PRIVACY POLICY
Effective Date: [26th March 2026]
Last Updated: [26th March 2026]
This Privacy Policy applies to the mobile and web application “Trust Circle”, together with any associated services, features, websites, or platforms made available through or in connection with such application and operated by Vivian Metaworks Private Limited, a company incorporated under the laws of India (hereinafter referred to as the “Company”, “we”, “our”, or “us”).
This Privacy Policy explains how the Company collects, uses, processes, stores, discloses, and protects personal data when individuals access or use the Trust Circle application and related services (collectively referred to as the “Platform”).
By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. The Company relies on user-declared age and does not independently verify age unless required for safety or compliance purposes.
1. INTRODUCTION AND PRIVACY COMMITMENT
1.1 Vivian Metaworks Private Limited recognises the importance of protecting personal data and respecting user privacy.
1.2 The mobile and web application “Trust Circle”, together with any associated services, features, websites, or platforms made available through or in connection with such application and operated by the Company (collectively referred to as the “Platform”), is designed as a consent-based communication platform that enables individuals to interact through controlled “trust circles” and optionally share approximate location information with other users.
1.3 This Privacy Policy explains: (i) the categories of personal data that may be collected through the Platform; (ii) the purposes for which such personal data is collected and processed; (iii) the manner in which such personal data is used and disclosed; (iv) the duration for which such personal data is retained; (v) the rights available to users in relation to their personal data; and (vi) the safeguards implemented by the Company to protect such personal data.
1.4 By accessing or using the Platform, you: (i) confirm that you have read and understood this Privacy Policy; (ii) acknowledge that this Privacy Policy forms an integral part of the Platform’s Terms of Use governing your access to and use of the Platform; (iii) provide your free, informed, specific, and unambiguous consent to the collection, processing, storage, and use of your personal data in accordance with this Privacy Policy and applicable law, including the Digital Personal Data Protection Act, 2023 (“DPDPA”), and, where applicable, for legitimate uses permitted under such law.; and (iv) represent and warrant that you are at least eighteen (18) years of age and legally competent to provide such consent.
1.5 If you do not agree with this Privacy Policy, you must immediately discontinue access to and use of the Platform.
2. DATA FIDUCIARY STATUS
2.1 Under the DPDPA, we act as a “Data Fiduciary”, responsible for determining the purpose and means of processing personal data collected through the Platform.
2.2 In its capacity as a Data Fiduciary, the Company undertakes to: (i) process personal data only for lawful and specified purposes in accordance with applicable law; (ii) collect only such personal data as is necessary for the purposes identified in this Privacy Policy; (iii) implement reasonable security safeguards to protect personal data against unauthorised access, disclosure, alteration, or destruction; and (iv) respect and facilitate the rights of Data Principals in accordance with the DPDPA and applicable regulations.
2.3 The Company processes personal data in accordance with the provisions of the DPDPA and any rules, regulations, or guidelines issued thereunder, to the extent such provisions are notified and brought into force.
3. APPLICABLE LEGAL FRAMEWORK
3.1 This Privacy Policy is published in accordance with, and is intended to demonstrate compliance with, applicable laws of India governing the collection, processing, storage, and protection of personal data, including: (i) the DPDPA and any rules or regulations issued thereunder, to the extent notified and brought into force; (ii) the Information Technology Act, 2000; (iii) the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent such provisions remain applicable; (iv) the CERT-In Directions, 2022 relating to cybersecurity incident reporting, log retention, and security practices; and (v) other applicable intermediary liability, cybersecurity, and data protection regulations issued by competent authorities in India.
3.2 In the event that the Platform is made available in jurisdictions outside India, the processing of personal data may also be subject to additional legal or regulatory requirements applicable in such jurisdictions, and the Company may implement such supplementary measures as may be required to comply with applicable law.
4. CONSENT NOTICE
4.1 Prior to the collection or processing of personal data, the Platform provides users with a clear and accessible notice explaining: (i) the categories of personal data that may be collected; (ii) the purposes for which such personal data is collected and processed; (iii) the rights available to users in relation to their personal data; and (iv) the manner in which users may withdraw their consent.
4.2 By creating an account on the Platform or otherwise accessing or using the Platform, you provide your free, informed, specific, and unambiguous consent to the collection, processing, storage, and use of your personal data for the purposes described in this Privacy Policy and in accordance with applicable law.
4.3 You may withdraw your consent at any time through the mechanisms made available on the Platform or by contacting the Company using the contact details provided in this Privacy Policy. Withdrawal of consent shall not affect the lawfulness of any processing carried out prior to such withdrawal. However, withdrawal of consent may result in the limitation, suspension, or discontinuation of certain services or functionalities of the Platform which depend on such personal data.
5. INFORMATION WE COLLECT
In order to provide and operate the services offered through the Platform, the Company collects and processes certain categories of personal data as described below:
5.1 Personal Information
5.1.1 Personal information includes information that can identify you directly or indirectly, including: (i) name; (ii) mobile number; (iii) email address (optional); (iv) profile photograph; (v) user account identifiers; and (vi) user circle associations.
5.2 Location Information
5.2.1 The Platform enables optional proximity-based interaction between users.
5.2.2 Where location sharing is enabled by a user, the Platform may process certain location-related information including: (i) approximate geographic location; (ii) location session signals; and (iii) proximity discovery indicators.
5.2.3 The Platform does not disclose precise GPS coordinates to other users. Instead, location information is converted into approximate geographic zones (typically ranging between approximately 150 metres and 300 metres in radius) before being displayed to other users.
5.2.4 Location data displayed through the Platform represents approximate geographic zones and may be subject to technical limitations or inaccuracies.
5.2.5 Location sharing: (i) is disabled by default; (ii) requires explicit user activation; (iii) operates for a time-limited session; and (iv) automatically terminates after the selected duration.
5.3 Contact Information
5.3.1 Subject to user permission, the Platform may access contact lists stored on a user’s device in order to: (i) identify other users of the Platform; (ii) simplify connection requests; and (iii) facilitate circle management.
5.3.2 Contact syncing is optional and may be disabled at any time through device or application settings.
5.4 Device and Technical Data
5.4.1 When you access or use the Platform, the Company may automatically collect certain technical information including: (i) IP address; (ii) device identifier; (iii) device type; (iv) operating system; (v) application version; (vi) network information; (vii) session timestamps; and (viii) crash diagnostics.
5.5 Usage and Interaction Data
5.5.1 The Company may collect certain interaction and usage signals including: (i) messaging activity metadata; (ii) connection requests; (iii) spam reports; (iv) abuse reports; (v) moderation signals; and (vi) analytics relating to platform usage.
5.5.2 The Platform does not access files, messages, or device data outside the application environment except where such access is expressly authorised by the user.
5.6 Message Content and Metadata
5.6.1 The Platform may process metadata associated with communications occurring through the Platform, such as timestamps, connection signals, and delivery status information.
5.6.2 The Platform does not access or analyse the content of communications except where required for security, moderation, or compliance purposes.
6. INFORMATION WE DO NOT COLLECT
6.1 Except where expressly authorised by users or required for the functioning of the Platform, the Company does not collect, access, monitor, or store the following categories of information: (i) files stored on a user’s device; (ii) passwords or authentication credentials used on third-party platforms; (iii) financial account information or payment credentials; (iv) keystrokes entered outside the Platform; or (v) device content unrelated to activity carried out within the Platform.
6.2 The Company does not access or monitor information stored on a user’s device unless such access is necessary for the functioning of specific Platform features and has been expressly authorised by the user through device or application permissions.
7. TRUST CIRCLES AND USER CONTROL
7.1 The Platform enables users to organise their connections into designated “trust circles”, which determine the level of interaction and visibility permitted between users.
7.2 The Platform may provide multiple trust tiers, including but not limited to: (i) an “Inner Circle”, within which users may communicate through messaging, voice calls, video calls, and media sharing; (ii) a “Trusted Circle”, within which messaging and voice communication may be permitted with limited media sharing permissions; and (iii) an “Outer Circle”, within which communication may be restricted and forwarding or downloading of media may be limited.
7.3 Users maintain control over their circle configurations and may: (i) add contacts to a particular circle; (ii) move contacts between circles; and (iii) modify communication permissions applicable to such circles through the settings available on the Platform.
7.4 The Company does not independently determine or modify the classification of users within circles and relies on user-controlled settings to determine the scope of interaction between users.
8. LOCATION SHARING CONTROLS
8.1 The Platform may provide optional location-based features that allow users to share approximate location information with other users.
8.2 Location sharing is disabled by default and may be enabled or disabled by users through the settings available on the Platform.
8.3 Where enabled, location sharing operates for a time-limited session and may be terminated by the user at any time.
8.4 The Platform does not disclose precise GPS coordinates to other users and instead displays approximate geographic zones.
8.5 Location information is processed on a session basis and is not permanently stored except where anonymised analytics are generated.
8.6 Certain location visibility or proximity-based interaction features may require mutual or reciprocal enablement by users before such information becomes visible to each other.
9. PURPOSE OF PROCESSING PERSONAL DATA
9.1 The Company processes personal data collected through the Platform only for lawful and legitimate purposes, including the following: (i) operating, maintaining, and administering the Platform; (ii) creating and authenticating user accounts, including verification through OTP and device binding; (iii) enabling communication services such as messaging, voice calls, video calls, and other interactions between users; (iv) facilitating proximity-based discovery features where users voluntarily enable location sharing; (v) detecting and preventing fraud, abuse, harassment, or misuse of the Platform; (vi) supporting moderation processes and enforcement of Platform policies; (vii) analysing usage patterns to improve the performance, functionality, and reliability of the Platform; and (viii) complying with applicable legal, regulatory, and law enforcement obligations. The Company processes personal data primarily on the basis of user consent, and in certain cases, where permitted under applicable law, for legitimate uses as recognised under the DPDPA.
10. AI-ASSISTED MODERATION
10.1 The Platform may use automated tools or artificial intelligence systems to identify suspicious behaviour, including spam, harassment, fraudulent activity, or violations of the Platform’s policies.
10.2 Automated systems may analyse usage patterns or behavioural signals in order to flag potential violations for review. Automated systems do not make final determinations in all cases and may be subject to human review where appropriate.
10.3 Where serious violations are detected, actions such as warnings, restrictions, suspension, or termination of accounts may be implemented.
10.4 Significant moderation decisions, including account suspensions or comparable restrictions, may be subject to human review and internal escalation processes in accordance with the Platform’s policies.
10.5 Users may raise concerns or seek clarification regarding moderation actions through the grievance redressal mechanisms specified in this Privacy Policy.
11. DATA SHARING
11.1 The Company does not sell, rent, or commercially trade personal data collected through the Platform.
11.2 The Company may disclose limited personal data in the following circumstances and only to the extent necessary for the purposes described in this Privacy Policy.
11.3 The Company may engage third-party service providers to support the operation of the Platform, including providers of: (i) cloud hosting infrastructure; (ii) analytics and system monitoring services; (iii) OTP verification services; (iv) push notification delivery systems; and (v) other technical infrastructure or support services necessary for the functioning of the Platform.
11.4 Such service providers may process personal data solely on behalf of the Company and only in accordance with contractual obligations requiring confidentiality, security safeguards, and compliance with applicable data protection laws.
11.5 The Company may disclose personal data where required to comply with applicable law or lawful requests from competent authorities, including courts, government agencies, regulatory authorities, or law enforcement bodies.
11.6 The Company may also disclose limited personal data where reasonably necessary to: (i) investigate suspected fraud, abuse, harassment, or misuse of the Platform; (ii) enforce the Platform’s policies, Terms of Use, or other applicable contractual terms; or (iii) protect the safety, rights, property, or security of users, the Company, or the public.
12. BUSINESS AND PREMIUM ACCOUNTS
12.1 The Platform may offer premium or enhanced features to registered business accounts or verified service providers.
12.2 Such features may include: (i) verified business profiles; (ii) enhanced visibility or discoverability within the Platform; and (iii) the ability to display business or service listings.
12.3 Business accounts may interact with users only where such interaction is initiated or expressly permitted by users.
12.4 Business accounts are not permitted to initiate unsolicited mass communications or engage in bulk messaging practices that may constitute spam or harassment.
12.5 The Company reserves the right to restrict, suspend, or terminate business accounts that violate the Platform’s communication policies or misuse the Platform’s services.
13. DATA RETENTION
13.1 The Company retains personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.
13.2 The general retention periods applicable to certain categories of data include: (i) location session data, which is retained temporarily for the duration of the location sharing session; (ii) account data, which is retained until a user submits a valid deletion request or the account is otherwise terminated; (iii) security logs, which may be retained for a period ranging from approximately one hundred eighty (180) days to one (1) year in accordance with cybersecurity requirements; and (iv) backup data, which may be retained for approximately thirty (30) to ninety (90) days as part of system backup and recovery processes.
13.3 Upon expiry of the applicable retention period, personal data may be deleted, anonymised, or irreversibly aggregated so that it can no longer be associated with an identifiable individual.
14. DATA SECURITY
14.1 The Company implements reasonable technical and organisational safeguards designed to protect personal data from unauthorised access, loss, misuse, alteration, or disclosure.
14.2 Such safeguards may include: (i) encryption of data in transit; (ii) secure cloud infrastructure and network protection mechanisms; (iii) restricted access controls for authorised personnel; (iv) monitoring systems designed to detect unauthorised access or suspicious activity; and (v) periodic vulnerability assessments and security reviews.
14.3 Access to personal data is limited to authorised personnel, contractors, or service providers who require such access for the operation or support of the Platform and who are subject to appropriate confidentiality obligations.
14.4 While the Company adopts reasonable security safeguards, no electronic transmission, storage system, or method of data protection can be guaranteed to be completely secure. Accordingly, the Company does not guarantee absolute security of personal data or communications transmitted through the Platform, and Users acknowledge that any transmission of data is undertaken at their own risk.
14.5 The Platform may implement security measures, including encryption of communications in transit and other technical safeguards designed to protect data transmitted through the Platform; however, the Company does not guarantee absolute security of such communications.
15. DATA BREACH NOTIFICATION
15.1 In the event of a personal data breach that is likely to affect users or compromise the security of personal data, the Company will take appropriate steps to investigate and mitigate the incident.
15.2 Where required under applicable law, the Company may notify affected users of such breach and provide information regarding steps taken to address the incident.
15.3 The Company may also report such incidents to competent authorities, including the Data Protection Board of India, CERT-In, or other regulatory bodies, in accordance with applicable legal or regulatory requirements.
15.4 The Company will take reasonable measures to contain the breach, assess the potential impact, and implement corrective measures to prevent similar incidents in the future.
16. CROSS-BORDER DATA TRANSFERS
16.1 Personal data collected through the Platform is currently stored and processed on infrastructure located within India.
16.2 In the event that personal data is transferred outside India in the future, such transfers will be carried out only in accordance with applicable law and subject to appropriate safeguards designed to protect personal data.
16.3 Where applicable under the DPDPA, personal data may be transferred only to jurisdictions permitted by the Government of India or otherwise in accordance with regulatory requirements applicable to such transfers.
16.4 The Company will take reasonable measures to ensure that any third parties receiving personal data outside India maintain appropriate standards of data protection and security.
17. RIGHTS OF USERS
17.1 In accordance with the DPDPA, users whose personal data is processed through the Platform (“Data Principals”) may exercise certain rights in relation to their personal data.
17.2 Subject to applicable law and verification of identity, users may exercise the following rights: (i) the right to obtain confirmation regarding the processing of their personal data and to access details of such data; (ii) the right to request correction, updating, or completion of inaccurate or incomplete personal data; (iii) the right to request erasure of personal data where such data is no longer necessary for the purposes for which it was collected, subject to legal retention obligations; (iv) the right to withdraw previously provided consent for the processing of personal data; (v) the right to nominate another individual who may exercise such rights in the event of the user’s death or incapacity; and (vi) the right to seek grievance redressal in relation to the processing of personal data.
17.3 Requests relating to the exercise of these rights may be submitted through the mechanisms made available on the Platform or by contacting the Company using the contact details set out in this Privacy Policy.
17.4 Users shall ensure that personal data provided by them is accurate, complete, and not misleading, and shall not impersonate another individual or provide false information.
18. WITHDRAWAL OF CONSENT
18.1 Users may withdraw their consent for the processing of personal data at any time by: (i) modifying the privacy settings available on the Platform; (ii) disabling specific permissions such as location access or contact synchronisation; or (iii) submitting a request to the Company or the designated Grievance Officer.
18.2 Upon withdrawal of consent, the Company will cease processing personal data to the extent required under applicable law, except where such processing is necessary to comply with legal obligations or to establish, exercise, or defend legal claims.
18.3 Withdrawal of consent may result in the limitation, suspension, or discontinuation of certain features or functionalities of the Platform that rely on such personal data.
19. ACCOUNT DELETION
19.1 Users may delete their accounts through the account management settings available on the Platform or by submitting a request to the Company.
19.2 Following a deletion request, the user’s account may enter a temporary deactivation or “soft deletion” period of approximately thirty (30) days, during which the account may remain recoverable by the user.
19.3 Upon expiry of the soft deletion period, personal data associated with the account will be removed from active systems, except where retention of certain information is required for legal, regulatory, fraud prevention, or security purposes.
19.4 Residual data may remain in system backups for a limited period in accordance with the Company’s backup and disaster recovery processes, after which such data will be permanently deleted or anonymised.
20. CHILDREN’S PRIVACY
20.1 The Platform is intended for use only by individuals who are eighteen (18) years of age or older.
20.2 The Company does not knowingly collect or process personal data relating to individuals below the age of eighteen (18).
20.3 If the Company becomes aware that personal data belonging to a minor has been collected without appropriate authorisation, the Company will take reasonable steps to delete such information and may suspend or terminate the associated account.
20.4 The Platform does not intentionally engage in behavioural profiling, targeted advertising, or similar processing activities directed at minors.
21. GRIEVANCE REDRESSAL
21.1 Users who have concerns, complaints, or requests relating to the processing of their personal data may contact the designated Grievance Officer appointed by the Company.
21.2 The Grievance Officer shall be responsible for addressing privacy-related concerns and facilitating the resolution of complaints in accordance with applicable law.
21.3 The details of the Grievance Officer are as follows:
Name: [Akshay Naik]
Designation: [Grievance Officer]
Entity: [Vivian Metaworks Private Limited]
Email: [vmpl@vivianmetaworks.com]
Address: [Pune, Maharashtra, India]
21.4 The Company shall acknowledge receipt of grievances within twenty-four (24) hours and endeavour to resolve such grievances within fifteen (15) days from the date of receipt or within such time as may be prescribed under applicable law.
21.5 If a user is not satisfied with the resolution provided by the Company, such user may seek further redress as per applicable laws.
22. CHANGES TO THIS PRIVACY POLICY
22.1 The Company may update or modify this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or features of the Platform.
22.2 Where material changes are made to this Privacy Policy, the Company may notify users through appropriate means, including notifications within the Platform or publication of the updated Privacy Policy on the Platform.
22.3 The revised Privacy Policy will indicate the updated “Last Updated” date at the beginning of the document.
22.4 Continued access to or use of the Platform after the publication of an updated Privacy Policy shall constitute acceptance of the revised Privacy Policy to the extent permitted under applicable law.
23. CONTACT
23.1 Users who have questions, requests, or concerns relating to this Privacy Policy or the processing of personal data may contact the Company using the contact details provided below.
23.2 For privacy-related enquiries or requests, users may contact:
Email: [vmpl@vivianmetaworks.com]
23.3 The Company may request reasonable information to verify the identity of the requesting user before responding to privacy-related requests in order to protect user data and prevent unauthorised access.