Privacy Policy

Who we are

VayuApps (“we”, “us”) is a software development studio based in Toronto, Ontario, Canada, operated by Rohit Verma. We are the controller of the personal information described on this page. Reach us any time at rohit@vayuapps.com.

Information you give us

• Enquiry and project forms — the contact form, the /mvp form and the /nocode migration form. We receive your name, email address and whatever you tell us about the project, including any budget or timeline you pick. Stored in our database and emailed to us so we can reply.
• Lead forms inside ads — if you reply to one of our ads on X (Twitter) or LinkedIn, the form is hosted by that platform, not by us. You give it your name, work email, company name and what you need; we download those submissions and reply by email. The platform holds its own copy under its own privacy policy, and its terms govern what it does with it.
• Live chat — your name, email address and the messages you send, kept so the conversation can carry on if you come back.
• Video calls — if you start a call from the chat widget, we store the connection details needed to set the call up. The audio and video themselves travel directly between the two browsers and are not recorded or stored by us.
• Call bookings — handled by Cal.com on its own booking page under the Cal.com privacy policy. We receive the name, email and time slot you choose.
• The app builder — if you describe an idea on /build, that description is sent to Anthropic’s Claude API to generate a prototype, and the idea and the generated result are stored so you can come back to them.
• Client contract portal — for existing clients: the email address used for one-time-code sign-in, your comments on a document, and your electronic signature on agreements, together with a log of when each was viewed and signed.

Information collected automatically

• Analytics — we use UserSesh to understand how the site is used: pages viewed, buttons clicked, approximate location from your IP address, and browser type. We do not sell this data.
• Advertising measurement — the site loads the Meta (Facebook) pixel, the X (Twitter) Ads pixel and the OpenAI (ChatGPT Ads) pixel so we can tell which ads led to an enquiry. Each vendor may set its own cookies and receives your IP address and the page URL.
• Server-side conversion reporting — when you submit a form after arriving from an ad, we report that conversion to OpenAI Ads and LinkedIn using a SHA-256 hash of your email address (never the address itself), your IP address and browser user-agent, and the ad click identifier from the landing URL.
• A/B testing — we sometimes show different versions of a page and record which version you saw and whether you submitted the form, so we can tell which one works better.
• Server logs and rate limiting — request metadata including IP address, kept briefly to keep the site up and stop abuse of our forms.

Cookies and local storage

• vayu_mvp_layout — a first-party cookie lasting 30 days that remembers which version of the /mvp page you were shown, so it looks the same each visit while we test layouts.
• vayu_oppref — session storage, cleared when you close the tab, holding the ad click identifier used to attribute a conversion.
• Sign-in cookies for the admin area and the client contract portal, set only if you sign in.
• Third-party cookies set by the analytics and advertising vendors above. Block them with your browser settings or an ad blocker if you prefer — the site works fine without them.

How we use this information

To reply to your enquiry and scope a project; to deliver and support work you have hired us for; to measure which ads and pages actually bring enquiries; to keep the site secure; and to meet legal and accounting obligations. We do not sell personal information, and we do not use it to make automated decisions that have legal effects.

Who we share it with

Only the service providers needed to run the business: Vercel (hosting), Supabase (database), Resend (transactional email), Cal.com (scheduling), UserSesh (analytics), Anthropic (AI generation in the app builder, which receives only the text you submit), and Meta, X, OpenAI and LinkedIn (advertising measurement). We may also disclose information where the law requires it. We have never sold personal information and have no plans to.

Where your information goes

We are based in Canada and several of the providers above are in the United States, so your information may be stored or processed outside your own country, including outside the EU and UK. Where that applies we rely on the providers’ standard contractual clauses and equivalent safeguards.

How long we keep it

Enquiries and chat transcripts are kept while we are in contact about a possible project and for up to two years afterwards. Client contracts and signatures are kept for the life of the engagement plus the period Canadian tax and contract law requires, typically seven years. Analytics and advertising data are retained according to each vendor’s own policy. Ask us to delete your data at any time and we will, unless we are legally required to keep it.

Your rights

Under Canada’s PIPEDA — and under the GDPR or UK GDPR if you are in the EU or the UK — you can ask what personal information we hold about you, ask us to correct or delete it, object to or restrict how we use it, ask for a copy in a portable format, and withdraw consent for marketing at any time. If you are in California, you have similar rights under the CCPA, including the right not to be discriminated against for exercising them.

Email rohit@vayuapps.com and we will respond within 30 days. You can also complain to the Office of the Privacy Commissioner of Canada, or to your local data-protection authority — the ICO if you are in the UK.

Security

All traffic is served over HTTPS. Form endpoints are rate-limited and validated, and access to stored data is limited to the founder and protected by credentials and database row-level security. No method of transmission is perfectly secure, but we take reasonable steps to protect what you share.

Children

This site is for businesses and adults. We do not knowingly collect information from anyone under 16. If you believe we have, email us and we will delete it.

Changes to this policy

We will post any changes here and update the date at the top. If a change materially affects how we use information we have already collected, we will email the people concerned.

Contact

Questions, corrections, or a deletion request: rohit@vayuapps.com. VayuApps, Toronto, Ontario, Canada.