Privacy Policy

Scope and contact

This policy explains how Substrate Labs, Mumbai, India, handles personal data for substrates.in and the Viveka API. Contact support@substrates.in for privacy questions, requests or complaints. Our company contact details also appear at the end of this page.

For website visitors, access requests and our business contacts, we decide how data is used. When a customer sends personal data to Viveka for a decision, the customer determines the purpose of that request and is responsible for its lawful basis, notices and consent. We process the request to provide the API service.

What you send to Viveka

We process the state, question, options and criteria in your API request to return a structured answer and probabilities. Those inputs can contain personal data if you include it. Send only what the decision needs and remove unnecessary identifiers. Do not send passwords, private keys or payment-card details.

Request sharing is off unless you turn it on. By default, we do not keep your requests to improve our models.

Obtaining a key, paying for API access or accepting our terms is not consent to contribute data.

Model improvement

Automatic request sharing is a setting in your Viveka account. It helps us evaluate and improve our models, and it works like this:

• Off unless you turn it on. Your account shows when sharing was turned on. While it is on, we keep requests that were answered. Requests that end in an error are never kept.
• Masked before it is stored. Email addresses, phone numbers, payment-card numbers, Aadhaar, PAN and UPI details are masked first, and shared records are stored without your name or email address. Masking is automated and may not catch every identifier, so send only what a decision needs.
• Kept for 12 months. Shared records are deleted after 12 months, or sooner if you delete them.
• Evaluation first, training only with consent. Shared requests are used to evaluate our models. Using a request for training also requires human feedback on it and your separate consent.
• Control over each request. You can exclude an individual request while sharing is on, and each response states whether that request was shared.
• Delete at any time. Deleting shared data removes your shared requests and feedback and turns automatic sharing off. Turning sharing off stops new requests from being kept.

Access and service records

We handle the contact details you provide when requesting access, your organisation details where supplied, API-key identifiers and the information needed to authenticate requests and apply usage limits. Do not include API-key secrets in support messages.

Our infrastructure also processes technical information such as IP addresses, request times, response status, errors and usage counts. We use service records to operate the API, prevent abuse, investigate failures and administer an agreed paid arrangement. If you pay for access, we keep the billing and transaction records needed for that arrangement and applicable accounting requirements.

Website forms, email and subscriptions

• Access requests and waitlists. Entries may include your email address, the date you joined, a referral code and your country if supplied. We use them to respond, manage invitations and send product updates you requested. Optional emails include an unsubscribe link.
• Surveys. We collect your answers and any contact details you choose to give. We use them for product research and contact you only as indicated on the form. A survey does not authorise collection of your API content.
• Status subscriptions. We store your email address and the service components you follow. Notifications start after confirmation and include a way to change or end the subscription.
• Support. We keep your message and the information you deliberately include so we can respond and resolve the issue. Avoid sending personal data from real requests when a redacted example will do.

Cookies, browser storage and embedded content

Public pages do not set advertising or analytics cookies. We do not use advertising trackers.

• Referral codes: remembered in your browser for 30 days.
• Survey progress: saved in your browser until submission.
• Protected areas: use sign-in cookies. Reading public pages does not require an account.

The website and its hosting services receive your IP address and browser information when you request a page. Articles may load images from Sanity or embedded media from Vimeo or Observable. Those providers receive technical request information when their content loads and apply their own privacy policies. Vimeo embeds use its do-not-track mode.

Why we use personal data

We use data to answer API requests, manage access, provide support, send requested communications, protect the service, administer agreed payments and meet legal obligations.

We do not sell personal data or use it to target advertising.

Where processing depends on consent, you can withdraw it using an unsubscribe link or by contacting us. Withdrawal does not make earlier lawful processing unlawful. Stopping optional communications or declining a training opt-in does not itself authorise any new use of your data.

Providers and locations

• Amazon Web Services: runs the Viveka API, our databases and core operations in Mumbai, India. Amazon Simple Email Service sends account and service email.
• Modal Labs, Inc.: provides the GPU infrastructure that runs Viveka Hoshi. It processes API content to compute the decision and the technical records needed to run that infrastructure.
• Google Cloud: holds backups and recovery infrastructure for business continuity.
• Clerk, Inc.: handles sign-in and account authentication, and manages the waitlist and invitations.
• Dodo Payments: processes payments and billing for paid access.
• Cloudflare: hosts the public website and supporting website data, including forms and subscriptions.
• Sanity: hosts published site content and media.
• Resend: delivers website and waitlist emails.

Not all data stays in India. The Viveka API, our databases and core operations run in Mumbai. Model inference, backups, sign-in, payments, email and website data may be processed outside India, including in the United States. Our website data uses Cloudflare’s Asia-Pacific infrastructure. Transfers remain subject to applicable legal requirements.

Providers receive information needed for their role. We may also disclose information when required by law, to respond to a valid legal request or to protect the service and affected people. A business transfer may require information to move to a successor, subject to applicable law and notice where required.

Retention

• API inputs and outputs: processed to answer the request and not kept as a content history by default. With automatic request sharing on, answered requests are kept, masked, for 12 months or until you delete them.
• API application and key-authorisation logs: configured with 14-day retention.
• Other security, access, usage and billing records: kept for the purposes described above and applicable legal requirements. These records are separate from a history of your request bodies and answers.
• Access requests and waitlists: kept until they have served their purpose or you ask for deletion. An unsubscribe may leave a minimal suppression record so we do not email you again.
• Status subscriptions: kept while subscribed, subject to any records needed to honour an unsubscribe.
• Support messages: kept while needed to resolve the issue and handle related follow-up or legal requirements.
• Shared requests and feedback: kept for up to 12 months and removed when you delete shared data.

Legal obligations or a dispute may require limited records to be retained longer. We restrict their use to that purpose.

Security and incidents

We use HTTPS, API authentication, access controls and rate limits to protect the service. Keep your keys private, minimise personal data in requests and tell us promptly if you believe a key has been exposed.

No service is completely secure. If an incident affects personal data, we investigate, take steps to contain it and provide notices to affected customers, people and authorities as applicable law requires. We do not claim that inference location or a confidence score guarantees privacy or security.

Your choices and requests

You can ask us to:

• Explain the personal data we hold about you.
• Correct or delete your personal data.
• Withdraw consent where that is the basis for processing.

We handle these requests and any additional rights under the law applicable to you. Deletion may be limited by legal retention duties or records needed for an unresolved dispute.

Write to support@substrates.in. We may need to verify your identity or authority before disclosing or changing data.

We aim to respond within 30 days and comply with any applicable statutory deadline. We explain if a request cannot be fulfilled in full. You may raise a complaint with a competent authority where that route is available under applicable law.

If your data was submitted by a Viveka customer, contact that organisation first: it controls the purpose of the request and may hold the original data. We assist with requests relating to information we actually hold. Disabling an API key does not delete copies held by the customer’s own application.

Children

Viveka accounts and API access are intended for adults, not children under 18. We do not knowingly collect children’s data to create accounts. If you believe a child has provided account or contact data, tell us so we can investigate and remove it where appropriate. Customers are responsible for any additional legal requirements before submitting data about children.

Changes to this policy

We publish the effective date and change history with this policy. We give notice of material changes as required by applicable law. If we propose a new use that needs consent, we ask for it separately before starting that use. Updating this policy does not enrol API content into training.