Nityasha
Sign up

Privacy Policy

How Nityasha collects, uses, and protects your information.

Privacy Policy

Last updated: 12 October 2026

Nityasha ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how your information is collected, used, stored, and safeguarded when you use Nityasha's web application, mobile application, APIs, and Model Context Protocol (MCP) integrations (collectively, the "Services"). This Policy is published in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and the rules made thereunder.

By using or accessing the Services, you agree to the practices described in this Policy. This Policy forms part of our Terms of Service.

1. Core Principles

  • No sale of personal data. We do not sell, rent, or trade your personal data.
  • No training on your private content. We do not use your calendar events, task descriptions, personal notes, or reflection entries to train general-purpose AI or large language models. Details are in our AI & Data Usage Policy.
  • Data minimisation. We process only the data needed to provide and secure the Services.
  • Your data stays yours. You can access, correct, or delete your data, and you can delete your account at any time.

2. Information We Collect

A. Information you provide directly

  • Account data: email address, name, authentication credentials, and profile details.
  • Task and schedule data: task titles, deadlines, priorities, notes, and related content you enter.
  • Feedback and communications: messages, support requests, and survey responses you send us.

B. Information collected via third-party integrations

  • Calendar and workspace providers (e.g., Google Calendar, Microsoft Outlook, via OAuth2): with your explicit permission, event times, titles, and availability, used only to detect conflicts and plan your schedule.
  • Connected AI agents and tools (via MCP or API tokens): queries and instructions your connected agents send to read or update your context and schedule, subject to the permissions you grant.

C. Technical and usage data

  • Device and browser type, IP address, anonymised session identifiers, logs, and performance data needed to operate and secure the Services.

D. Payment data

  • Payments are handled by our payment processors (Razorpay and Stripe). We do not store full card numbers or CVV. We receive limited billing metadata (for example, payment status, plan, and last digits) needed to provision your subscription.

3. How We Use Your Information

  1. To provide, maintain, and secure the Services (scheduling, notifications, integrations).
  2. To personalise and improve the product, including AI-assisted features that operate on the data you choose to use with them, under the safeguards in our AI & Data Usage Policy.
  3. To process subscriptions, billing, and refunds.
  4. To send service communications (security alerts, billing notices, policy changes).
  5. To comply with applicable law, prevent fraud, and enforce our Terms.

4. How We Share Your Information

We do not sell your personal information. We share data only with:

  • Infrastructure providers that host our databases and application (for example, Supabase and our application hosting provider), under confidentiality and data-processing obligations.
  • Payment processors (Razorpay, Stripe) to process your transactions.
  • AI model providers that process the limited context needed for AI features, under terms that prohibit use of that data for training their general models; where available, zero-data-retention endpoints are used. If you enable Bring Your Own Key, your data flows directly to the provider you chose, under their terms.
  • Legal authorities, where required by applicable law, court order, or government authority.
  • A successor entity, in the event of a merger, acquisition, restructuring, or sale of assets, subject to this Policy.

We may create anonymised or aggregated data that cannot reasonably identify you and use it for analytics and research without restriction.

5. Security

We use appropriate technical and organisational measures, including encryption in transit (TLS) and encryption of stored credentials and tokens (AES-256), access controls, and tokenised agent authentication. No method of transmission or storage is completely secure; we cannot guarantee absolute security. You are responsible for keeping your credentials confidential. Report suspected unauthorised access immediately at [email protected].

6. Data Retention

  • Account and content data: retained while your account is active, and for a reasonable period thereafter as required by law or to meet legal, billing, or dispute obligations.
  • Deleted content: when you delete content or your account, it is removed from active systems and deleted or anonymised from backups within a reasonable period.
  • Billing records: retained as long as required by tax, accounting, and financial-reporting law.
  • Security logs: retained for a limited period needed for security and abuse prevention.

7. Children

The Services are not intended for individuals under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us personal data, contact [email protected] and we will delete it promptly upon verification.

8. Your Rights Under the DPDP Act, 2023

As a Data Principal, subject to applicable law, you have the right to:

  • Access a summary of the personal data we process about you and of our processing activities.
  • Correction and erasure of inaccurate or unnecessary personal data.
  • Withdraw consent where processing is based on consent (note: some processing is necessary to deliver the Services you have requested).
  • Grievance redressal by contacting us and escalating, if needed, to the Grievance Officer and the Data Protection Board of India as established under the DPDP Act.
  • Nominate another individual to exercise your rights in the event of your death or incapacity.

We will not discriminate against you for exercising these rights.

To exercise any right, email [email protected] with enough information to verify your identity. We aim to respond within 30 days; for complex requests we may extend this by up to 30 further days with notice.

You may also delete your account directly from Settings. Upon deletion, your data is handled in accordance with Section 6 and our legal retention obligations.

Where you are located outside India, you may have additional rights (for example, under the GDPR or CCPA). We will honour such requests to the extent required by applicable law.

9. Changes to This Policy

We may update this Policy from time to time. For material changes, we will notify you through the Services or by email before the change takes effect. Continued use after the effective date constitutes acceptance.

10. Contact