Privacy Policy

This Privacy Policy explains how Reachify Innovations Private Limited (“Reachify”, “we”, “us”, or “our”) collects, uses, stores, shares and protects information when you explore our demo, book a call with us, or purchase our CharvaX service at charvax.com. We are committed to handling your data responsibly and in accordance with applicable Indian law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDP Act).

It covers two distinct relationships. For information about you as our client — the person or business buying and using CharvaX — we are the data fiduciary (sections 1–2). When we host your store, we also process data on your behalf — including your own customers’ data — as your data processor (section 3). Your live store additionally publishes its own shopper-facing privacy policy, which governs how your store collects data from your customers; this document is Reachify’s policy, not that one.

1. Information we collect

We collect only the information we need to deliver our service and communicate with you:

• Contact details — your name and the name of your business or brand.
• Communication details — your email address and WhatsApp / phone number, so we can send your confirmation, service agreement, and project updates.
• Business details — information you share about your store, products, and requirements (for example, your store URL, catalogue size, current platform, and customisation notes).
• Booking details — the time you pick for a call with us, and anything you ask us to cover.
• Payment information — when you pay, your card / UPI / netbanking details are collected and processed directly by our payment processor, Razorpay. We do not see or store your full card number, CVV, or banking credentials; we receive only a payment confirmation and a payment reference ID.
• Usage and device data — the pages you visit and the actions you take on this website (for example opening the demo, viewing a quote, starting checkout or booking a call), your IP address, browser and device details, the ad or link that brought you here, and identifiers stored in cookies or in your browser. This data is not anonymous. Section 6 lists exactly what goes to Meta and to Google.

2. How we use your information

• Service delivery — to set up, configure, and deliver your store, and to collect the assets required to build it.
• Communication — to send confirmations, your service agreement, onboarding forms, call invitations and reminders, and updates, and to respond to your questions over email or WhatsApp.
• Payment processing — to take your setup fee and, where applicable, your monthly subscription, and to issue receipts.
• Analytics — to understand how this website is used, through Google Analytics (section 6).
• Advertising — to see which of our ads lead to demos, bookings and payments, and to help Meta decide who is shown our ads, by sharing limited data with Meta (section 6).
• Legal and security — to comply with our legal obligations, prevent fraud, and keep our service secure.

We do not sell your personal data. We share limited data with Meta to measure and target our ads, as set out in section 6, and you can turn that off at any time.

3. Hosting your store — data we process for you

When we host and operate your store, we process data on your behalf — including your customers’ data (orders, contact details, addresses, and store activity). For this data you are the data fiduciary and Reachify is your data processor: we process it only to run and support your store, under the data-processing terms in your service agreement, and never for our own purposes. The one exception, unless you opt out under your service agreement, is that we may combine de-identified, aggregate statistics derived from your store with those of other stores in the same industry, only to improve our service: these statistics never contain personal data, are never used to make a decision about any individual, and are never used to train any third-party AI model. We do not sell it and we do not use it for third-party advertising.

How the AI crew uses data

Your store comes staffed with BarhaX and a crew of AI agents (plus the buyer-facing AI Store Companion). They act on your store’s data to do their work, but under a strict boundary that is enforced in code, not left to configuration: the AI receives a customer’s name and business signals (such as order history or segment) — never their contact details, address, payment information, or identity documents. The underlying tools simply do not emit those fields, so even a misbehaving prompt cannot reveal them. We do not use your customers’ personal data to train external AI models, and personal identifiers are hashed before anything leaves our servers for measurement.

First-party analytics and ad measurement

Your store includes a first-party analytics engine that records store activity (such as page views, add-to-cart, and confirmed purchases) to power your own dashboards and the AI crew. Where you choose to connect ad-measurement destinations (for example Meta, Google, or TikTok), your store sends them conversion signals with personal identifiers hashed (SHA-256) before they leave the server — configured and controlled by you, and gated on your shoppers’ consent. You decide which destinations are connected.

4. How your data is stored

Your lead and project information is stored on managed Supabase infrastructure (PostgreSQL), with access restricted to authorised Reachify personnel. Your store’s data is held in an isolated database provisioned for your store. Payment records are held by Razorpay under their own security standards, and our website and services are hosted on Vercel. Sensitive credentials you provide (such as gateway or logistics keys) are encrypted at rest. We retain your information only for as long as needed to deliver the service, meet our legal and accounting obligations, and resolve any disputes.

Our request log

Each time a browser or another program asks this website or its servers for a page or an action, we record: the time; the page address, without the values in its query string; the names of any query parameters; the request method; the status of our response and a short label for its result; a request ID; a keyed hash of the IP address (never the address itself); whether the request came from a browser or a bot; the country it came from; and the name of the site that linked to the page. We keep this log for security, and because CERT-In, India’s national computer emergency response team, directs service providers to keep logs for 180 days within India. It is stored in our database in Mumbai, India, and each entry is deleted after 180 days.

Complaints

When you lodge a complaint, we keep your name, your email address, any phone number and order reference you give, and your complaint as you wrote it, with its reference number and dates. We use them to record, look into and resolve your complaint, and to meet our duty under rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020. They are stored in our database in Mumbai, India. We keep a complaint record for as long as we need it to resolve the complaint and to deal with any claim about it.

5. Service providers and other recipients

We rely on a small number of trusted providers to run our service and your store, and two companies — Meta and Google — also receive data from this website. Each receives only what is described here:

• Razorpay — payment processing. Your payment data is governed by Razorpay’s privacy policy. We attach your business name, email address, WhatsApp number and any Meta cookie IDs in your browser to the payment order, so the payment can be matched to your quote and measured.
• Resend — transactional email delivery (confirmations, call invitations and reminders, onboarding, and store order emails).
• Vercel — website and application hosting.
• Supabase — secure database storage for your lead, booking, project, and store records.
• Meta Platforms — receives the website activity, hashed identifiers, IP address, browser details and Meta cookie IDs described in section 6, through the Meta Pixel in your browser and the Meta Conversions API from our servers, while Marketing is on. Meta also uses this data under its own terms.
• Google — Google Analytics receives the website activity described in section 6 while Analytics is on. Google Calendar and Google Meet host a call you book: the calendar event holds your name, email address, phone number, brand name and anything you asked us to cover.
• AI model providers — OpenAI answers the BarhaX demo chat on this website and receives the text you type there, including any notes you ask BarhaX to remember. Anthropic powers the AI crew and Companion, and receives only the limited signals described in section 3. They do not use that data to train their models.
• Logistics and messaging partners — couriers and, where enabled, WhatsApp/SMS providers, to ship orders and send order updates. Firebase is used to verify phone numbers by OTP.

We use sub-processors under their published terms, and we do not add a third-party middleware layer into the path of your sensitive data. Ad-measurement destinations you connect (section 3) act on your instructions, not ours.

6. Cookies, analytics and advertising

This section covers charvax.com. Your live store uses first-party cookies for the storefront and the analytics described in section 3; non-essential tracking there is subject to your shoppers’ consent, and declining it suppresses those signals.

What goes to Meta

While Marketing is on in Cookie settings — it is on unless you turn it off — we share the data below with Meta Platforms to measure and target our ads: to see which ads lead to demos, bookings and payments; to help Meta show our ads to people likely to be interested; and to build audiences, such as people who opened our booking page but did not book, who may be shown our ads again.

• From your browser (the Meta Pixel). Each page you view, and these actions: opening the demo or the booking page, viewing our pricing, first using the demo or BarhaX, viewing a quote (with its price), clicking through to WhatsApp, starting or completing our qualifying questions, starting checkout, submitting the payment form, paying (with the amount), and booking a call. Each carries the amount, product and a short label where there is one, and a random ID we keep in your browser, in hashed form. Meta’s own script also receives the page address, the page you came from, your IP address, browser details and Meta cookie IDs.
• From forms. When you complete our qualifying questions, submit the payment form on /quote, or book a call on /book, we also share your email address, phone number and name, in hashed form, with those actions and with later ones during the same visit.
• From our servers (the Meta Conversions API). So that they are not lost to ad blockers, some of the same actions are also sent from our servers: opening the demo or the booking page, viewing our pricing, first using the demo or BarhaX, viewing a quote, clicking to reserve, clicking through to WhatsApp, and completing our qualifying questions. These carry the action, the page address, the random browser ID in hashed form, your IP address, browser details and Meta cookie IDs, the amount where there is one, and — for the qualifying questions — your email address and phone number, in hashed form. When you pay, our server sends the payment with its amount, your email address, phone number and name in hashed form, and your Meta cookie IDs. When you book a call, it sends the booking with your email address, phone number and name in hashed form, the random browser ID in hashed form, and your IP address, browser details and Meta cookie IDs. If a booked call is cancelled, it may send the cancellation with the same hashed details. For a payment or a booking, our servers follow the choice recorded when you submitted the form.

What goes to Google

While Analytics is on in Cookie settings — it is on unless you turn it off — Google Analytics receives each page you view (its address and title) and the actions listed above, with details such as the amount, product, the tier and price of your quote, the call time you pick and, if a booking fails, the reason. Google’s own script also receives your IP address and browser details, and sets its own cookies. We also pass your Cookie settings choice to Google using Google’s consent signals.

Cookies and browser storage

• _fbp — Meta’s browser ID, set by Meta’s script while Marketing is on.
• _fbc — the ID of the Meta ad you clicked to reach us. Set only when you arrive from a Meta ad and only while Marketing is on: by our code for 90 days, or by Meta’s script.
• _ga and _ga_… — Google Analytics IDs, set by Google’s script while Analytics is on.
• zentea_consent_v1 — kept in your browser’s local storage, not a cookie. It remembers your Cookie settings choice and when you saved it. Necessary for your choice to work.
• rs_visitor_id — a random ID kept in your browser’s local storage. It is only ever sent in hashed form: to Meta while Marketing is on, and to us with a call you book.
• cx_attr_v1 — kept in your browser’s local storage for 30 days. It remembers which ad or link first brought you here, and is saved with a call you book.
• Session storage (cleared when you close the tab) keeps the name, WhatsApp number and email you type into our qualifying questions, so the quote and booking forms can be filled in for you.

Your choices

Cookie settings is in the footer of every page of this website, and at the bottom of /quote and /book. It opens only when you click it. Turn Analytics or Marketing off and save, or choose “Reject optional” to turn both off.

• With Marketing off, the Meta Pixel does not load (or is told to stop), nothing is sent to Meta from your browser, and forms you submit afterwards are not sent to Meta from our servers.
• With Analytics off, Google Analytics does not load and records nothing.
• Your choice is saved in this browser only. Another browser or device needs its own choice.
• Turning a setting off does not delete cookies that are already set — you can clear those in your browser — and it does not recall data that has already been sent.
• For a quote or booking you have already submitted, the choice recorded when you submitted it applies. To withdraw your consent for that submission, email us (section 9).

7. Your rights and grievances

You have the right to:

• Access the personal data we hold about you.
• Request correction of any inaccurate or incomplete data.
• Request deletion of your data, subject to our legal and accounting retention obligations.
• Withdraw consent to non-essential processing at any time — with Cookie settings on this website (section 6), or by emailing us.

To exercise any of these rights or to raise a grievance, email us at info@reachifyinnovations.com, or write to our Grievance Officer, Raghav Pratay (Founder & CEO), at raghav@reachifyinnovations.com or +91-9128547292. So that we can find your records and confirm the request is yours, please include:

• your name;
• the email address or phone number you used with us;
• your payment order ID or the date of your booked call, if you have one; and
• what you would like us to do.

We may ask you to confirm the request from that email address or phone number. We will respond within 30 days of receiving your request. If you are not satisfied with our response, you can complain to the Data Protection Board of India, established under the Digital Personal Data Protection Act, 2023.

If you are a customer of a store we host and want to exercise your rights over your data, please contact that store, which is the fiduciary for its customer data. As its processor, we support merchants in honouring access, correction, and deletion requests. Until our erasure tooling is built, we carry out a deletion request by hand in the systems we operate for that store, within 30 days of the store asking us.

8. Changes to this policy

We may update this Privacy Policy from time to time, and the “Last updated” date above will show when. If we make a material change, we will tell you about it, and where the change needs your consent we will ask for it again.

9. Contact us

For any privacy question or request, contact Reachify Innovations Private Limited at info@reachifyinnovations.com or on WhatsApp at +91 91285 47292. Our Grievance Officer is Raghav Pratay, Founder & CEO, at raghav@reachifyinnovations.com or +91-9128547292. Reachify Innovations Private Limited (CIN U73100BR2024PTC069981) is registered at 05 Bhagwanpur, Patahi (Muzaffarpur), Bandra, Muzaffarpur – 843113, Bihar, India.