Legal
Privacy Policy
How Vicaratva collects, uses, shares and protects personal data when you run an audit or hold an account.
Last updated · Vicaratva, operated by Merlinvicki Creative Services Pvt. Ltd.
1. Who we are
Merlinvicki Creative Services Pvt. Ltd. (“Vicaratva”, “we”, “us” or “our”) operates Vicaratva and is the data fiduciary and controller responsible for the personal data described in this policy. In this policy, “personal data” means information that relates to an identified or identifiable individual.
Merlinvicki Creative Services Pvt. Ltd.
C-17/1, New Raipur Road, near Kendua More
Kolkata 700084, West Bengal, India
This policy applies to the Vicaratva website and audit tools. It does not apply to third-party websites you scan or link to from a report.
2. Personal data we collect
When you run a scan without an account
- The URL you submit, the final URL after redirects, and the audit results generated from it.
- Your IP address. We collect the IP address that submitted the scan, hash it with SHA-256, and store only the hash. We use it for rate limiting and, if you later claim the report, to confirm the scan came from your connection. The raw IP address is not written to our database.
When you hold an account
- Your email address, and your name if you provide one or your sign-in provider supplies it.
- Authentication data: a hashed password, or an account identifier from GitHub or Google if you sign in with one.
- Two-factor authentication secrets and recovery codes, if you enable two-factor authentication. These are stored encrypted.
- Your saved reports and scan history.
- Subscription and plan status. Card and payment details are collected and processed by Razorpay and do not reach our servers.
Collected automatically
- Standard server logs (request time, path, response status, user-agent, hashed IP), kept for security and troubleshooting.
- A first-party session cookie that keeps you signed in, and — only if you consent — the Google Analytics cookies described in section 6. We do not use advertising cookies.
Data inside the pages you scan
A report is generated from the content of the page at the URL you submit. If that page contains personal data in its markup, that data is included in the collected signals and, for user-experience, conversion and privacy audits, in the page content sent to our language-model provider. Do not scan authenticated pages, or pages containing sensitive personal data, that you would not want processed this way.
3. Why we use it, and our legal basis
We process personal data for the purposes below. Where the General Data Protection Regulation or a similar law applies, the corresponding legal basis is shown; under the Indian Digital Personal Data Protection Act, 2023 we rely on your consent or on a legitimate use permitted by that Act.
| Purpose | Legal basis |
|---|---|
| Running a scan you request and returning the report | Performance of a contract, or steps taken at your request before a contract |
| Creating and securing your account, including two-factor authentication | Performance of a contract |
| Taking payment and managing subscriptions | Performance of a contract; compliance with tax and accounting law |
| Rate limiting, abuse prevention, and protecting the service and scanned hosts | Our legitimate interest in operating a secure service |
| Measuring how the site is used, with Google Analytics | Your consent, which you can withdraw at any time |
| Service email such as sign-in links, password resets and report delivery | Performance of a contract |
| Responding to legal requests and enforcing our terms | Compliance with a legal obligation; our legitimate interest in enforcing our rights |
We do not use personal data for advertising, and we do not sell personal data. We do not make decisions producing legal or similarly significant effects about you by solely automated means; language models generate parts of a report, but a report is informational only and is not a decision about any individual.
4. Who we share it with
We share personal data with service providers who process it on our behalf and under contract. The current list, what each receives and where it operates, is on the Data Processing page. In summary:
- Anthropic receives the stripped text content of a scanned page for user-experience, conversion and privacy audits, to generate the written findings.
- Google receives the public URL you scan, for PageSpeed Insights performance metrics; an account identifier and email if you sign in with Google; and, if you consent to analytics, your IP address, a cookie identifier and site-usage events through Google Analytics.
- Cloudflare operates the Turnstile bot check on our scan and sign-in forms and receives your IP address, user-agent and a challenge token.
- Resend delivers our service email and receives the recipient address and message content.
- Razorpay processes payments and receives the billing details you give it directly.
- The website you scan receives a request from our scanner and will see it in its own server logs.
We also disclose personal data where we have a good-faith belief that doing so is reasonably necessary to comply with a law, regulation, legal process or enforceable government request; to enforce our Terms of Service, including investigating suspected violations, fraud or security incidents; or to protect the rights, property or safety of our users, Vicaratva or the public. If we are involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, subject to this policy.
5. What we do not do
- We do not sell or rent personal data.
- We do not run advertising on this site, and we do not use tracking for advertising or profiling. Google Analytics runs only with your consent and only to measure site usage (see section 6).
- We do not store raw IP addresses ourselves; an IP address is sent to Google Analytics only if you consent, and is handled under Google’s terms.
- We do not use your scan content or reports to train our own or any third party’s models.
6. Cookies and similar technologies
Strictly necessary. A first-party cookie that keeps you signed in and protects against cross-site request forgery, and the Cloudflare Turnstile cookie set when the bot check runs. These are required for the site to function, carry no consent choice, and blocking the sign-in cookie will prevent you from logging in.
Analytics (optional, off by default). With your consent we load Google Analytics, which sets the _ga cookies and sends site-usage data, including your IP address and a cookie identifier, to Google LLC in the United States. We use it only to understand which pages are used and how people move through the site; we do not use it for advertising. Nothing is loaded and no analytics cookie is set until you choose “Accept” on the cookie banner. You can withdraw consent at any time from the “Cookie preferences” link in the site footer; when you do, we delete the _ga cookies and stop loading Google Analytics. See the Data Processing page for Google’s role and region, and section 7 for how we handle transfers outside your country.
7. International transfers
Some of our service providers operate outside India and outside the European Economic Area, so personal data may be transferred to and processed in other countries, including the United States. Where we transfer personal data internationally we rely on the transfer mechanisms available under applicable law, including standard contractual clauses and equivalent contractual safeguards in our agreements with those providers. Transfers of data covered by the Digital Personal Data Protection Act, 2023 are made only to countries not restricted by the Central Government.
8. How long we keep it
- Anonymous reports are deleted automatically 30 days after they are created. Claiming a report links it to your account and removes that expiry.
- Account reports and history are kept until you delete them or close your account.
- Account records are kept for the life of the account and then deleted or anonymised within 90 days, unless a longer period is required by law or needed to resolve a dispute.
- Billing and tax records are retained for the period required by Indian tax and companies law.
- Rate-limit records are held in memory only and cleared when the service restarts. Server logs are kept for a short period for security and then deleted or aggregated.
9. How we protect it
We maintain technical and organisational measures appropriate to the risk, including: transport encryption for all traffic; passwords stored as salted hashes and two-factor secrets stored encrypted; IP addresses stored only as SHA-256 hashes; access to production data limited to personnel who need it; and a server-side guard that blocks scanner requests to private, loopback and internal network ranges. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
If a personal data breach occurs that is likely to result in risk to affected individuals, we will notify the Data Protection Board of India, and any other authority and the affected individuals, without undue delay and within the timeframes required by applicable law.
10. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or completed, to have it erased, to obtain a copy in a portable form, to restrict or object to certain processing, and to withdraw any consent you have given (which does not affect processing already carried out). You also have the right to nominate another person to exercise these rights in the event of your death or incapacity, and the right to complain to a supervisory authority, including the Data Protection Board of India.
You can delete individual reports and deactivate your account from within the app. For any other request, email hello@vicaratva.com. We will respond within the period required by applicable law, and in any event without undue delay. We may ask you to verify your identity before we act.
11. Deleting your data and closing your account
A single report
Delete any report from your history or from the report page itself. Deleting a report removes the audit results and the hashed IP address stored with it. Anonymous reports you never claim are deleted automatically 30 days after creation.
Your account
Deactivating your account from Account → Security signs you out everywhere and blocks further sign-in. Deactivation is reversible on request and does not, by itself, erase stored data.
Full erasure
To have your account and every report linked to it permanently deleted, email hello@vicaratva.com from your account address. We will complete verified erasure requests within 30 days. Billing and tax records we are legally required to keep are the exception and are retained only for the period the law requires.
12. Children
The Services are intended for use by adults and are not directed to children. We do not knowingly collect personal data from a child. If you believe a child has provided us personal data, contact us and we will delete it.
13. Your responsibilities
You must keep your account information accurate. You must only scan websites you own or are authorised to test, and you must not submit through the Services personal data that you are not entitled to disclose to us and our processors. If you use the Services to scan a site on which you capture personal data belonging to your own users, you are the controller of that data and we act as your processor; the terms of that arrangement are set out on the Data Processing page.
14. Grievance and Data Protection contact
If you have a question or complaint about how we handle personal data, contact our Grievance Officer:
Grievance Officer, Merlinvicki Creative Services Pvt. Ltd.
Email: hello@vicaratva.com
Postal: C-17/1, New Raipur Road, near Kendua More, Kolkata 700084, West Bengal, India
We will acknowledge your complaint within a reasonable period and aim to resolve it within the timeframe required by the Digital Personal Data Protection Act, 2023 and the Information Technology Rules.
15. Changes to this policy
We may update this policy from time to time. The date at the top of this page shows the current version. If a change is material we will notify account holders by email, or by a notice on the Services, before it takes effect. We encourage you to review this page periodically.
Questions about this document? Email hello@vicaratva.com.