Privacy policy

1. Who we are and what this covers

Dhvni AI (“Dhvni”, “we”, “us”) runs the website at dhvni.in and the Dhvni speech APIs. This policy explains how we handle personal data under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the rules made under them.

We play two different roles, and this policy says which applies where:

• For your account and this website, we decide why and how your data is used, so we are the Data Fiduciary.
• For text, audio and voices you send through the API, we process them on your behalf and only to provide the service to you, so we act as your Data Processor. You decide what is sent and remain responsible for having a lawful basis, including consent, for the people whose data it is.

2. What we collect

Account and contact details. Your name, work email, company and what you are building, from the access form or when we set up your account. For invoices, your billing address and GSTIN.

API usage. For every request: a request ID, the time, your account, and usage counts such as characters spoken and seconds of audio transcribed. We store API keys only as a secure hash, so we cannot read them back.

Technical logs. IP addresses, request metadata and error logs, used to run, secure and debug the service.

Customer content. Text you send for speech, audio you send for transcription, and the results we return.

Voice data. For each cloned voice: the reference recordings you provide, the trained voice, the consent recording or signed release, and the results of our consent checks (whether the code words were heard and how closely the speaker matched the reference). A voice recording can identify a person, so we treat this data with particular care.

On this website we do not use advertising cookies or third party trackers.

3. How we use it

• To provide the API: turning text into speech, audio into text, and serving your voices.
• To create a cloned voice, and to verify that the person it belongs to has agreed.
• To meter usage, bill you and issue GST invoices.
• To keep the service secure, prevent fraud and misuse, and investigate abuse reports.
• To reply to you and support your account.
• To meet our obligations under Indian law.

We process account data with your consent or for the legitimate uses the DPDP Act allows, such as providing a service you asked for and meeting legal duties.

We do not sell personal data. We use your recordings only to build your own voices. We do not use customer content, recordings or voices to train models for anyone else.

4. How long we keep it

• Audio sent for transcription is processed to return your text and is not stored by us afterwards.
• Text sent for speech is not stored. We keep only the usage counts described above.
• Reference recordings and trained voices are kept until you delete the voice or close your account, and then deleted.
• Consent records are kept for three years after a voice is deleted, so we can show who agreed to its creation and when.
• Security logs are kept for 180 days, as directions from CERT-In under the IT Act require.
• Account, usage and billing records are kept for as long as Indian tax and company law requires, currently up to eight years.

5. Who we share it with

We share data only with service providers that help us run Dhvni, under contracts that limit their use of it to the work they do for us:

We update this list before a new provider starts processing customer data, and tell customers by email. We also share data when Indian law or a valid order from a court or government authority requires it, or as part of a merger or sale of our business, in which case this policy continues to apply.

6. Transfers outside India

Some providers process data outside India, as the table above shows. We transfer data only to countries the Government of India has not restricted under the DPDP Act, and only under contracts that require it to be protected.

7. How we protect it

We use encryption in transit (TLS), store API keys only as hashes, limit access to customer data to the people who need it to run the service, and delete reference recordings when a voice is deleted. If a personal data breach happens, we will inform the Data Protection Board of India and the people affected, as the DPDP Act requires.

8. Your rights

Under the DPDP Act you can:

• Ask for a summary of the personal data we hold about you and how we use it.
• Ask us to correct, complete, update or erase it.
• Withdraw consent you gave us, as easily as you gave it.
• Nominate someone to use these rights for you if you die or become unable to.
• Raise a grievance with us, and then with the Data Protection Board of India.

Write to support@dhvni.in to use any of these. We reply within 30 days. If your voice was cloned by one of our customers and you want it removed, write to us as well: we will disable the voice and tell the customer.

9. Children

Dhvni is a service for businesses and is not meant for anyone under 18. We do not knowingly collect children's personal data for our own purposes. If you are a customer whose product serves children, for example students, you are responsible for getting verifiable consent from a parent or lawful guardian before sending a child's voice or data to the API, as Section 9 of the DPDP Act requires.

10. Changes to this policy

When we change this policy we will post the new version here with a new effective date. For changes that matter, we will also email account holders before they take effect.

11. Contact and grievance officer

For questions, requests or complaints about your personal data, write to our Grievance Officer at support@dhvni.in. We acknowledge every grievance and resolve it within 30 days.