Privacy Policy

Sarvak is operated by Sarvak, a company registered in India. Sarvak sends transactional notifications — OTPs, webinar invitations, event links, and business communications — to opted-in subscribers. Every sending domain must have SPF, DKIM, and DMARC records configured before any email can be sent. For privacy-related queries, contact us at privacy@sarvak.in.

• Account data: Name, email address, company name, password (hashed, never stored in plain text).
• Contact lists: Email addresses, names, and custom fields you upload. All contacts must have explicitly opted in before any email is sent.
• Send data: Email subject, body, send time, and templates you create.
• Usage data: Open rates, click rates, bounce rates, delivery status per contact.
• Technical data: IP address, browser type, access timestamps (for security and rate limiting).

• Delivering your transactional notifications through AWS SES.
• Tracking opens, clicks, bounces, and unsubscribes on your behalf.
• Enforcing suppression lists to prevent emailing opted-out contacts.
• Rate limiting and abuse prevention.
• Generating aggregate analytics and AI-powered insights for your account.
• Sending account notifications (password resets, admin messages).

We do not sell your data or your contact lists to any third party.

We use the following sub-processors to operate the platform:

• Amazon Web Services (SES) — email delivery. Data processed in the AWS region configured for your account.
• Supabase — database and authentication. Data stored in your configured Supabase project.
• Upstash (Redis & QStash) — rate limiting and message queuing.
• Vercel — hosting and serverless functions.
• DeepSeek AI — AI-generated email template suggestions and subject line insights. Only prompt text is sent — no contact data, email addresses, or campaign content is transmitted to this service.

When you use Sarvak to send emails to your subscribers, you are responsible as the sender for the lawfulness of that communication. You must ensure:

• You have obtained explicit consent from each contact to receive emails from your organisation.
• Contacts have not previously opted out or unsubscribed.
• You comply with applicable laws including GDPR, CAN-SPAM, and DPDP Act (India).

Contact data is stored securely and used only to deliver the emails you send. It is never shared, sold, or accessed for any other purpose.

• Send data and logs: retained for 12 months, then auto-deleted.
• Contact lists: retained until you delete them or close your account.
• Account data: retained until account deletion.
• Suppression list: retained indefinitely to honour unsubscribe requests.

We implement the following security measures:

• All data transmitted over HTTPS/TLS.
• Passwords hashed using bcrypt via Supabase Auth.
• API endpoints protected by JWT authentication and per-IP rate limiting.
• Unsubscribe and tracking URLs signed with HMAC-SHA256 to prevent forgery.
• SES webhook signatures verified before processing.
• SVG uploads blocked to prevent XSS via image injection.

You have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate data via your account settings.
• Erasure — request deletion of your account and all associated data.
• Portability — export your contact lists and send data.
• Objection — object to processing where we rely on legitimate interest.

To exercise any right, email privacy@sarvak.in. We respond within 30 days.

We use only essential cookies for authentication (session tokens stored in localStorage/cookies via Supabase Auth). We do not use third-party tracking or advertising cookies.

We may update this policy. Material changes will be notified by email to registered account holders at least 14 days before taking effect. Continued use after that date constitutes acceptance.

Questions or requests: privacy@sarvak.in
Sarvak
Hyderabad, Telangana, India