Not legal advice. The policy pages were written from what the product really does, not from a legal review. Have someone qualified (ideally counsel who knows Indian IT and DPDP law and GDPR) read them before relying on them.
The operator identity is filled in and the policy pages are live (deployed 2026-10-07; the live text matches
apps/website). The pre-flight for the deploy is in R8 of../communication/ses-production-access/readiness-checklist.md.
Where each policy lives
The website page is the text readers see. Two documents also have a longer draft here; the rest are pointers or internal.
| Document | Text | Notes |
|---|---|---|
| Terms of service | page: apps/website/app/terms/page.tsx; long draft: terms-of-service.md |
The page is shorter. The two are not reconciled (gap-log G60) |
| Privacy policy | page: apps/website/app/privacy/page.tsx; long draft: privacy-policy.md |
The page now has the controller and processor split; the draft adds the legal-basis table and retention detail |
| Acceptable use | page only; acceptable-use-policy.md is a pointer |
|
| Anti-spam | page only; anti-spam-policy.md is a pointer with the facts the page depends on |
|
| Abuse reporting | page only; abuse-reporting-policy.md is a pointer |
|
| Sub-processors | page only; sub-processors.md is a pointer |
The one list; Privacy and Security link to it |
| Data retention schedule | data-retention-schedule.md, internal |
What each period should be and what the code does today |
| Phase B outlines | phase-b-drafts.md, not public |
Tenant sending-vetting policy and a data processing addendum, for the later tenant-mail request |
Decided values (2026-10-07)
| Item | Value |
|---|---|
| Operator | Dipanshu Vishwakarma, trading as Vlozi. An individual: the business is not registered, so nothing may imply a company ("Pvt Ltd", "Inc.", "LLC"). |
| Postal address (public) | Devgaon, Azamgarh, Uttar Pradesh 276201, India. Spelled as on the operator's Aadhaar since 2026-10-26 (it read "Deogaon" from 2026-10-07), so the website, the AWS account and AWS's identity verification name the same village. |
| Effective date | 7 October 2026, which must equal the real deploy date (gap-log G62). One constant, LEGAL_EFFECTIVE, in apps/website/lib/legal.ts. |
| Governing law and venue | India; the courts in Azamgarh, Uttar Pradesh (decided by the owner, 2026-10-07). |
| Grievance contact | The operator, at privacy@vlozi.app and the postal address. |
| Refunds | Within 7 days of a subscription payment, on request by email: the payment minus the credits used. Pack credits are non-refundable. Done by hand. |
| Agency use | Allowed. An agency sends from its own workspace and is responsible for its clients' lists, consent and content. Reselling or white-labelling Vlozi stays forbidden. |
The site reads the operator, address, effective date and contact addresses from apps/website/lib/legal.ts. A change is one edit there plus a search of
this folder for the old text. The operator's private mailboxes are never written in the repo or on the site. The public addresses and why they were chosen
are in ../communication/ses-production-access/contact-addresses.md; do not publish another
without updating that file.
Rules
- Publish a promise only if the code keeps it. The Terms and Privacy drafts mark some sentences in
[brackets]: each is gated on work that has not shipped (the retention job, subscriber erase, the 90-day purge). Publish a bracketed sentence only when its job exists and is deployed. Until then the pages say "email us; within 30 days we tell you what we erased and what we could not". - One operator name and address everywhere, taken from
lib/legal.ts. - One sub-processor list, on the website page.
- The Terms say customers are responsible for their lists and for lawful consent; the Anti-spam page says how.
- Keep the AWS request (
../communication/ses-production-access/case-message.md) consistent with all of this.
Questions for counsel
- The venue clause: the courts in Azamgarh, Uttar Pradesh.
- Whether an individual operator needs a separately named grievance officer, and what acknowledge-and-resolve times apply to complaints about hosted content.
- How long billing records must be kept for an individual proprietor (the draft leaves the period open).
- The standard-contractual-clause claim, and how the DPDP Act's "data fiduciary" and "data processor" map onto the controller and processor roles.
- The refund and agency-use wording, which are business decisions made on 2026-10-07 and are worth a lawyer's glance.
Where this folder is rendered
docs/ is the repo's internal handbook and is meant for the team only. The docs site that renders it answers without a login today (checked 2026-10-07), so
put it behind Cloudflare Access before relying on it for anything unpublished (gap-log G70).