Privacy policy
How VLR Nordic Private Limited collects, uses, stores and protects personal data in Postvik, our AI social-media service, and the rights you hold over your data.
Who we are
This service is operated by VLR Nordic Private Limited ("VLR Nordic", "we", "us"), a company incorporated in India (CIN U62013AP2026PTC125976), with its registered office in Guntur, Andhra Pradesh, India. For the personal data described here, VLR Nordic acts as the data fiduciary (the entity that decides how and why your data is processed) under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").
Postvik is our AI social-media manager. A client sends photos, clips and requests in the Postvik chat on Telegram, or photos and requests on the Postvik dashboard; our system writes captions and makes posts and reels, the client approves each one, and Postvik then publishes it to the social accounts the client has authorised.
Questions about this policy or your data go to info@vlrnordic.com.
What this policy covers
This policy covers the personal data we handle when you use Postvik as a client, and data we collect through this website, postvik.app. Where we act only as a processor on a client's behalf (for example, handling content that a client's own customers appear in), the client is the fiduciary for that data and their own privacy notice also applies.
What we collect
To run the service, we collect and store:
- Photos, images and video clips you send for use in your posts and reels.
- Post text: captions, drafts, briefs, and the messages you send us.
- Your Telegram identity: your Telegram user ID and display name, used to recognise you and route your jobs. For a Telegram group linked to Postvik, the names and messages of the people who write in it.
- Google sign-in details: your Google email and account ID, if you sign in to the dashboard with Google.
- Job history: a record of the posts we've drafted, edited, and published for you.
- Comments on your posts, when you ask us to read them.
- Brand notes: the notes you give us about your voice, colours and industry, kept so later captions use them.
- Contact and account details you give us to set up and support your account (such as name, email, and the social accounts you connect).
- Server logs: when you visit postvik.app or the dashboard, our server records your IP address, browser and the page you asked for, and deletes them after about 14 days.
We do not intentionally collect sensitive personal data (such as health, financial, or biometric data). Please don't send it to us through Postvik.
How we use it
We use your data only to provide and improve the service you've hired us for:
- To write captions and make posts and reels from what you send.
- To publish approved posts to the platforms you've authorised.
- To keep the brand notes you give us and use them in later captions.
- To operate, support, secure, and bill for the service.
We do not sell your personal data, and we do not use your photos, captions, or brand notes to train models we offer to other clients.
Consent and legal basis
Under the DPDP Act, we process your personal data for one of two reasons: you consented to it, or you gave it to us yourself so we could provide the service you asked for, and you haven't told us to stop (a "legitimate use" under section 7(a) of the Act). By using Postvik you consent to the processing described here. You can withdraw consent at any time by contacting us, after which we'll stop processing your data and, on request, delete it (see Your rights and our data deletion page). Withdrawing consent doesn't affect processing we already did lawfully, and it may mean we can no longer provide the service.
Where your data is stored
Your data is stored on a server we operate, hosted with Hetzner in Finland. Reel clips are held with Cloudflare while a reel is made and deleted 14 days after it is finished; the machines that read and render reels run at RunPod (so far in the United States and Europe); we keep backups on our server in Finland and on our own computer in India.
If you are in India, this means your personal data is mostly stored outside India. The DPDP Act permits transferring personal data abroad except to countries the Government of India specifically restricts; Finland is not restricted. We disclose this transfer to you here: your data is stored in Finland, with backup copies in India, and processed in Europe, the United States and the other countries our providers work from.
Your rights
India's DPDP Act gives you these rights as a data principal. They take legal effect on 13 May 2027, and we honour them now:
- Access: get a summary of the personal data we hold about you, how we process it, and who we have shared it with.
- Correction: have inaccurate or incomplete data corrected or updated.
- Erasure: have your personal data deleted when it's no longer needed or you withdraw consent, unless the law requires us to keep it.
- Withdraw consent: as easily as you gave it.
- Grievance redressal: raise a complaint with us and get a response.
- Nominate: nominate someone to exercise your rights if you die or become incapacitated.
To exercise any of these, email info@vlrnordic.com. For deletion specifically, follow the steps on our data deletion page. From 13 May 2027, if you're not satisfied with our answer to a complaint, you can also take it to the Data Protection Board of India, which takes complaints online.
How long we keep it
We keep your data for as long as you're an active Postvik client, and for up to 90 days after our engagement ends (so your account can be reactivated and any handover completed). After that we delete it. You can ask us to delete your data sooner at any time; we action deletion requests within 30 days (see data deletion).
We may retain a limited set of records for longer where the law requires it, for example invoices and tax records kept to meet accounting and statutory obligations.
How we protect it
We take reasonable technical and organisational measures to protect your data: access to the server is restricted and authenticated, data in transit is encrypted (HTTPS/TLS), and platform credentials and API keys are kept in access-controlled configuration, never in public code. No system is perfectly secure, but we work to limit who can reach your data and what a single failure could expose, and we'll notify you and the relevant authority of a personal-data breach as required by law.
Children
Postvik is a business tool and is not directed at children. We don't knowingly process the personal data of anyone under 18 without verifiable parental or guardian consent. If you believe a child's data has reached us, contact info@vlrnordic.com and we'll delete it.
Changes to this policy
We may update this policy as the service and the law evolve. When we do, we'll change the date at the top of the page and, for material changes, tell active clients directly. This version was last updated 23 October 2026.
Contact and grievances
For any privacy question, request, or complaint, contact us. We acknowledge within 48 hours and resolve within 30 days.
- Email: info@vlrnordic.com
- Company: VLR Nordic Private Limited, registered in Guntur, Andhra Pradesh, India (CIN U62013AP2026PTC125976)
Want your data removed? One email does it, and we act within 30 days. Here's exactly how it works.
Data deletion instructions