How Vault Encryption Works
Descriptions and uploaded files reach the authenticated API before AES-256-GCM encryption on the server. The current service uses a server-managed master key to protect content encryption keys. Virasat has technical access to decrypt vault content. Basic metadata, including titles and categories, is stored separately and is not encrypted by this vault-content mechanism.
1. Who We Are & Data Fiduciary Details
Virasat Technologies Inc. ("Virasat", "we", "us", or "our") provides vault record organization, server-encrypted content storage and check-in tools. Verified family handover is planned and disabled in the current service. The service is being developed through our mobile applications (iOS and Android) and website.
For the purposes of the Digital Personal Data Protection Act, 2023 (DPDP Act, India), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and applicable global privacy statutes, Virasat acts as a Data Fiduciary regarding basic account metadata and as a secure encrypted custodian regarding vault ciphertext.
2. Categories of Information We Process
A. Account & Contact Information (Plaintext Metadata)
When you register on our website or mobile app, we collect your full name, email address, country of residence, mobile operating system preference (iOS / Android), and communication language where provided. This data is used for account verification, check-in recording and relevant account or waitlist notices.
B. Vault Items & Personal Media
Vault records can include financial references, document descriptions, personal messages and supported media files. Descriptions and files are encrypted on the server before storage. Account and item metadata are stored in the database; Virasat operates the keys needed to decrypt vault content.
C. Trusted Family Contacts (Nominees)
You may supply the name, mobile phone number, relationship and email address of intended trusted people. Obtain their permission before saving their details. Saving them does not send an invitation, verify their identity or grant vault access; these workflows are currently unavailable.
D. Operational Heartbeat & Telemetry Data
We log heartbeat check-in confirmation timestamps, app crash reports, and device identifiers (device model, OS version). We maintain zero third-party advertising SDKs and never engage in cross-app behavioral tracking.
3. Legal Grounds for Processing (DPDP Act & SPDI)
We use the information you provide to operate account verification, vault organization, check-in recording and waitlist updates. Planned handover capabilities are not an active processing workflow in the current service.
A saved trusted person is an organizational record. It does not itself activate data-rights nomination, financial inheritance or a release of vault content. Contact us about data access requests; verified recipient workflows are still being developed.
4. Check-Ins & Planned Family Handover
The current service records check-in activity. It does not determine whether a user is alive or healthy and does not provide an emergency response service:
- Check-Ins: Configure available schedule settings and confirm activity within your account.
- Reminders: Scheduled delivery, SMS, push notifications and vacation pause are not currently available.
- Release Controls: A missed check-in does not authorize access or start an automatic release countdown.
- Recipient Access: Invitations, acceptance, recipient verification and family handover are planned and currently disabled.
5. Data Storage, Residency & Security Controls
The deployment uses AWS services configured for the Mumbai region. Descriptions and uploaded files use server-managed encryption; metadata and account records remain accessible to authorized service processes. This statement is not a certification of data-residency compliance.
6. Zero Commercialization & Sub-Processor Disclosures
We do not sell, rent, monetize, or trade your personal or financial data under any circumstance. Our business model relies exclusively on premium subscription tiers, never on advertising or behavioral data mining.
The service uses the following infrastructure providers:
- AWS (Amazon Web Services): Encrypted cloud object storage & PostgreSQL compute (Mumbai, India).
- Google Identity Services: Optional single sign-on authentication.
- Transactional Email Provider: For supported account and waitlist messages. SMS and push delivery are not currently available.
- Google Fonts: The website requests font files from Google, which receives the request metadata, including the IP address.
7. Privacy Requests & Account Deletion
You can contact the privacy address below about access, correction or consent withdrawal. You can delete your account at any time in the app under Profile → Delete Account, after confirming your password or Google account. See how to delete your account if you no longer have the app.
Deletion is immediate and permanent. It removes your account, profile, vault items and uploaded files, descriptions, trusted people, check-in and release settings, subscription records, notifications and related security records. Each file's encryption key is stored only with the deleted records, so any copy that remains in storage during cleanup can no longer be decrypted. We keep no backup of deleted vault content. Copies you downloaded or shared yourself are not affected.
8. Privacy Contact & Requests
For questions about how the current service handles your information or to raise a privacy request, use the following contact:
Please describe your request and the account or waitlist email it relates to. Do not email account passwords or private vault contents.