1. Introduction

Welcome to Recuvix ("we", "us", "our"). Recuvix is an AI-powered blog generation platform operated by Recuvix Technologies, a company incorporated in India.

This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our platform at recuvix.in and related services.

By using Recuvix, you agree to this Privacy Policy. If you disagree, please do not use our service.

2. Information We Collect

2.1 Information you provide directly

Account information:

• Email address
• Full name (optional)
• Profile photo (if signing in via Google)
• Password (hashed using bcrypt — we never store plain-text passwords)

Payment information:

• Transaction ID (from Razorpay)
• Payment amount and timestamp
• Pack purchased

We do NOT collect or store: Credit card numbers, CVV codes, or bank account details. All payment processing is handled by Razorpay, a PCI DSS Level 1 certified payment processor.

Content you create:

• Blog topics, titles, and generated content
• Uploaded brand assets (logos, images)
• Workspace details and member lists
• Voice recordings (temporarily, see Section 4)
• Calendar entries and keyword research
• Internal linking strategies

Support communications:

If you contact us, we keep records of the communication to help resolve your issue.

2.2 Information collected automatically

Usage data:

• Pages visited and features used
• Blog generation count and types
• Error logs and performance data
• Timestamps of key actions

Device and browser data:

• Browser type and version
• Operating system
• Screen resolution
• IP address (used for security, not tracking)

Cookies:

2.3 What we do NOT collect

• Your LLM API keys (stored only in your browser)
• The content of your API key requests to AI providers
• Biometric data
• Government ID numbers
• Your precise GPS location

3. How We Use Your Information

We use the information we collect to:

Provide the service:

• Create and manage your account
• Process credit purchases and maintain your balance
• Generate blogs and SEO content on your behalf
• Store generated blogs in your history
• Enable team workspace features

Improve the service:

• Understand which features are used most
• Debug errors and performance issues
• Develop new features based on usage patterns

Communicate with you:

• Send transactional emails (payment receipts, password resets, credit refund notifications)
• Respond to support requests
• Send product updates (you can unsubscribe anytime)

Security and fraud prevention:

• Detect and prevent abuse
• Enforce our Terms of Service
• Protect other users from harm

Legal compliance:

• Comply with Indian law and regulations
• Respond to lawful government requests
• Maintain records required by law

We do NOT:

• Sell your personal data to any third party
• Use your content to train AI models
• Display advertising based on your data
• Share your data with marketers

4. Voice Recording Data

If you use the Voice to Blog feature:

What we collect:

• Your audio recording (uploaded to secure storage)
• The transcription produced by OpenAI Whisper
• The structured transcript used for blog generation

How it is used:

Your audio is sent to OpenAI's Whisper API for transcription. OpenAI's privacy policy governs their handling of this data.

Retention:

Audio files are automatically deleted from our servers within 24 hours of successful blog generation. Transcripts are retained as part of your blog history until you delete them.

Your control:

You can delete any voice recording and its transcript from your account at any time.

5. Third-Party Services

We use these third-party services. Each has its own privacy policy:

AI providers (Claude, ChatGPT, Gemini, Grok):

If you use BYOK mode, your API key and content requests go directly from your browser to the AI provider. Recuvix does not proxy or log these requests.

If you use Managed Mode, your blog topic and generation parameters are sent to our server, which calls the AI provider using our platform key. We do not store the raw AI provider request/reponse.

6. Data Storage and Security

6.1 Where your data is stored

Your data is stored on:

• Supabase (primary database): hosted on AWS in the ap-south-1 (Mumbai) region
• Cloudinary CDN: globally distributed
• Supabase Storage: AWS S3 (Mumbai region)

We choose India-region hosting wherever possible to comply with data localisation principles.

6.2 Security measures

• Encryption in transit: All data transmitted over HTTPS using TLS 1.3
• Encryption at rest: Database encrypted using AES-256
• Row-level security: Supabase RLS ensures users can only access their own data
• API key encryption: Tenant LLM keys stored using AES-256-CBC with a server-side secret
• Password hashing: bcrypt with salt rounds
• SSRF protection: Competitor scraper validates all URLs against private IP blocklists
• Rate limiting: All API endpoints rate-limited to prevent abuse

6.3 Data breach response

In the event of a data breach:

• We will notify affected users within 72 hours of discovery
• We will notify relevant authorities as required by law
• We will publish a post-mortem within 30 days

7. Data Retention

We retain your data for as long as necessary:

Exception: Payment records must be retained for 7 years under the Indian Income Tax Act.

8. Your Rights

You have the following rights regarding your data:

Right to access: Request a copy of all personal data we hold about you. We will respond within 30 days.

Right to correction: Update incorrect information via your account settings.

Right to deletion: Delete your account and all associated data from Settings → Account.

Right to data portability: Export all your blogs in HTML, Markdown, or XML format.

Right to restrict processing: Object to specific uses of your data by contacting legal@recuvix.in.

Right to withdraw consent: Withdraw consent for non-essential processing at any time.

To exercise any of these rights, email: legal@recuvix.in

9. Children's Privacy

Recuvix is not intended for users under 18 years of age. We do not knowingly collect personal information from minors.

If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.

10. International Transfers

Your data may be processed in countries other than India when we use third-party services like Cloudinary (USA) and Resend (USA).

These transfers are governed by appropriate safeguards including standard contractual clauses.

11. Cookies and Tracking

We use minimal cookies essential for service functionality. We do not use advertising cookies or cross-site tracking.

If you use a browser extension to block trackers, our site will continue to function normally. Only authentication cookies are strictly necessary.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do:

• The "Last updated" date will change
• Significant changes will be notified via email
• Continued use after changes constitutes acceptance of the new policy

13. Contact Us

For privacy questions or requests:

Email: legal@recuvix.in

Response time: Within 5 business days

Address: Recuvix Technologies, India