Privacy & Data Protection Notice

Vara (vara.ajmalaksar.com) is a voice-driven whiteboard operated by Ajmal Aksar (the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023 — “DPDP Act”). Contact for anything in this notice: support@vara.ajmalaksar.com.

We collect only what the service needs to work:

• Account data — your name, email address, and sign-in identifiers, handled by our authentication provider Clerk. Used to create and secure your account.
• Your content — the boards you draw, the transcripts of speech or text you submit, and the session journals Vara builds from them. Stored (as one workspace per account) in our database provider Convex so your work follows you across devices. Used solely to provide the whiteboard to you.
• Usage counters — a monthly count of AI turns, used to enforce your plan’s fair-use limits.
• Technical logs — standard server logs (IP address, timestamps, errors) kept briefly for security and debugging.

We do not sell personal data, show ads, or use your content to train AI models.

By creating an account you consent to the processing described here, for the purpose of providing Vara to you. You can withdraw consent at any time by deleting your account (below); withdrawal does not affect processing done before it.

Vara is intended for users aged 18 and above.

• Clerk — authentication and account management.
• Convex — database and file storage for your workspace.
• OpenAI (and, for video imports, Google Gemini) — the speech and text you submit is sent to these AI providers to generate your board. It is processed to serve your request, not to train their models under our API terms.
• Vercel — application hosting.

These providers store data on servers outside India (primarily the United States). By using Vara you consent to this cross-border transfer, which the DPDP Act permits for countries not restricted by the Central Government.

Your account data and content are kept until you delete them. Deleting your account permanently erases your boards, journals, usage counters, and Clerk account. Technical logs are retained for a short operational window and then discarded.

Under the DPDP Act you can:

• Access — ask for a summary of the personal data we hold about you.
• Correct — fix inaccurate account data (name and email can be changed from your account menu).
• Erase — delete your account and all data yourself from the account page, or by writing to us.
• Nominate — designate someone to exercise these rights for you if you are unable to.
• Grievance redressal — complain to us, and escalate to the Data Protection Board of India if we do not resolve it.

Grievance officer: Ajmal Aksar, support@vara.ajmalaksar.com. We acknowledge grievances within 7 days and aim to resolve them within 30 days. If you are unsatisfied with our response, you may approach the Data Protection Board of India.

In the event of a personal data breach, we will notify the Data Protection Board of India and every affected user as required by the DPDP Act and its rules — without undue delay, and in any case within 72 hours of becoming aware of the breach.

If this notice changes materially, we will show the updated version here with a new effective date and flag the change in the app.