Privacy Policy

Virabha (“we”, “our”, “us”) is the Data Fiduciary responsible for your personal data processed through the Platform. Our contact details are set out in Section 13.

Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are required to provide you with a clear notice before or at the time of collecting your personal data. The categories below describe what we collect and the purpose for which each category is processed.

We obtain your freely given, specific, informed, and unambiguous consent before processing your personal data for purposes beyond those strictly necessary to perform the service you have requested.

You may withdraw consent at any time by contacting us at the Grievance Officer’s email below. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal, but may mean we can no longer provide certain services to you.

For marketing and promotional communications, you may opt out at any time via the unsubscribe link in any such communication or by updating your notification preferences in your account settings.

We process your personal data only for the purposes notified to you at the time of collection. We will not repurpose your data in a manner incompatible with the original purpose without obtaining fresh consent or establishing another lawful basis.

We share your personal data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• Payment processors (Razorpay, Cashfree) for transaction settlement and fraud checks.
• KYC partners (Cashfree Verification Suite) for identity verification required under Prevention of Money Laundering Act (PMLA).
• Logistics providers for physical delivery of purchased goods.
• Digital metal custodian for opening and maintaining your digital metal account.
• Regulatory and law enforcement bodies when required by applicable law, court order, or government direction.

We do not sell, rent, or trade your personal data to third parties for their independent marketing purposes.

We retain your personal data for as long as your account remains active or as required by applicable law. Key retention periods are:

• KYC and transaction records: 5 years from the date of transaction, as required under PMLA.
• Account data: for the duration of the account plus 3 years after closure.
• Support and grievance records: 3 years from resolution.
• Device and usage logs: 90 days, except where retained for active fraud investigations.

After the applicable retention period, data is securely deleted or anonymised.

As a Data Principal under the DPDP Act, you have the following rights, which you may exercise by contacting our Grievance Officer:

• Right to Access: Obtain a summary of your personal data and the purposes for which it is being processed.
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal obligations to retain certain records.
• Right to Grievance Redressal: Lodge a complaint with our Grievance Officer and, if unresolved, escalate to the Data Protection Board of India.
• Right to Nominate: Nominate a person to exercise your rights in the event of your death or incapacity, through the Nominees feature in your account.

We will respond to rights requests within 30 days unless an extension is permitted by law.

Your personal data is primarily stored and processed in India. Where we engage service providers located outside India, we ensure that appropriate contractual safeguards are in place consistent with the DPDP Act and any cross-border data transfer rules notified by the Central Government.

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Sensitive financial data (bank account numbers, IFSC, PAN, UPI IDs) is encrypted at rest using AES-256. Access to personal data is restricted to authorised personnel on a need-to-know basis.

While we take reasonable precautions, no method of transmission over the internet or electronic storage is completely secure. In the event of a personal data breach affecting your rights and freedoms, we will notify you and the Data Protection Board of India as required by law.

We use cookies and similar technologies to maintain your session, remember your preferences, and analyse Platform usage. You can manage cookie preferences through your browser settings. Disabling certain cookies may affect Platform functionality.

The Platform is not directed at persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact our Grievance Officer immediately.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-Platform notice at least 14 days before the change takes effect. The revised policy will carry an updated effective date.

For any privacy-related concern, to exercise your DPDP rights, or to report a suspected data breach, please contact our Grievance Officer using the details in the sidebar, or file a grievance at the Grievance page. If your concern is not resolved within 30 days, you may escalate to the Data Protection Board of India once it is constituted.