Legal

Privacy Policy

SARVARC Workspace · Effective 14 October 2026 · Last updated 14 October 2026

Operated by: SARVARC, an MSME-registered proprietorship (Udyam Registration No. UDYAM-GJ-01-0682251), Ahmedabad, Gujarat, India. Website: https://sarvarc.com. Contact: contact@sarvarc.com

1. Who we are and what this policy covers

SARVARC Workspace ("SARVARC", "we", "us", "our") is a browser-based productivity platform that includes a PDF Editor, Data Arrangement, Make Forms, Diagrams & Graphs, Redaction, Showcase, Presenter, Business Proposals, SARVARC Sign, team collaboration, and our AI assistant Kadessa (together, the "Service").

This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what choices and rights you have. It applies to everyone who visits sarvarc.com, creates an account, uses the Service, or fills in a form that someone else created with Make Forms.

By using the Service you confirm that you have read this policy. Where the law requires consent, we ask for it separately and you can withdraw it at any time (see Section 11).

2. The short version

  • Much of the work you do (editing a PDF, arranging data, drawing a chart) happens inside your own browser and is stored on your own device.
  • That does not mean nothing ever leaves your device. Some features send data to our servers or to service providers: signing in, cloud sync to your Google Drive, published forms and their responses, team collaboration, the Kadessa AI assistant, feedback, payments, and analytics. Section 4 lists every one of them.
  • We do not sell your personal data. We do not show third-party ads.
  • We do not use the content of your files to train AI models, and we do not permit our AI providers to do so on our behalf.
  • You can access, correct, export, and delete your data. Section 11 explains how.

3. Roles: who is responsible for what

For account holders and visitors, SARVARC decides why and how your data is processed. Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") we act as the Data Fiduciary, and under the GDPR as the controller.

For form respondents, the person or business that creates and publishes a form (the "Form Owner") decides what to ask and why. The Form Owner is responsible for having a lawful basis to collect those answers and for telling respondents how they will be used. SARVARC stores and delivers the responses on the Form Owner's behalf as a processor. If you filled in a form and want your answers corrected or deleted, contact the Form Owner first. You may also contact us and we will help route the request.

For your own content (files, data sets, designs, proposals, text you type to Kadessa), you remain the owner. If that content contains other people's personal data, you are responsible for having the right to use it in the Service.

4. What we collect, and why

4.1 Account and profile data

When you sign in with email or Google we collect your email address, your name, your business name (if you enter one), your profile picture (taken from your Google account if you use Google sign-in), and a unique account ID. We use this to create and secure your account, show your name and avatar, and identify you to teammates you invite.

Authentication is provided by Supabase. Your browser keeps a session token so you stay signed in.

4.2 Google Drive sync (optional)

If you sign in with Google and use cloud sync, we ask for the Google Drive drive.file permission. This is a limited permission: it only lets SARVARC create and access files that SARVARC itself created or that you open with SARVARC. It does not give us access to the rest of your Drive.

With this permission SARVARC saves your sessions and assets as files inside a SARVARC folder in your own Google Drive. Those files live in your Google account, not on our servers. Your browser stores a temporary Google access token (and its expiry time) so sync can work. You can revoke access at any time at https://myaccount.google.com/permissions.

SARVARC's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4.3 Content you work on

Files you open in the PDF Editor, Data Arrangement, Redaction, Diagrams & Graphs, Showcase and other tools are processed in your browser. Saved sessions, assets, brand kits, signatures, and form drafts are stored locally in your browser (localStorage and IndexedDB) and, if you enable Drive sync, in your Google Drive.

Local storage means the data stays on that device and browser. If you clear your browser data, or use a private window, it can be lost. We cannot recover data that exists only on your device.

4.4 Make Forms (published forms and responses)

When you publish a form, we store the form definition and its settings in our database. When someone submits a published form, we store the submission, which can include:

  • the answers they typed or selected,
  • their name and email address if the form asks for them,
  • signatures they draw, type, or upload (stored as image or PDF data),
  • files they attach.

Respondents open forms on a separate page (sarvarc-forms.pages.dev), delivered through Cloudflare. Only the Form Owner (and teammates the Form Owner shares the form with) can read the responses. Form Owners can delete forms and responses at any time.

4.5 Teams and live collaboration

If you create or join a team, we store the team, its members, invitations, and shared projects. During live co-editing, your edits and presence information (such as your cursor and name) are relayed between teammates in real time through Supabase Realtime. Teammates you invite can see the content of shared projects and your name and avatar.

4.6 Kadessa, our AI assistant

When you chat with Kadessa, the following is sent from your browser to our backend (a Cloudflare Worker) and then on to our AI provider, OpenAI, to produce a reply:

  • the messages you type,
  • context about what you are working on, such as which tool is open, column headers, row counts, and a sample of rows from the data set you are using,
  • a compressed screenshot of your chart, diagram, or PDF page when you use a feature that lets Kadessa see it,
  • images or documents (for example Word files) that you attach in the chat,
  • your sign-in token, so we can confirm who is asking and enforce usage limits.

We also record how many Kadessa messages you send each day to apply fair-use limits.

Kadessa only receives data when you use it. Please do not paste or attach information you are not allowed to share, and avoid sending highly sensitive data (such as government ID numbers, payment card numbers, or health records) to Kadessa. AI replies can be wrong, so check them before relying on them.

4.7 Feedback

If you submit quick feedback, we store your ratings, comments, the tool you were using, your browser's user-agent string, the time, and your account ID.

4.8 Payments and donations

At this stage, payments are mainly voluntary contributions that support SARVARC's development. Payments are processed by Razorpay. Donations are processed by Ko-fi. We do not see or store your full card, UPI PIN, or bank credentials; those go directly to the payment provider. We keep a record of your plan, entitlement status, and transaction references so we can give you access and handle refunds, tax, and disputes.

4.9 Analytics and technical data

We use Google Analytics to understand how the Service is used (pages and features visited, device and browser type, approximate location from IP address, and similar usage data). Google Analytics uses cookies or similar identifiers. You can block them with browser settings or Google's opt-out add-on.

Our hosting and security providers (such as Cloudflare and Supabase) automatically process technical data like IP address, request time, and error logs to deliver the Service, prevent abuse, and keep it secure.

4.10 Other features that contact third parties

Some features call outside services only when you use them:

  • Stock images: your search words are sent through our proxy to Pexels.
  • Translation: the short piece of text you choose to translate (up to about 490 characters at a time) is sent to MyMemory.
  • Currency rates: a request to Frankfurter (European Central Bank data). No personal content is sent.
  • Maps and boundaries: map tiles from CARTO and OpenStreetMap and boundary data from geoBoundaries are requested by your browser, so those services see your IP address.
  • Code libraries and fonts: the Service loads open-source libraries and fonts from CDNs (jsDelivr, unpkg, cdnjs, esm.sh, Google Fonts), which see your IP address when your browser fetches them.

These providers have their own privacy policies and we do not control them.

4.11 What we do not collect

We do not use your microphone or camera, and we do not collect your precise location. We do not knowingly collect data from children (Section 12).

5. Why we use your data (purposes)

  • to provide, maintain, and secure the Service and your account;
  • to sync your work, deliver published forms, and enable teams and live collaboration;
  • to power Kadessa and enforce usage limits;
  • to process payments and manage plans;
  • to respond to support requests and feedback;
  • to understand usage and improve the product;
  • to detect and prevent fraud, abuse, and security incidents;
  • to comply with law and enforce our Terms of Service.

We use your data only for these purposes, or for another purpose that is compatible with them, or after asking for your consent.

6. Legal bases

  • India (DPDP Act): your consent, and the limited "legitimate uses" the Act allows (such as performing what you asked us to do, legal compliance, and responding to emergencies).
  • EU/UK users (GDPR): performance of a contract, your consent, our legitimate interests (security, improving the Service, preventing abuse), and legal obligation.

7. Who we share data with

We do not sell your personal data. We share it only as follows:

Recipient Purpose
Supabase Database, authentication, realtime collaboration
Cloudflare Hosting, Workers backend, security, delivery
OpenAI Generating Kadessa replies
Google Sign-in, Drive sync, Analytics, Fonts
Razorpay, Ko-fi Payments and donations
Pexels, MyMemory, Frankfurter, CARTO, OpenStreetMap, geoBoundaries, CDN providers Only the features described in Section 4.10
Your teammates and Form Owners As you configure in teams and forms
Professional advisers (lawyers, auditors, accountants) Under confidentiality duties
Authorities Where required by law, court order, or to protect rights and safety
A buyer or successor If SARVARC is merged, sold, or restructured, with the same protections for your data

We require service providers to protect data and use it only to provide services to us.

8. International transfers

Our providers operate data centres in several countries, so your data may be processed outside India (including the United States and the EU). We transfer data only to the extent permitted by the DPDP Act and applicable law, and for EU/UK users we rely on appropriate safeguards such as standard contractual clauses where required.

9. How long we keep data

Data Retention
Account and profile Until you request deletion of your account
Published forms and responses Until the Form Owner deletes them or the account is deleted
Team data Until the team or project is deleted, or you leave
Kadessa usage counters Kept while your account is active
Feedback Up to 12 months, or until you ask us to delete it
Payment records As long as tax and accounting laws require (generally up to 8 years)
Analytics According to Google Analytics settings (14 months)
Backups and logs Up to 30 days after deletion, then overwritten

Data stored locally in your browser or in your own Google Drive is under your control. Deleting your SARVARC account does not automatically delete files already saved in your Google Drive. Delete those from Drive yourself.

We may keep limited data longer where needed for legal claims, fraud prevention, or legal compliance.

10. Security

We use measures that are reasonable for a service of our size, including HTTPS encryption in transit, row-level security on our database so users can only reach their own records, restricted allowed origins and rate limiting on our backend, server-side verification of sign-in tokens, and keeping AI instructions and secrets on the server rather than in your browser.

No system is completely secure. We cannot guarantee absolute security, and you use the Service at your own risk in that respect. Please protect your account: use a strong password, keep your devices updated, and sign out on shared computers. Local browser storage is only as safe as the device it sits on.

Redaction tool notice: the Redaction tool is designed to help you remove sensitive content from documents. You are responsible for checking the final output (including hidden text, metadata, and earlier versions) before sharing it. SARVARC does not guarantee that a redacted file is free of all sensitive information.

Data breaches: if a personal data breach affects you, we will notify you and the relevant authorities (including the Data Protection Board of India and, where applicable, EU/UK supervisory authorities) as required by law.

11. Your rights and choices

Subject to applicable law, you can:

  • Access a summary of the personal data we hold about you and who we shared it with;
  • Correct inaccurate or incomplete data (you can edit your name and business name in the app);
  • Erase your data by emailing contact@sarvarc.com to request deletion of your account (an in-app delete button is not available yet), and we will complete it within 30 days;
  • Withdraw consent at any time (for example, stop using Kadessa, disconnect Google Drive, or opt out of analytics). Withdrawing does not affect processing done before, and some features may stop working;
  • Grievance redressal: raise a complaint with us (Section 14);
  • Nominate another person to exercise your rights if you die or become incapacitated (DPDP Act);
  • If you are in the EU/UK: also object to or restrict processing, ask for data portability, and complain to your local supervisory authority.

To use any right, email contact@sarvarc.com from your registered email. We may ask you to verify your identity. We aim to respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is operational.

12. Children

The Service is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data without verifiable parental consent, email us and we will delete it. If you are a Form Owner, do not use forms to collect data from children unless you have verifiable parental consent as the law requires.

13. Cookies and similar technologies

We use:

  • Essential storage: login session tokens, your theme, last section, saved sessions, and form data in localStorage and IndexedDB. The Service cannot work without them.
  • Analytics cookies: Google Analytics.
  • Third-party content: services in Section 4.10 may set their own cookies.

You can clear or block cookies and local storage in your browser. Blocking essential storage will break parts of the Service.

14. Grievance Officer and contact

Grievance Officer / Data Protection contact: Prayag Pathak, Proprietor and Founder
Email: contact@sarvarc.com
Address: Ahmedabad, Gujarat, India

We acknowledge complaints within 48 hours and aim to resolve them within 15 days.

15. Your responsibilities

You agree that you will:

  • only upload, process, or share personal data you have the legal right to use;
  • get any consents or give any notices needed when you use the Service with other people's data, including data you collect through forms or send to Kadessa;
  • not use the Service for anything unlawful or to collect sensitive data without proper safeguards;
  • keep your login details confidential and tell us promptly about suspected unauthorised access.

You are responsible for the content you create, store, publish, and share through the Service.

16. Third-party services and links

The Service links to and relies on third parties. We are not responsible for their content, security, or privacy practices. Your use of them is governed by their own terms and policies. AI outputs are generated automatically and may be inaccurate, incomplete, or similar to outputs given to others. You should review them before use.

17. Disclaimers and limits of liability

To the fullest extent permitted by law:

  • the Service and this policy are provided "as is" and "as available" without warranties of any kind;
  • we are not liable for loss of data stored only in your browser or device, for loss caused by clearing browser data, by device failure, or by third-party outages (including Google, Supabase, Cloudflare, OpenAI, and Razorpay);
  • we are not liable for unauthorised access that results from your own failure to keep credentials secure, or from the act of third parties we could not reasonably prevent;
  • we are not liable for indirect, incidental, special, consequential, or punitive damages, or loss of profits, revenue, goodwill, or data;
  • our total liability for any claim relating to this policy or your data is limited to the amount you paid us in the 12 months before the claim, or INR 10,000 if you paid nothing.

Nothing in this policy excludes liability that cannot be excluded by law, and nothing limits your statutory rights under applicable data protection law.

The Terms of Service, which you should read together with this policy, contain further terms on acceptable use, intellectual property, subscriptions, refunds, and dispute resolution. If the two documents conflict on how personal data is handled, this policy prevails.

18. Changes to this policy

We may update this policy as the Service changes (for example, when new features launch or new providers are added). We will update the "Last updated" date and, for material changes, notify you in the app or by email before they take effect. Continued use after the effective date means you accept the updated policy, except where the law requires fresh consent, in which case we will ask for it.

19. Governing law and disputes

This policy is governed by the laws of India. Subject to any mandatory rights you have where you live, the courts at Ahmedabad, Gujarat, India have exclusive jurisdiction over disputes arising from it. We encourage you to contact us first so we can try to resolve any concern informally.

20. Contact

Questions about this policy: contact@sarvarc.com
SARVARC, Ahmedabad, Gujarat, India

Also read: Terms of Service · Refund and Cancellation Policy

← Back to SARVARC