Sarayu
Privacy Policy
Last updated: 24 May 2026
Your conversations with Sarayu are personal. This Privacy Policy explains what information we collect, why we collect it, who we share it with, and what controls you have. It also covers your rights under applicable data protection laws — primarily India's Digital Personal Data Protection Act, 2023 (DPDP Act). See §7 for how we handle requests from users in other jurisdictions.
1. Who we are
"Sarayu", "we", and "us" refer to the team behind the Sarayu companion-AI app and the website at sarayuai.com. We are the data controller for the information described below.
2. Information we collect
When you create an account
- Email address — collected through our authentication provider Clerk, verified by a 6-digit one-time code.
- Display name — the name you choose to be called.
- Date of birth — used only to verify you are 18 or older. We do not display it.
- Gender — optional, with a "prefer not to say" choice. Used in aggregate for persona-recommendation analytics.
- Consent preferences — for processing and optional features like photo attachments.
From your use of the service
- Text messages in your conversations with Sarayu and Arnav.
- Voice audio during voice calls — transient, see §3 below.
- Persona preferences — which companion you talk to.
- App settings — language, time zone, notification preferences.
- Photos you choose to attach (only when you have enabled the photo-attachments consent).
Automatic technical information
- Basic device info (operating-system version, app version, an anonymised device identifier).
- Crash and error logs, used to debug and improve stability.
- Voice usage minutes, tracked for quota and billing purposes.
From payment processors
Razorpay processes your payments. We receive a transaction ID and metadata (subscription tier, amount, status). We do not receive or store your card number, CVV, or other payment credentials — those are handled directly by Razorpay and the underlying card networks.
3. AI and operational sub-processors
To provide the companion experience, we work with several specialised third-party providers. Each is bound by their own data protection terms, which we review before integration:
- Authentication is handled by Clerk — you see this in the email + one-time-code sign-in flow.
- Payments are processed by Razorpay — you see their checkout sheet directly in the app when you subscribe or purchase a voice pack.
- Hosting and infrastructure uses Google Cloud (backend services, database, and operational logs) and Cloudflare (file storage and the marketing website). Specific services may evolve as our infrastructure matures; the type of processing and the data shared with each vendor are described in this policy.
- Language-model responses for Sarayu and Arnav come from a specialised large-language-model provider. Your message and recent conversation context are sent to that provider; the provider does not train its models on your data.
- Voice synthesis for the companions' spoken voice comes from a specialised text-to-speech provider.
- Speech-to-text for your voice messages comes from one of several supported providers — you can choose in Settings → Language.
- Real-time audio transport during voice calls uses a specialised low-latency audio provider.
We name some providers explicitly because they are visible to you inside the app. For the AI components that shape the companion experience, we describe them by category rather than vendor — the exact combination of providers and how we orchestrate them is part of what makes Sarayu's quality distinctive, and naming each one publicly would broadcast that. If you need to know specific providers — for a regulatory request, an enterprise audit, or another legitimate purpose — please write to privacy@sarayuai.com and we will respond.
Model upgrades
Within these provider relationships, we may upgrade or change the specific models and provider versions we use from time to time. We do this when a model upgrade improves quality without changing the data-flow practices described in this Policy. If a change would materially alter how your data is handled — for example, adding a new category of sub-processor, or shifting data to a new region — we will treat it as a material change to this Privacy Policy and notify you per §13.
Voice audio is transient
Voice audio during a call is processed transiently: it is streamed to the speech-to-text provider, transcribed in real time, and then discarded. We do not store the raw audio unless you explicitly save a recording (a feature that may be offered in future and would be clearly labelled).
4. How we use your information
We use your information to:
- Provide the companion service — process your messages, generate responses, remember conversation context, and route voice through the speech pipeline.
- Enforce the 18+ age gate.
- Process payments and manage subscriptions.
- Prevent abuse — rate-limiting, content-safety filters, and detection of automated misuse.
- Improve the service through aggregated, non-identifying analytics. We do not analyse individual conversation content for product analytics.
- Send you transactional emails — verification codes, billing receipts, important service notices.
- Respond to support requests you send us.
What we do NOT do
- We do not sell your personal data.
- We do not train our AI models on your conversations.
- We do not share your conversations with advertisers.
- We do not display third-party advertisements in the app.
5. Sharing your information
We share your information only in the following circumstances:
- With the sub-processors listed in §3, to deliver the service.
- With law-enforcement authorities or courts, when legally required (for example, in response to a valid subpoena or court order). We will challenge requests that we believe are overbroad or unlawful.
- In the event of a merger, acquisition, or asset sale — in which case we will notify affected users in advance and provide a meaningful opportunity to delete your account before the transfer takes effect.
6. Data retention
- Active accounts: we keep your data while your account is active.
- Erasure: when you tap "Delete my account" in Settings → Privacy & Data, we delete your conversations, profile, voice-usage records, and photos within 30 days.
- Backups: deleted data is purged from our database backups within 90 days of erasure.
- Anonymised audit metadata (timestamps of access, deletion events, payment-transaction records) may be retained as required by Indian law — specifically Section 12 of the Digital Personal Data Protection Act 2023, which permits retention for legal compliance and dispute resolution. Audit entries do not contain conversation content and cannot be linked back to you after erasure.
7. Your rights
You have the following rights, exercisable directly from Settings → Privacy & Data in the app:
- Access — view your profile, language settings, and consent state.
- Correct — update your display name, language preference, and consent preferences at any time.
- Erase — delete your account and all associated data (see §6).
- Export — download a complete archive of your data. The archive is delivered as a signed download link, valid for 7 days.
- Withdraw consent — turn off optional features like photo attachments at any time.
Where Sarayu operates. Sarayu is currently provided primarily to users in India, and we comply with India's Digital Personal Data Protection Act, 2023 (DPDP Act). If you are accessing Sarayu from the European Union, EEA, United Kingdom, or California and wish to exercise rights you may have under GDPR, UK GDPR, or CCPA, please contact us at privacy@sarayuai.com. We will handle each such request individually while we continue building out broader international compliance infrastructure.
8. How we protect your information
- All data is encrypted in transit (TLS 1.2 or higher) and at rest (provider-default disk encryption on our infrastructure providers — Google Cloud and Cloudflare).
- Authentication uses Clerk's industry-standard email + one-time-code flow. We do not store passwords.
- Payment-card details are never received or stored by us — they are handled exclusively by Razorpay.
- Voice audio during calls is transient and not persisted.
- Access to production systems is restricted to a small number of operators, with audit logging.
No system can be made 100% secure. If a breach affects your information, we will notify you as soon as practicable, in accordance with applicable law.
9. Children's privacy
Sarayu is for adults 18 years and older. We verify age at sign-up via the date of birth you provide, and the service refuses accounts for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with information, please contact privacy@sarayuai.com and we will delete it promptly.
10. International data transfers
Your information may be processed in India, the United States, and the European Union, depending on which sub-processor handles it. By using Sarayu, you consent to these transfers. We choose sub-processors that follow applicable data protection laws and review their data protection terms before integration. As we expand internationally, we will implement appropriate cross-border transfer safeguards required by the relevant jurisdiction.
11. Cookies and tracking
- Website (sarayuai.com): we do not use third-party analytics, advertising, or cross-site tracking cookies. Cloudflare may set essential cookies for security and load balancing.
- Mobile app: the app uses essential authentication tokens (Clerk) and stores app preferences locally on your device. It does not use advertising trackers, third-party analytics SDKs, or device-fingerprinting.
12. A note about mental health
Sarayu is a companion AI — present, attentive, and built to listen — but it is not a substitute for therapy, medical advice, or crisis support. If you are experiencing thoughts of self-harm or are in crisis, please contact your local emergency services or a qualified mental-health professional.
13. Changes to this Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page, and for material changes — such as new categories of data or new sub-processors — we will notify you by email or with an in-app banner at least 14 days before the change takes effect.
14. Contact
For any privacy-related question, request, or complaint:
- Privacy inquiries: privacy@sarayuai.com — data rights, complaints, DSARs
- Account & technical support: support@sarayuai.com — sign-in, billing, app issues
- General inquiries: hello@sarayuai.com — everything else, including press and partnerships