Privacy Policy
This policy explains what data Aalap collects, how we use it, and the rights you have over it under the Digital Personal Data Protection Act 2023 of India and other applicable laws.
1. Who we are
Aalap ("we", "us") is an AI-assisted video editing service for Indian creators. We are the Data Fiduciary under the DPDP Act.
2. Data we collect
2.1 You give us
- Account information — email, phone (optional), name.
- Video uploads and voice recordings you submit for processing.
- POV / CTA / hashtag text you write or accept.
- Payment metadata (card last 4, UPI handle, txn id) — full card numbers are handled only by Razorpay and never reach us.
2.2 Collected automatically
- IP address, browser / device user-agent, approximate region.
- Pages viewed, actions taken, render durations.
- Aggregate usage metrics for capacity planning.
3. How we use it
- To deliver the service: process your uploads into finished reels.
- To run AI features: transcription, ideation, captioning — via our sub-processors (see below).
- For billing, fraud-prevention, customer support.
- For aggregate, anonymous analytics to improve the product.
We do not sell your data. We do not train AI models on your content without separate written consent.
4. Sub-processors
| Vendor | Purpose | Region |
|---|---|---|
| DigitalOcean | Hosting (droplet, Spaces) | India (BLR1) |
| ElevenLabs (Scribe) | Speech-to-text | US / EU |
| Anthropic (Claude) | Ideation LLM | US |
| Sarvam AI | Indic STT (optional path) | India |
| Razorpay | Payments processing | India |
| Cloudflare | CDN, DDoS protection | Global edge |
5. Retention
- Raw uploads: deleted automatically after 30 days.
- Intermediate processing files: deleted after 7 days.
- Rendered reels: kept 60 days hot, then archived.
- Account & billing records: kept while account is active + 7 years for statutory tax / accounting requirements.
6. Security
TLS 1.3 everywhere · encrypted at rest · token-bucket rate limiting · principle-of-least-privilege access · audit logs on production systems · regular vulnerability scans.
7. Your rights (DPDP Act 2023)
- Right to access — export your data anytime from your account page.
- Right to correction — edit profile data anytime.
- Right to erasure — delete your account; we purge personal data within 30 days (except where statutory retention applies).
- Right to grievance redressal — contact our grievance officer below.
- Right to nominate — appoint someone to act on your behalf in case of incapacity.
- Right to withdraw consent — at any time, with effect on future processing.
8. Children
We do not knowingly collect data from users under 13. If you believe a child has shared data with us, contact us to delete it.
9. International transfers
Some sub-processors (ElevenLabs, Anthropic) process data outside India. We rely on standard contractual clauses and only share the minimum data needed for that service.
10. Changes
We'll email you about material changes and post updates here.
11. Grievance Officer
Reyaansh Upadhyay
Email: grievance@aalap.app
Response time: within 7 working days
Questions? Email support@aalap.app — we read every message.