Privacy Policy
Updated 2026-10-22 · Version 2026-10-22.1 · English
1. Operator and privacy contact
Guna Kanumuri operates BharatChitra AI from Medchal, Telangana 501401, India. For access, correction, deletion, consent withdrawal or a complaint, write to admin@bharatchitra.com. We may request proportionate account verification before releasing data or making a destructive change. Never send your password or a reset link.
2. Information processed
We process account name, email, password hash, verification and reset records, session information, chosen settings and policy-agreement records. The app uses bcrypt password hashing; passwords are not intentionally stored as plaintext. Projects may contain ideas, scripts, uploaded photos or audio, generated images, narration, captions, thumbnails, exports and job status. We also process payment identifiers, plan and usage records, optional business tax details, support correspondence and security/operational logs. Hosting and payment services may receive IP addresses, request headers and device information when you connect.
3. Purposes and choices
We use information to create and secure accounts, verify email, deliver requested AI processing and exports, manage payments and limits, provide support, investigate abuse and meet applicable legal obligations. Sending a prompt or upload for generation requires processing it by the configured AI and infrastructure providers. Optional product analytics and learning from usage are disabled unless enabled by the operator and you opt in separately. Declining optional analytics does not prevent normal use. We do not use acceptance of the Terms as permission to send marketing messages.
4. Providers and international processing
Depending on the configured feature, service providers may include Vercel and Railway for hosting, Supabase for account/project data, Cloudflare R2 for media, Google and OpenAI for AI processing or speech, a configured image worker and speech services, Resend or SMTP for transactional email, and Razorpay or Dodo Payments for checkout. Local speech engines may also be used. Data relevant to a request can be transmitted to those providers and processed outside India. We do not represent that all data stays in India or that no cloud sharing occurs. Provider handling and retention depend on their applicable terms and the actual service configuration; do not assume every provider offers identical training or retention controls.
5. Sharing and visibility
We do not sell personal information. Authorized personnel and service providers may access data as necessary for the purposes above; we may disclose information where legally required or to address fraud or safety threats. Projects are intended to be accessible to their account owner rather than a public gallery. Media links may be time-limited bearer links: anyone receiving a working link may be able to use it until expiry. A project share action deliberately enables access under its sharing settings. Do not forward private media or reset links. Review the sharing settings and remove sharing when it is no longer wanted.
6. Retention and deletion
We retain active account and project information to provide the service. You can delete projects or deactivate your account and request erasure through support. Account deactivation revokes access, while media cleanup, related-record review and backup expiry may take additional time. Payment, security, dispute and agreement records may be retained where needed for lawful accounting, fraud prevention, legal obligations or claims; retained data must not be repurposed incompatibly. We do not promise immediate deletion from every provider or a fixed 48-hour backup/render purge. Ask support for the status and applicable retention details for your request.
7. Your requests and withdrawal
You may request access to information about your data and processing, correction, deletion, withdrawal of optional consent and a review of a complaint. Account settings include available profile, data-export and deactivation tools. Tools may not include every record, so contact us for a complete request. Withdrawing data processing necessary for a requested creation means that creation cannot continue; optional analytics can be declined independently. Where applicable law provides additional rights, including nomination or regulator complaints, those rights are preserved. No policy label is a certification of legal compliance.
8. Cookies and browser storage
Essential access_token and refresh_token cookies support authentication. Administrator sessions may use admin_auth. The browser stores language choices and activity/session settings to operate the interface. Payment providers may set their own necessary checkout cookies. We do not deploy an advertising cookie through this policy. Optional analytics preferences default off and can be changed through the privacy-preferences controls. Clearing browser storage can reset local choices but does not delete server-side account data.
9. Children and sensitive media
Accounts are restricted to adults aged 18 or older. The service is not offered for children to operate. Do not upload identifiable children's images or voices or material exploiting children. Fictional, age-appropriate illustrated stories are permitted. Tell us promptly if a child's personal information was supplied so we can investigate and take appropriate action. Real-person photos and voices require the necessary authorization; a checkbox records an uploader's statement, not independent proof that the depicted person consented.
10. Security, incidents and updates
We use access controls, password hashing and session protections, but no service is risk-free. Do not upload material you cannot lawfully or safely provide for cloud processing. We will investigate suspected incidents and make notifications required by laws applicable at the time. Material policy changes are published with a new version and presented for acknowledgement before new creation or purchases where appropriate. Contact admin@bharatchitra.com with security or privacy concerns.