Privacy Policy

Information you provide directly:

• Contact details: Full name, email address, and mobile phone number collected at checkout.
• Business information: Business type (cafe, restaurant, QSR, bakery, bar, retail, etc.) and business name (if provided).
• Location data: Locality name, city, and pincode for the location you wish to analyse. When you pick a place from the search suggestions in the Free Snapshot tool, we also receive that place's coordinates, which is how we put it on the map. We do not read your device's location.
• Checkout details you enter before paying: your WhatsApp number, email, GSTIN and business details are saved as you fill in the checkout, even if you don't complete the payment.
• Payment information: All payments are processed entirely by our payment provider. We do not receive, store, or have access to your card numbers, UPI IDs, or bank account details. We receive only a payment confirmation token and order ID.

Information collected automatically:

• Usage data: Pages visited, button clicks, and general browsing behaviour, collected through our analytics tooling.
• Session-replay analytics: only if you choose Accept, in the cookie band or the cookie and tracking controls, our third-party analytics tooling records clicks, scrolling and page navigation so we can see where the site is confusing. It masks what you type into form fields by default. Section 8 says how to change your cookie and tracking choices.
• Device and network data: Browser type, operating system, IP address, and approximate location (country/city level) for security and fraud prevention.
• Searches that find nothing: when your search for a business finds no match, we keep the words you typed, to improve our search. Before saving, we remove any phone number or email address.
• Cookies: Minimal session cookies for the checkout flow. Analytics, session-recording and advertising cookies stay off unless you choose Accept, as described in Section 8.

• Report generation: Your location, business type, and order details are used as inputs to our AI pipeline to generate your Viabe Report.
• Delivery: Your email address is used to send the completed Report PDF. Your phone number is used to send a delivery notification by messaging.
• Unfinished orders: if you start a checkout and don't complete it, we may send you one message on WhatsApp or email about that order. Reply STOP or write to us and we won't contact you again.
• Order management and support: Contact details are used to respond to support queries, order issues, and refund requests.
• Service improvement: Aggregated and anonymised usage data helps us improve report quality, website performance, and product features.
• Legal compliance: We may retain and disclose data where required by Indian law, regulatory direction, or court order.
• Marketing: We will not send promotional emails without your explicit opt-in consent. Order confirmations and report delivery emails are transactional communications, not marketing.

We may publish statistics made from many checks together, such as a trend across a city. These are numbers only. They never include personal data (as India's DPDP Act defines it) or any detail about a single business, and each number comes from at least 20 businesses.

Viabe uses AI and large language models to produce its reports and services, and shares the information necessary for that with model providers as processors.

Business outreach. We sometimes contact businesses using contact details the business itself publishes, such as on its own website, to introduce Viabe once. Every message tells you how to opt out, and an opt-out is permanent. To have your business's details deleted, email us and we will remove them within one working day.

The DPDP Act allows us to process your personal data on two kinds of ground: the consent you give us, and the legitimate uses the Act itself lists. Below, for each thing we do with your data, we say which one we are relying on. Two things are set out separately at the end, because we are not relying on your consent for them and we would rather say so than file them under a ground to make the list look complete.

• Providing what you ordered: when you place a paid order you give us your contact, business and location details for that purpose, and we process them to produce and deliver what you bought, to keep the order record, and to handle support and refunds. This is the basis for the service itself. It does not depend on marketing consent, and withdrawing marketing consent does not stop it.
• Unfinished orders: we rely on the details you entered for the purpose of placing that order, under the notice shown at checkout. One reminder about that order is part of it; it is not marketing, and we send nothing further without your opt-in.
• Optional details you choose to give: where something is genuinely optional — the coordinates of the place you pick in the Free Snapshot tool, or a business name you did not have to enter — we process it because you chose to give it for that purpose, and you can ask us to remove it.
• Marketing: promotional email goes only to people who have explicitly opted in. That consent is a separate ground and can be withdrawn without affecting your order. Order confirmations, processing notices and delivery of what you bought are part of the service, not marketing, and are not sent on this ground.
• Legal and regulatory obligations: we retain, and where we are legally required to, disclose data to meet accounting, tax and other statutory obligations, or a lawful order. This ground applies whether or not you consent, and it is why some data survives an erasure request — see the retention list in Section 5 and your rights in Section 6.

Optional tracking consent

Analytics and session replay. These are separate categories. Both stay off until you choose Accept, and you can change either one at any time through the footer link described in Section 8.

The technical data your browser sends. The device and network data in Section 1 — IP address, browser and operating system — reaches us with every request your browser makes, simply so the site can answer it. It is not something you hand over separately, so there is no consent to give or to withdraw. We use it to keep the site, the checkout and delivery working and to prevent abuse, we keep no more of it than that needs, and Section 5 says for how long.

Where we do rely on your consent, you can withdraw it at any time through the mechanism in Section 6. Withdrawing consent does not affect processing already carried out while it was in force, and it does not remove data we are required by law to keep.

We share your personal data only with the following trusted service providers, each bound by their own privacy and security obligations:

• Payment processing — to take payment securely. Card, UPI, and bank details are handled entirely by the payment provider and never reach us.
• Communication delivery — to send your Report, order confirmations, and delivery notifications by email and messaging.
• Hosting and database infrastructure — to store order records, report metadata, and account information securely.
• Mapping and geolocation services — to resolve the location you submit and gather location signals for the analysis.
• Product analytics and session replay — when you choose the relevant optional category, the third-party tooling described in Section 1 receives usage and interaction data directly from your browser.
• Advertising measurement — when you choose the Advertising category, Google Ads and Meta Pixel receive your visits and, for a checkout or a paid order, its value, currency and our order number, directly from your browser. We send them no name, email or phone number.
• Form delivery — when you send us something through a form on our website, what you type into it reaches us through a third-party form-relay provider. Email you send to our address does not pass through it, which is why Section 6 asks for requests about your data by email.
• Website hosting — to serve viabe.ai and its checkout pages.
• AI and model providers — the processors described in Section 2, which receive the information necessary to produce your report or service.

We do not sell, rent, trade, or otherwise disclose your personal data to any third party for marketing, advertising, or commercial purposes. The one exception is the Advertising category, which is on by default in India until you choose Reject; it is described below.

• Orders and customer data: Retained for 3 years from the date of purchase for compliance, dispute resolution, and statutory accounting obligations.
• Generated Report PDFs: Retained for 1 year from the delivery date, after which they may be purged from our storage.
• Unfinished checkouts: deleted 30 days after you started them, unless you complete the order.
• Analytics data: Aggregated and anonymised after 90 days.
• The words typed in a search that found nothing: 30 days, then deleted.
• Deletion requests: acted on by hand, once we can satisfy ourselves who is asking, within the timelines prescribed under the DPDP Act and its rules, and subject to the data we are legally required to keep. Section 6 says how to make one.

You are the Data Principal for your personal data and RKeCom Services (OPC) Pvt Ltd is the Data Fiduciary for it. Under the DPDP Act you have the following rights:

• Access: obtain a summary of the personal data we hold about you and of the processing we have carried out on it, together with the identities of the other Data Fiduciaries and processors with whom we have shared it.
• Correction, completion and updating: have data that is inaccurate or misleading corrected, data that is incomplete completed, and data that is out of date updated.
• Erasure: have your personal data erased, except where we are required to keep it to comply with a law or for a purpose the DPDP Act allows. Section 5 sets out what we keep and why.
• Withdrawal of consent: where we are processing your data on a consent you gave — the marketing opt-in, an optional detail you chose to give us, analytics, or session recording — withdraw it as easily as you gave it and we will stop that processing. Use the Cookie & tracking choices link in the footer to withdraw any optional tracking category.
• Grievance redressal: complain to us about how we have handled your personal data, or about how we answered a request you made, through the Grievance Officer named in Section 7 — the route the DPDP Act expects you to use before approaching the Data Protection Board of India.
• Nomination: nominate another individual to exercise these rights on your behalf if you die or become unable to exercise them yourself.

How to exercise them

Every request under this section is handled by a person. We do not operate a self-service privacy portal, and nothing on this site can carry out any of these requests on its own — so the mechanism is an email, and that is the whole of it. Write to support@viabe.ai from the email address you gave at checkout, telling us your name, that email address, and what you are asking for. For a nomination, give the name of the person you are nominating and how we can reach them. We may ask you for details that only the person who placed the order would know: acting on an unverified request about your data would itself be a breach of it. We respond within the timelines prescribed under the DPDP Act and its rules. If you are not satisfied with how we handle a request, Section 7 is the next step.

Send these by email rather than through the contact form on our website. As Section 4 says, anything typed into a form here reaches us through a third-party relay; a request under this section carries your identity, and a nomination carries someone else's, so it should not take a route that email does not.

If you are unhappy with how we have handled your personal data, or with how we answered a request under Section 6, you can complain to our Grievance Officer. The DPDP Act requires a Data Fiduciary to publish this contact and to provide a means of grievance redressal before a complaint is taken to the Data Protection Board of India.

• Grievance Officer: Fazal Khan
• Entity: RKeCom Services (OPC) Pvt Ltd, operating as Viabe.ai

Write to grievance@viabe.ai with your name, the email address you gave at checkout, and what went wrong. We will acknowledge your complaint and respond within the timelines prescribed under the DPDP Act and its rules.

We resolve grievances within 30 days.

The same Grievance Officer acts for the Company as a whole, across every Viabe product this policy covers.

We use cookies and similar technologies for the following limited purposes:

• Session cookies: Required for the checkout flow and order status tracking. These expire when you close your browser.
• Analytics cookies: Off until you choose Accept. They help us understand visits. If you later choose Reject, they stop at once. A Global Privacy Control browser signal keeps them off.
• Session-recording cookies: Off until you choose Accept. They let us see clicks, scrolling and page navigation, so we can find where the site is confusing. Typing in form fields is masked. Reject, or a Global Privacy Control signal, keeps them off.
• Advertising cookies and pixels: Off until you choose Accept. Once you accept, Google Ads and Meta Pixel measure which of our ads brought you to Viabe, and let us show our ads to people who visited. They are told that a visit, a checkout start or a paid order happened, with its value, currency and our order number. We send them no name, email or phone number. They never load on your order or report pages. Reject, or a Global Privacy Control signal, keeps them off.
• Visitor counter: One random identifier, kept for 30 days, so we can count visitors once and not twice. It holds no personal data and is used only for counting. It stays even if you choose Reject.
• Payment cookies: Set by our payment provider, Razorpay, when the payment step opens, even if you chose Reject. They are needed to take your payment safely and to check for fraud. Razorpay keeps a device ID and a checkout ID in your browser storage (rzp_device_id, rzp_checkout_anon_id); they stay until you clear your browser data. It also sets one cookie (rzp_unified_session_id) that lasts about 30 minutes, and one risk check value that is deleted when you close the tab.
• Human check: Our own cookie (viabe_hc), set when you search, so our search works for people and not for bots. It lasts about 20 minutes.
• Theme preference: A local storage entry (not a cookie) stores your light/dark mode preference. This is never transmitted to our servers.

Changing your choice

We show a small consent band at the bottom of the page. Nothing optional loads until you choose. Choose Accept to turn them on, Reject to keep them all off, or Choices to pick each one. Your choice is saved on your device. You can change it at any time with the Cookie choices link in the footer. A Global Privacy Control browser signal keeps all optional trackers off. Section 5 says how long analytics data is kept.

We keep a record of each cookie choice you make: what you chose and when, with a random ID that is not linked to your name or contact details. We keep it for 3 years, to show that we followed your choice.

Advertising cookies and pixels (Google Ads and Meta Pixel) are a separate category, Advertising. It stays off until you choose Accept, and you can turn it off again at any time. It is never on your order or report pages. The analytics tooling above is third-party and is there to show us how the site is used. Only if you choose Accept do Google Ads and Meta Pixel measure which of our ads brought you to Viabe and let us show our ads to people who visited.

For privacy-related queries and data requests:

• Email: support@viabe.ai

You can also write to us through the contact form.

To raise a formal grievance about how we have handled your personal data, use the Grievance Officer in Section 7 rather than this address.

We may update this Privacy Policy periodically. Material changes will be reflected in the "Last updated" date above and, where appropriate, communicated by email to registered users.

Viabe Pulse is sold in India only, so this section appears in the India edition of this policy. It applies in addition to Sections 1 to 9.

What we collect when you order Pulse

• Your business identity. For a business with premises: the Google place you confirm at checkout — its place identifier, name, address and coordinates. For an online-only seller: your business name and the storefront web address, or the marketplace and seller identifier, you give us.
• Your business shape and type: whether it has premises or sells online only, and its business type and cuisine or category, chosen from our list at checkout.
• Contact details: the WhatsApp number your results are delivered to, and the email address we write to if a paid run is refunded.
• Payment: processed entirely by our payment provider, as in Section 1. We receive a payment confirmation, the amount paid and an order reference — never card, UPI or bank details.

Finding your business.

To find your business, we use your rough location from your internet connection. We use it only for that search. We do not store it.

When you type in our business search box, we keep the words you typed, and the business you picked, for 24 hours, so we can fix search problems. We remove any phone number or email address first. We do not share them with anyone, and we delete them after 24 hours.

What we never see

We never see your own business data. Pulse does not ask for, and has no way to read, your sales, point-of-sale, bank, accounting or platform logins. Everything in a Pulse check comes from information that is publicly visible: your public listings, website, social profiles and marketplace pages, and those of the rivals we compare you with. If you use Pulse Fix and sign in with Google, see Google user data below.

What we keep, and what we do not

• Google listing data is used, not stored. Ratings, review counts, opening hours and listing attributes that we read from Google during a run are rendered into your results and are not written to our records.
• What we keep: the place identifier for your business and for the rivals we selected; the coordinates you confirmed at checkout, as part of your order; our own record of which rivals we selected, when, and why; the names of the rivals we compared; and our own observations about your business and those rivals — for example, whether a website or a social profile was found, the themes in rival reviews, price moves, and which businesses web searches and AI assistants named — so that a later check can be compared with an earlier one.
• Your results themselves are stored so that you can download them again from your order page.
• The rivals in your results are other businesses whose public presence we read. We do not contact them.

How long, and how to have it removed

Your order and contact details are kept as described in Section 5. Our own observations about your business are kept for as long as they are needed to compare a later check with an earlier one and to meet our legal obligations. You can ask for any of it to be deleted by emailing support@viabe.ai (Section 6); deletion is carried out by hand.

How your results reach you

Your results are sent as a PDF to your WhatsApp number through a messaging provider acting as our processor (Section 4). If a paid run is refunded, we tell you by email at the address you gave, once the refund is confirmed. If a run stops for a reason on our side, a person at Viabe is alerted; the Refund Policy, Section 6, says what happens then.

Pulse Fix records: we keep your answers and the details of each fix for up to 90 days. All Pulse Fix records are deleted within 365 days. Photos you send us are deleted within 90 days, or 30 days after your website closes if we used them on it.

Viabe Team is in early access in India only, so this section appears in the India edition of this policy. It applies in addition to Sections 1 to 9 and describes the category of processing only.

Asking for early access

When you ask for early access on our website, we receive the one contact you give — a WhatsApp number or an email address — and what you tell us about your business, whether that reaches us as a message you send from the page or through the form on it. We use it only for the purpose you sent it: your interest in early access to Viabe Team. We keep it while early access is being decided. You can ask for it to be deleted at any time by emailing support@viabe.ai naming the contact you gave (Section 6); deletion is carried out by hand.

Using Viabe Team

When a customer uses Viabe Team, it acts on that customer's behalf across the channels the customer connects to it, with the customer's approval before anything is published or sent on their behalf. Doing that involves processing the customer's business content and the information those connected channels make available to it. In that processing Viabe is a processor acting for that customer, who remains the Data Fiduciary for their own business and customer data and decides what it is used for. This section is a general description of that category of processing. Viabe Team's own, more detailed privacy policy is kept with the product and is not published yet, so there is no link to give you here; until there is, this section is the whole of what we say about Viabe Team.