Your data, handled with care

This policy covers both products operated by the same team: VayuTransfer (prepaid file transfer at vayutransfer.com) and VayuStudios (photo gallery delivery for photographers at vayustudios.com). Wherever a section applies to only one product, it says so explicitly.

VayuTransfer

• Name, email, and profile photo from Google OAuth (if you sign in)
• Transfer metadata: file name, size, expiry time, download limit — we never read or analyse file contents
• Wallet balance and transaction history

VayuStudios

• Studio admin: name, email, phone, password (hashed, never stored in plain text)
• Client/event details entered by the studio admin: client name, email, phone, event type and date
• Photos you upload — both watermarked previews and original full-resolution files
• Booking enquiries submitted through a studio's public website (name, email, phone, event details, message)
• Face vectors generated by AWS Rekognition when Selfie Search is enabled (see Section 4)

• To create and manage your wallet, studio account, or client gallery access
• To process file transfers, photo uploads, and generate secure shareable links
• To send transactional emails: download links, booking notifications, selection updates, and account status changes
• To maintain a security audit log and prevent fraud
• To power the VayuStudios AI chat assistant (AWS Bedrock) — conversations are used only to answer your question, not for training or advertising

When a studio enables Selfie Search, we use AWS Rekognition to index faces in that studio's uploaded photos and match them against a selfie a client or guest submits.

• Face data is indexed per project — it is never compared across different studios or different clients' events
• We do not use face data for identification outside the gallery it was created for, and never share it with third parties beyond the AWS service that powers the match
• Deleting a project or a studio account permanently deletes its associated face index
• Studio admins are responsible for obtaining consent from clients and guests before enabling face search for an event — see Terms of Service, Section 5

Files and photos are stored on Amazon S3 (ap-south-1 — Mumbai) with server-side encryption. Watermarked preview images are additionally cached on Cloudflare R2 for fast gallery loading. Structured data (wallets, projects, users, bookings) is stored on Amazon DynamoDB, also in Mumbai. All traffic between your browser and our servers is encrypted with TLS.

We do not sell, rent, or share your personal data for marketing. We use the following services to operate the platform:

• Amazon Web Services — S3, DynamoDB, SES (email), Rekognition (face search), Bedrock (AI chat)
• Cloudflare R2 — CDN caching for watermarked photo previews
• Google OAuth — authentication only, for VayuTransfer sign-in
• Razorpay — PCI-DSS compliant payment processing; we never see or store your card details
• Vercel — web application hosting

Each client gallery is private and accessible only via a unique secure link, verified with a one-time password (OTP) sent to the client's phone or a magic link sent to their email. Clients cannot see or search other clients' galleries. Download activity is logged with a hashed (SHA-256) IP address for security — never the raw IP, and never linked to identity unless the downloader is a registered user.

We use a single secure, HTTP-only session cookie to keep you signed in — on VayuTransfer (wallet/login session) and VayuStudios (studio admin or client gallery session). We do not use advertising or cross-site tracking cookies.

• VayuTransfer files are deleted automatically when their transfer link expires (default: 24 hours)
• VayuStudios galleries remain accessible until the studio admin closes the project or their account
• If a studio account is suspended or deleted by the platform, the studio admin is notified by email; on deletion, all associated projects, photos, and face-index data are permanently removed
• Wallet transaction records are retained for up to 7 years for financial compliance

You may request a copy or deletion of your account and associated data at any time by emailing support@vayutransfer.com. Financial records may be retained longer where required by law.

VayuStudios is used to deliver event photography that may include minors (e.g. birthdays, school events, family functions). The studio admin uploading such photos is responsible for having appropriate consent from parents or guardians. We do not knowingly collect account registrations from children — studio admin and client accounts are intended for adults.

Questions about this policy? Email support@vayutransfer.com or reach us on WhatsApp.