Privacy policy.

• Controller. Vlozi decides why and how it uses the personal data of people who visit this site, create an account, contact us or are invited to a workspace. This policy covers that.
• Processor. Vlozi handles the personal data of a customer's own contacts and recipients (newsletter subscribers, form respondents, mailbox correspondents, chat visitors) on that customer's instructions. The customer decides who is in that data and what they were told, and is responsible for having consent. If you want access to, or deletion of, data a customer holds about you, ask that customer first; we will help them respond.

• Account. Name, email, password hash, workspace/tenant id, role, optional MFA factor.
• Billing. The minimum needed to process a payment (handled by the payment processor — see sub-processors below). Vlozi stores invoice metadata and credit-balance state; full card numbers never touch Vlozi infrastructure.
• Content. Anything you create in the product — blog posts, newsletters, contacts, chatbot transcripts, uploaded media. All of it is scoped to your tenant.
• Usage. Server logs (timestamp, IP, route, status, latency), kept briefly for debugging and abuse prevention. They can contain a recipient's email address when an email fails or is skipped.
• Support correspondence. If you email or use the in-product feedback form, Vlozi keeps that thread to follow up.
• Cookies and analytics. Essential cookies (session, CSRF) and one interface preference (sidebar state). No advertising cookies. This marketing site uses cookieless analytics (Plausible) for page views and events, with no cross-site tracking; it is not loaded when your browser asks to save data.

• Run the product you signed up for (auth, dashboard, sending mail, serving the blog, replying via the chatbot).
• Bill correctly (compute credit usage, send receipts, prevent abuse of the free tier).
• Support (answer questions, debug, send transactional mail).
• Security (detect compromise, rate-limit, investigate abuse).
• Improve the product in aggregate (counts, latency, error rates — never the contents of your posts).

Vlozi does not sell your data, does not share it with advertisers, and does not train models on it. The only third parties Vlozi shares data with are sub-processors required to run the service: hosting, the database, email delivery, payments, AI features and analytics. A feature that uses AI sends the provider only the content the request needs, and the provider's API terms apply to it.

The one current list, with what each provider does, what personal data is involved and where Vlozi chooses the region, is on the sub-processors page. If Vlozi adds a sub-processor that handles personal data, that page will be updated and existing customers notified by email at least 14 days before the change takes effect.

Inside Vlozi, workspace data can be viewed by the operator and by staff who need it for support, billing and abuse handling.

The primary Postgres lives in Neon's ap-south-1 region (Mumbai). Edge compute and CDN delivery run globally on Cloudflare. Object storage (uploaded media) sits on Cloudflare R2, tenant-prefixed. Outbound mail goes through Amazon SES (ap-south-1, Mumbai) and Resend. See the security page for the operational details.

• While your account is active: as long as you keep the account open.
• Cancelling a plan stops charges. It does not delete your data.
• Deleting a workspace takes it out of your dashboard, stops its API keys and means it can no longer be exported, so copy what you need first. Deleting it also cancels its plan and add-ons straight away, with no refund for the rest of the billing period; if the plan can't be cancelled, the workspace is not deleted. To have the data erased, email [email protected]; within 30 days we tell you what we erased and what we could not, unless the law requires us to keep something.
• Deleting your account: you must first delete or hand over every workspace you own.
• Server logs: kept briefly, then deleted.
• Billing records: retained for the period required by Indian tax law (currently 8 years).

Under GDPR (EU/UK), India's Digital Personal Data Protection Act, and equivalents, you can:

• Access the personal data Vlozi holds about you.
• Get a copy of your data. Form submissions, comments and campaign reports export from the dashboard; for anything else, ask and we send it within 30 days.
• Correct anything that's wrong.
• Delete your account — and with it, your personal data, on the retention schedule above.
• Restrict or object to certain processing, and withdraw consent where consent was the basis.
• Lodge a complaint with a supervisory authority if Vlozi gets it wrong.

Email [email protected] with the request. Vlozi responds within 30 days.

If you're outside India and your data crosses borders to reach Vlozi's infrastructure, we rely on the standard contractual clauses in a provider's data processing terms where it offers them. The sub-processors page shows each provider and where it processes data. Questions: [email protected].

Vlozi isn't built for children. The product is targeted at adults running businesses; accounts shouldn't be opened by anyone under 18. If Vlozi learns that a minor has created an account without verifiable parental consent, the account will be closed.

Material changes are notified to existing customers by email at least 14 days before they take effect. Minor clarifying edits land on this page with the effective date above updated.

General questions: [email protected]. Security issues: [email protected]. Postal: Dipanshu Vishwakarma, trading as Vlozi, Devgaon, Azamgarh, Uttar Pradesh 276201, India.

Privacy requests and data-protection complaints (grievance contact): Dipanshu Vishwakarma, [email protected], Devgaon, Azamgarh, Uttar Pradesh 276201, India.