pay creators) |
| KYC verification for high-volume payouts | Legal obligation (RBI KYC guidelines) |
| Fraud detection and account security | Legitimate interest (protecting users and the platform) |
| Tax invoicing and financial records | Legal obligation (GST Act, Income Tax Act) |
| Platform analytics and improvement | Legitimate interest (improving the product for all users) |
| Marketing emails and newsletters | Consent (explicit opt-in required) |
| Responding to legal/regulatory requests | Legal obligation |
Where we rely on consent, you may withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.
Data Sharing & Third Parties
We share your data only where necessary and only with parties who are contractually bound to protect it. We never sell your data. Below is every category of third party we share data with:
We share transaction details (amount, buyer/seller identity, order reference) with our payment gateway partners to process payments. These partners (Razorpay, PayU, or similar RBI-licensed processors) are PCI-DSS certified and operate under their own privacy policies. We share only what's required to complete the transaction.
For physical product orders, we share the buyer's delivery name and address, the seller's pickup address, and order reference with our integrated courier partners. This information is used solely for fulfilling the shipment and is not retained by couriers beyond their operational needs.
Our platform is hosted on cloud infrastructure located in India. Our cloud provider(s) have access to server data as part of their hosting role but are contractually prohibited from accessing or using your data for any purpose other than hosting.
We use RBI-registered SMS gateway providers to send OTPs, order confirmations, and shipping updates to your registered phone number. We share only your phone number and the message content required for the notification.
We use privacy-safe analytics tools to understand platform usage. Where possible, data is anonymised or aggregated before being sent to analytics platforms. We do not share personally identifiable information with analytics providers.
Our AI features (product description generation, pricing suggestions) may process your product content through third-party AI APIs. We use data minimisation practices — only the specific content needed for the AI task is sent, and personal identifying information is stripped before transmission.
When KYC is required (for creators earning above ₹50,000/month), we use a regulated identity verification service. Your Aadhaar/PAN details are transmitted to this service over encrypted channels. We receive only a pass/fail verification result.
We may disclose your data to law enforcement agencies, courts, or regulatory bodies when required by a valid court order, legal process, or government mandate. We will notify you of such disclosure wherever legally permitted to do so.
When you purchase from a creator's store, we share your name, delivery address, and order details with the creator whose product you purchased — so they can fulfil your order. We do not share your phone number or email with creators unless you message them directly.
If ArviK Media undergoes a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and before it becomes subject to a materially different privacy policy.
Cookies & Tracking Technologies
We use cookies and similar tracking technologies on our website (arvikmedia.com) and mobile app. Here is a complete breakdown of what we use and why:
| Cookie Type | Purpose | Can You Opt Out? |
|---|---|---|
| Essential / Session Cookies | Keep you logged in; maintain your shopping cart; enable secure checkout and OTP flow | No — required for the platform to function |
| Security Cookies | Detect and prevent fraud, CSRF attacks, and account takeovers | No — required for your security |
| Analytics Cookies | Understand how pages are used, which features are popular, and where errors occur | Yes — via cookie settings or browser opt-out |
| Preference Cookies | Remember your language, currency, and display preferences | Yes — clearing will reset your preferences |
| Affiliate Tracking Cookies | Track which affiliate link brought a buyer to a creator's store — valid for 30 days | Yes — blocking will mean affiliates don't get commission credit |
We do not use third-party advertising cookies or allow ad networks to place tracking pixels on our platform.
To manage your cookie preferences, use your browser's built-in cookie settings or visit our cookie preferences panel at the bottom of the website. For the mobile app, you can manage tracking preferences in App Settings → Privacy.
Data Storage & Security
All personal data is stored on servers physically located in India. We do not transfer personal data outside of India for storage or primary processing. Some AI API calls may route through global infrastructure, but data is anonymised before transmission (see Section 5.6).
In the event of a data breach that poses a risk to your rights, we will notify you within 72 hours of becoming aware of the breach, as required by the DPDP Act 2023. We will notify you via SMS to your registered phone number and email (if provided), and publish a disclosure on arvikmedia.com/security-updates.
Data Retention
We retain your personal data only for as long as necessary for the purpose it was collected, or as required by law.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account profile data (name, phone, email, photo) | Until account deletion + 30 days | Active account operation; grace period for account recovery |
| Product listings and store content | Until account deletion | Active store operation |
| Transaction records and GST invoices | 7 years from transaction date | GST Act and Income Tax Act compliance |
| Payout and settlement records | 7 years from payout date | Financial auditing and RBI compliance |
| KYC documents (Aadhaar / PAN references) | 5 years from last transaction | RBI KYC retention guidelines |
| Fraud and dispute records | 3 years from incident date | Platform integrity and legal protection |
| Login and session logs | 12 months | Security monitoring and incident response |
| Analytics data (anonymised) | 36 months | Platform improvement and trend analysis |
| Support ticket history | 24 months from ticket close | Quality assurance and dispute resolution |
| Marketing consent records | Until consent is withdrawn + 3 years | Proof of consent for regulatory purposes |
After the applicable retention period, data is permanently deleted or irreversibly anonymised from all our systems and backups within 30 days.
Your Rights Under the DPDP Act 2023
As a data principal under India's Digital Personal Data Protection Act 2023, you have the following rights over your personal data. You can exercise these rights at any time by contacting privacy@arvikmedia.com.
| Your Right | What It Means | How to Exercise |
|---|---|---|
| Right to Access | Receive a complete copy of all personal data we hold about you, in a readable format | Email privacy@arvikmedia.com — delivered within 30 days |
| Right to Correction | Request correction of inaccurate, incomplete, or outdated personal data | Most corrections can be made directly in account settings; complex corrections via email |
| Right to Erasure | Request permanent deletion of your personal data (subject to legal retention obligations) | In-app: Settings → Delete Account, or via arvikmedia.com/data-deletion |
| Right to Grievance Redressal | Have your privacy concerns addressed by our Data Protection Officer within a reasonable timeframe | Email dpo@arvikmedia.com — acknowledged within 48 hours |
| Right to Nominate | Nominate another individual to exercise your data rights on your behalf in case of death or incapacity | Submit nomination form to privacy@arvikmedia.com |
| Right to Withdraw Consent | Withdraw consent for marketing communications or non-essential data processing at any time | Account Settings → Privacy → Communication Preferences |
| Right to Data Portability | Receive your data in a portable format (JSON/CSV) to move to another platform | Email privacy@arvikmedia.com — delivered within 30 days |
If you believe your rights have been violated and we have not resolved your concern satisfactorily, you may escalate to the Data Protection Board of India once it is operational under the DPDP Act 2023.
Children's Privacy
ArviK Media is intended for users who are 18 years of age or older. We do not knowingly collect, process, or store personal data from individuals under the age of 18.
Our registration process requires users to confirm they are 18 or above. We do not use age verification technology to enforce this — we rely on user declaration. If we become aware that a user under 18 has created an account, we will delete their account and all associated data within 30 days of discovery.
If you are a parent or guardian and believe your child has registered on ArviK, please contact us immediately at privacy@arvikmedia.com with the subject line "Minor Account" and we will take immediate action.
International Users
ArviK Media is an Indian platform primarily serving creators and buyers in India. If you access our platform from outside India — for example, as a member of the Indian diaspora purchasing from a creator's store — the following applies:
We do not currently operate or direct our services towards users in the European Union. This policy is therefore not drafted to comply with GDPR. EU users who access our platform do so at their own discretion.
Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make changes, we will:
Your continued use of the platform after the effective date of a policy update constitutes your acceptance of the updated policy. If you disagree with the changes, you may close your account before the effective date.
Contact Us & Data Protection Officer
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
| Contact Type | Contact Details | Response Time |
|---|---|---|
| General Privacy Queries | privacy@arvikmedia.com | Within 3 business days |
| Data Deletion Requests | arvikmedia.com/data-deletion or privacy@arvikmedia.com | Within 24 hours (acknowledgement) |
| Data Protection Officer (DPO) | dpo@arvikmedia.com | Within 48 hours |
| Security Vulnerabilities | security@arvikmedia.com | Within 24 hours |
| Minor Account Reports | privacy@arvikmedia.com (Subject: "Minor Account") | Within 24 hours |
Registered Office: ArviK Media, India
For postal correspondence, please email us first at privacy@arvikmedia.com to receive our current registered address.