Privacy Policy

Nirvana Nikhilum Private Limited ("LifeVela," "we," "our," or "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use the LifeVela application and website (lifevela.com).

If you have questions, contact us at privacy@lifevela.com.

We collect the following categories of data:

Account Information: Name, email address, and profile details provided during registration or via Google OAuth.

Optional personal setup: Your chosen setup depth, name, language, confirmed timezone, location, current priority, chosen Life areas, work/commute windows, interruption preference and practical support notes, only when you provide them. These remain private to your account; they are not shared availability or permission to read a connected account. Unconfirmed setup drafts are stored privately for resume, become unavailable after 24 hours and are removed by scheduled maintenance. The page shows whether your latest writing has actually been acknowledged; an unsaved edit is not promised to survive refresh. You can discard drafts or remove setup preferences. If you explicitly mark a saved Vela answer as helpful, we record your acknowledgement and its private result reference, not an independently measured outcome.

Financial Data: Monthly planning estimates; expense, income, refund, and transfer records; monthly budgets; SIP investment and loan or EMI records; net worth snapshots; recurring bills; insurance policies; family commitments; derived monthly cash-flow summaries; finance import-processing records; festival preferences you choose to store; minimal plan-adoption metadata; and deletion-integrity markers used to prevent removed Finance records from being silently recreated.

Habit and Lifestyle Data: Habit names, daily completion logs, streak history, goal records, and OKR progress.

Health Data: Sleep logs (bedtime, wake time, quality rating), mood logs (level and optional note), water intake logs, and workout records. The limited on-device health preview described below is not uploaded to us, stored in your account, or collected as LifeVela data.

Usage Data: Page views and related browser, device, and network information collected through Google Analytics. The integration sends page-view events, including the page path, when a page loads or the route changes.

Communications: Emails you send to our support team and notification preferences.

Connected-service data (only if you choose a connection when it becomes available): The service and account you connected, connection status, permission information available to us, and the messages, events, files, tasks or other items needed for a request or setup you enable. We may keep a task draft, action status and receipt in LifeVela. A provider's OAuth permission may technically allow access to more data than the particular items LifeVela retrieves for your task; granting a connection is not permission for every possible action.

Paid checkout is not currently open. We do not collect payment card details directly. If checkout opens, its payment provider and data practices will be shown before purchase.

We use your data to:

- Provide and improve the Service, including calculating your daily Life Score. - Personalise your experience and provide available Vela assistance. - Send account emails and, where enabled and eligible, weekly summaries via Resend. - Analyse page-view patterns through Google Analytics to understand traffic and improve the Service. - Respond to support requests and communicate service updates. - Comply with legal obligations under Indian law.

We do not use your data for advertising. We do not sell, rent, or share your personal data with third parties for their marketing purposes.

Vela uses OpenAI as its primary language-model provider. Its language-processing requests contain the message you send and the bounded instructions needed to interpret it or generate a reply. Grounded Life Score answers are prepared within LifeVela. Vela does not retrieve your Life Thread journal or connected inbox for ordinary chat. Information you choose to type or paste into a Vela message is part of that message and may be processed by OpenAI.

Saving your private Health profile is model-free. In the optional Health support form, you can select specific confirmed measurements, an age reading, allergy information, preferences or active/paused goals for one reply. We send those selected details to OpenAI only after your explicit request-specific processing choice and retention disclosure. Date of birth and private source notes are excluded; selected allergy notes are included as displayed. Family or Teams membership does not grant this access. The question and reply are saved in your private Vela conversation; removing a profile record does not erase copies in an earlier conversation or a file you downloaded. Delete a conversation separately when you want its saved copies removed.

Saving personal setup preferences is also model-free. In Vela, you may explicitly select particular confirmed setup details for one question and opt in after the processing and retention explanation. Only those selected details and your question go to OpenAI for that reply; unconfirmed setup drafts and operation records are excluded. Setup depth does not grant this permission. Family or Teams membership never grants access to private setup details. The question and reply remain in your private conversation; changing or removing a preference does not erase copies already saved in an earlier conversation, downloaded file or provider processing record. Conversation deletion is a separate control.

You can also ask Vela to help enter or change supported personal setup details and private Health profile records without opening their modules. This optional authoring step sends only the request you review and minimal confirmed date/timezone context to our AI provider after a request-specific processing choice. Existing saved records are read within LifeVela to identify the exact target and prepare the reviewed change; they are not included in that proposal request. The original wording, proposal and pending command stay in protected session memory, not a saved conversation or separate AI memory record. They do not survive closing or reloading the app. Saving and checking the original operation use the same authenticated private record controls as the modules. Saved canonical records retain their existing export, removal and account-deletion controls; removing them does not erase the provider's applicable processing retention. Vela neither shares these records with Family or Teams nor performs a final external action.

Optional Fitness assistance uses the completed or partial session you explicitly choose, its recorded activity and duration, your question, and only the additional confirmed Health or setup details you select. We send these to OpenAI only after your request-specific processing choice. Vela offers nonclinical next-session options; selecting one only fills an editable form. Asking for help does not record exercise, change your score or schedule a session. Saving a plan is a separate deliberate internal action. Vela never finalizes external sending, purchasing or booking; the user performs that final step. Your question, readable reply, bounded options and selected-source references are saved in your private conversation for recovery and export. Saved replies describe their original sources, not guaranteed current facts; changing or removing a source does not erase earlier conversation copies or provider retention. Delete the conversation separately to remove those saved copies.

Optional Habits assistance uses one habit you select, its current plan, the seven calendar days you choose to review, and its open next try and up to five recent outcome reports. Missing or unclear older entries remain unknown, not failures. Only after your request-specific processing choice do we send that bounded record, your question and any additional confirmed Health or setup details you explicitly select to OpenAI. Suggestions are nonclinical, not a habit-strength grade or a promise about when a habit will form. Reviewing an option only fills an editable plan; saving a plan, choosing a next try and reporting what happened are separate deliberate internal actions. Asking for help does not mark days done, change your score, enable reminders or share anything with a Family or Team. Your original question, reply, bounded options and source references are saved in your private conversation for recovery and export. An earlier saved reply is history, not proof that its sources are still current. Changing or removing a habit or selected detail does not erase earlier conversation copies or provider retention; delete the conversation separately to remove its saved copies.

When connected-service tasks become available, a task may process the relevant provider content needed to deliver the feature you choose. Where a task needs AI processing of that content, we will disclose that use before access and limit it to the permitted, user-facing task. Connecting an account does not itself approve sending a message, changing an event or taking another external action. We do not use connected-service data to train a general AI model.

We keep production API feedback, evaluation/fine-tuning sharing, and input/output sharing for model improvement disabled. Vela requests use OpenAI's non-stored Responses setting and do not automatically fall back to another provider. This is not a zero-retention guarantee: OpenAI may retain abuse-monitoring data for up to 30 days, or longer for legal or security reasons, and supported models may retain encrypted prompt-cache data for up to 24 hours. OpenAI may process data outside your country, including outside India. These processing records are distinct from conversation history saved in your LifeVela account.

Your journal entries are not sent to any AI model, are not used to generate insights, and are not included in anything Vela reads.

Sign in with Google can provide your name, email address and profile photo. A separate Google service connection, if offered and chosen, requests its own permissions for the feature shown at connection time. The Google consent screen identifies the permissions requested; a permission can technically cover more Google content than one task needs. We limit our own retrieval and use to the selected, disclosed feature and do not treat account connection as approval for an external action.

LifeVela's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data may pass through service providers such as Composio to authenticate a chosen connection and perform its requested API calls, or through an AI processor for a separately disclosed task where allowed and consented to. We do not sell Google user data, transfer it for third-party marketing, use it for advertising or lending, or use it to train generalised AI or machine-learning models. Human access is limited to specific data you affirmatively ask us to inspect, security, legal requirements, or permitted de-identified internal operations.

You can review and remove a connected app's Google access at myaccount.google.com/connections. Removing provider access does not by itself erase data already saved in LifeVela; use LifeVela's export, deletion or privacy-request controls for that. Disconnecting in LifeVela does not delete the original data in Google.

Current availability — limited internal mobile testing: LifeVela may offer an explicit, user-initiated, foreground preview from Apple Health or Health Connect. It requests read-only permission only for sleep duration and stages, steps, heart rate, resting heart rate, and active energy. The preview is in memory only: LifeVela does not upload it, store it in your account, send it over the network, write it to Supabase, add it to your Life Score, show it to Vela, or create a log entry from it.

This is a preview, not an automatic sync or cloud connection. Clear preview removes the preview from the app; it does not delete anything from Apple Health or Health Connect. You manage or revoke system permissions in Apple Health or iPhone Settings, and in Health Connect or Android Settings, respectively.

Future cloud wearable connections, if we introduce them, are separate from this local preview. Before such a connection is available, we will identify the provider, the data categories, where data is processed, and the controls to disconnect it. Health data is never used for advertising or sold.

Your LifeVela account and product records are stored on Supabase, hosted on Amazon Web Services (AWS) infrastructure in the Asia Pacific region. If you choose a connected service when available, Composio manages its authorization credentials and processes the provider API traffic needed for that feature. Other service providers process the limited information described in section 8; this does not mean all processing stays in the Supabase region.

Security measures we implement: - All traffic encrypted in transit using TLS. - Data at rest encrypted by our infrastructure providers. - Row-level security restricting every record to the account that owns it. - Production data access limited to those who need it.

LifeVela does not currently offer an in-app two-factor authentication setup.

While we implement these security measures, no system is 100% secure. If a breach affects your personal data we will notify you within 72 hours of becoming aware, with a plain description of what happened, what data was involved and what you can do, and we will notify the Data Protection Board as required.

We use, or may use when a named feature becomes available, the following third-party services to operate LifeVela:

Google (Google LLC): Used for sign-in authentication and, where a Google service connection is offered and chosen, the approved connected feature. Google is not the primary provider for Vela's language-processing route.

Telegram: If your Telegram account is linked, direct messages you send to the LifeVela bot are relayed to LifeVela and replies return through Telegram. The link does not give LifeVela access to your other Telegram chats. Bot conversations are not Telegram Secret Chats. Disconnecting stops future use of the link; existing LifeVela and Telegram messages remain subject to each service's retention and deletion controls. A reply already being delivered may still arrive.

Composio (when connected-service features are enabled): Manages authorized provider connections and carries the API requests and responses needed for those features. It can process the connected account identifier, credential and provider content involved in a request. Under its standard retention policy, execution and trigger logs can contain request arguments, response content and connection metadata and remain for up to one year. This is not a zero-data-retention connection. These processing details are available in this policy from Connections. Choosing Connect starts the provider's authorization flow for the selected access; signing up alone does not connect an outside account. Disconnecting stops LifeVela's future use of the connection; it does not by itself erase Composio's retained logs, the original provider data or every upstream grant. See sections 5, 10 and 11 for controls and docs.composio.dev/docs/security/data-retention for Composio's policy.

OpenAI: Primary language-model processing for Vela, using the message and bounded instructions described in section 3. We do not opt production content into model-improvement sharing. The non-stored API setting does not remove OpenAI's separate abuse-monitoring and prompt-cache retention. Processing may occur outside your country. See OpenAI's API data controls at developers.openai.com/api/docs/guides/your-data.

Payment provider: Paid checkout is not currently open. If it opens, we will identify the processor, price and payment-data handling before you purchase; LifeVela will not collect payment card details directly.

Railway (Railway Corp): May host a future Open Wearables component for separately disclosed cloud wearable connections in a United States region. It is not used by the current local-only Apple Health or Health Connect preview.

Google Analytics (Google LLC): Page-view measurement. Google receives page-view events, including the page path, and may receive standard browser, device, and network information associated with those requests.

Resend (Resend, Inc.): Email delivery service for messages LifeVela sends. It receives the recipient address, message content and delivery metadata needed to deliver those emails. Any future inbound Vela email channel will be disclosed separately before activation.

Supabase (Supabase, Inc.): Database and authentication infrastructure hosted on AWS.

DigitalOcean: Hosts the Calendar connection service in Bengaluru, India. Processes authenticated Calendar requests and the connected-service data needed for the calendar features you choose; product records remain in Supabase.

Each third party has its own privacy policy and data practices. We review provider arrangements before activating new data flows; a planned integration in this list is not a claim that it is live.

We use cookies and similar technologies as described in our Cookie Policy (lifevela.com/cookies).

In summary: - Session cookies: Required for authentication and keeping you logged in. - Analytics cookies: Google Analytics cookies used for page-view measurement. - AI notice display preference: Browser local storage keeps an account-scoped notice version after you choose “Got it”, so the same short processing notice is not repeated on that browser. This is not AI processing consent and stores no request, record, chat text or token. Clearing browser storage makes the notice appear again. - No advertising cookies: We do not use cookies for targeted advertising.

LifeVela does not currently provide an in-app analytics preference control. You can block or delete cookies through your browser settings, and browser privacy tools may prevent Google Analytics scripts from loading.

Under India's Digital Personal Data Protection Act and our commitment to your privacy, you have the right to:

Access: Request a copy of the personal data covered by your request. Correction: Request correction of inaccurate or incomplete data. Erasure: Request deletion of your account and associated data, subject only to the limited retention described below. Self-service export: Open Data & Privacy and choose Save my data in desktop Chrome or Edge. The resumable JSON folder includes the named records shown there, including Life Thread entries and saved private Vela conversations. Sign-in credentials, provider data and private operational records are excluded. Existing folders keep their original scope when resumed. Your basic profile and the named sections listed in Data & Privacy are included. Export pages are read independently, not as a single point-in-time snapshot. If a section's record count changes during export, LifeVela pauses; restart after your changes settle. For a broader access request, email privacy@lifevela.com. Withdrawal of Consent: Withdraw consent for data processing at any time (this may affect your ability to use the Service). When a connection is available, you can stop using it in LifeVela and separately remove its access in the provider's account settings. Neither step erases data already saved by the other service. Grievance Redressal: Lodge a complaint with our Grievance Officer.

To exercise these rights, go to Settings then Privacy in the app, or email privacy@lifevela.com. We will respond within 30 days.

We retain your personal data for as long as your account is active or as needed to provide the Service.

Upon account deletion: - Your account and active product data are removed when the deletion workflow completes. If a temporary provider or infrastructure failure interrupts the workflow, it remains queued for automatic retry and is not reported as complete. - Deletion does not delete your Google or other provider account, the original content held there, or an external action already completed. We stop LifeVela's use of a supported connection as part of its deletion workflow; upstream credential revocation may be best effort or unavailable for a particular provider. You can also remove the grant yourself in that provider's security or connected-app settings. We will not describe a pending or unconfirmed provider revocation as completed. - Restricted recovery backup copies may remain for up to 30 days before expiry from the backup cycle. - De-identified aggregate analytics that cannot reasonably be linked back to you may be retained. Where Team aggregates are used, they are recalculated without your contribution when you leave. - Minimal security, deletion-receipt, and legally required records are retained only for their stated purpose and retention period. - Google Analytics page-view data is retained according to our Google Analytics property configuration and Google's applicable retention rules.

Financial transaction logs may be retained for up to 7 years as required by Indian tax and accounting laws, in anonymised form only.

The DPDP Rules 2025 were notified on 14 November 2025, with full obligations applying from 13 May 2027. We are building toward those obligations: consent is recorded and auditable, you can save the named product records in a resumable export folder and start account deletion today, and breach notification follows the 72-hour requirement. We will say we are compliant when we are, and not before.

LifeVela is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors.

If we become aware that we have collected data from a person under 18, we will delete that data immediately. If you believe a minor has provided us with personal data, please contact privacy@lifevela.com.

We may update this Privacy Policy from time to time. When we make material changes, we will:

- Notify you via email at least 14 days before the changes take effect. - Display a prominent notice in the app. - Update the "Last updated" date at the top of this page.

Continued use of the Service after the effective date constitutes acceptance of the updated policy.

For privacy-related enquiries, data requests, or complaints:

Privacy Team Email: privacy@lifevela.com

Grievance Officer: Manish Bhardwaj Email: manish@lifevela.com

Nirvana Nikhilum Private Limited CIN: U74999HR2021PTC098092 PAN: AAHCN8353M H No 944, Block C, Sushant Lok 1, Gurugram, Haryana, India – 122001 Incorporated: 30 September 2021 under the Companies Act, 2013

LifeVela is a product of Nirvana Nikhilum Private Limited.

We aim to respond to all privacy requests within 30 days. If you are not satisfied with our response, you may lodge a complaint with India's Data Protection Board.