Privacy Policy

1. Introduction

This Privacy Policy explains how LifeIndex ("we," "our," or "us") collects, uses, discloses, and protects your information when you use the LifeIndex website, mobile app, and related services (the "Service").

We are committed to complying with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the EU General Data Protection Regulation (GDPR), the Illinois Biometric Information Privacy Act (BIPA), and other applicable data protection laws. LifeIndex is offered from India and is also available to users in other countries; wherever you are, we process your personal data on the lawful bases described in Section 5 and only with the consent and notice this Policy sets out. If you do not agree with this Policy, please do not use the Service.

This Policy should be read together with our Terms of Service.

2. Data Controller / Data Fiduciary

LifeIndex is the data controller (under the GDPR) and the data fiduciary (under India's DPDP Act) responsible for your personal data and for determining how and why it is processed. You can reach us, or our Grievance Officer, at the contact details in Section 15.

3. Information We Collect

4. How We Use Your Information

• Generate your astrological readings, charts, and daily insights
• Create and render your personalized AI avatar video, if requested
• Authenticate you and maintain your account
• Process payments for premium features
• Send you service-related emails (e.g. reports, account notices)
• Improve and secure the Service, including fraud and abuse prevention
• Comply with legal obligations

5. Legal Basis for Processing

Under India's DPDP Act, we process your personal data on the basis of the consent you give when you create an account and use the Service, and for legitimate uses permitted by that Act. Under the GDPR (for users in the EU/EEA and UK), we rely on the following bases:

• Consent: you consent to the processing described in this Policy when you sign up. Biometric data (photo/voice) is processed only with your separate, explicit, separately recorded consent. You may withdraw any consent at any time — withdrawal is as easy as giving it (see Section 10) and does not affect processing already carried out before withdrawal.
• Contract: processing needed to provide the Service you signed up for
• Legitimate interests / legitimate uses: securing the Service and preventing fraud and abuse
• Legal obligation: where required by tax, accounting, or other law

6. Biometric Information

• We collect biometric identifiers (facial image, voiceprint) only to generate your avatar video and voice clone
• We do not sell, lease, trade, or otherwise profit from biometric data
• Avatar videos are retained for 30 days and then deleted
• Cloned voice models are auto-deleted after 90 days of inactivity
• You may withdraw consent and request deletion of your avatar and voice data at any time from account settings or by emailing us
• Biometric data is retained no longer than necessary to fulfill the purpose for which it was collected, and in any case is deleted upon account deletion

7. Third-Party Service Providers

We share limited data with the following processors, solely to provide the Service:

• Anthropic (United States) & Google Vertex AI (Google Cloud): process the questions you ask and your computed chart data to generate readings. We send only your question text and derived astrological data — never your name, email, phone number, or raw birth details — and, under their API terms, these providers do not use your data to train their models.
• HeyGen Inc. (United States): processes your photo to generate avatar video
• ElevenLabs Inc. (United States): processes your voice recording for voice cloning and text-to-speech; SOC 2 Type 2 certified with a signed Data Processing Agreement
• Firebase / Google Cloud: authentication and app infrastructure
• Google, Facebook, Apple: if you choose to sign in via these providers
• Resend / AWS SES: transactional email delivery
• Cloud hosting (Google Cloud Run) and PostgreSQL database: store your account and chart data, encrypted at rest

These providers are contractually bound to protect your data and use it only for the purposes we specify.

8. International Data Transfers

We store your account and chart data in India (Google Cloud, Mumbai region), encrypted at rest. To provide the Service, some processing takes place outside India:

• AI reading generation — performed by Anthropic and Google (United States).
• Optional avatar and voice features — performed by HeyGen and ElevenLabs (United States).

For users in India: under the DPDP Act, personal data may be transferred outside India except to any country or territory the Government of India specifically restricts by notification. By consenting to this Policy you consent to these transfers for the purposes described above. We transfer only the minimum data needed and require each recipient to protect it under a data processing agreement.

For users in the EU/EEA and UK: where we transfer personal data outside the European Economic Area, we rely on safeguards such as the EU Standard Contractual Clauses, and host EU/EEA user data with a preference for EU data residency where operationally supported.

9. Data Retention

• Account and chart data: retained while your account is active, deleted within 30 days of account deletion
• Avatar videos: 30 days, then automatically deleted
• Cloned voice models: deleted after 90 days of inactivity
• Consent records: retained as required to demonstrate compliance, even after withdrawal

10. Your Rights

Depending on your location, you have the following rights over your personal data:

• Access — obtain a summary of the personal data we hold about you and how we process it
• Correction & completion — correct, complete, or update inaccurate or incomplete data
• Erasure — delete your data and/or your account
• Withdraw consent at any time, including for biometric processing, as easily as you gave it (this does not affect processing already carried out)
• Data portability — export your data in a portable format (EU/EEA/UK)
• Object to or restrict certain processing (EU/EEA/UK)
• Nominate another individual to exercise your rights in the event of your death or incapacity (India, DPDP Act)
• Grievance redressal — raise a complaint with our Grievance Officer (Section 15) and receive a response within the timelines required by law. You may also complain to a data protection authority, including the Data Protection Board of India or your EU/EEA supervisory authority.

You can exercise these rights from your account settings, or by contacting us at the email below. We respond to requests within 30 days.

11. Children's Privacy

The Service is intended for adults and is not directed at children. Consistent with India's DPDP Act, we treat anyone under the age of 18 as a child: we do not knowingly collect personal data from, profile, or direct behavioural tracking or targeted advertising at children, and biometric avatar creation requires you to confirm you are 18 or older. Where a child's personal data would be processed, verifiable consent of a parent or lawful guardian is required. If you believe a child has provided us personal data, contact us and we will delete it.

12. Security

We use industry-standard safeguards, including AES-256-GCM encryption of personal data at rest, hashed passwords, JWT-based authentication, and rate limiting. No system is 100% secure, and we cannot guarantee absolute security.

13. Cookies & Local Storage

We use essential cookies/local storage to keep you signed in and remember your consent choices. We do not use third-party advertising trackers.

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by updating the "Last Updated" date above, and, where required, we will notify you directly.

15. Contact Us