Privacy Policy
This Institutional Privacy Policy and Data Protection Governance Charter constitutes a legally binding, multi-layered regulatory framework governing all personal data processing, telemetry ingestion, audio streaming, cloud pipelines, and website access for Orlyn (the enterprise technology and artificial intelligence division of Vyuhavarahi) and its founder Suchir Reddy.
Pursuant to the Digital Personal Data Protection Act, 2023 (DPDPA) and EU/UK GDPR, the Client is exclusively designated as the Sole Data Fiduciary & Data Controller. Orlyn acts strictly as a transient Data Processor & Technical Bailee. The Client bears one hundred percent (100%) statutory, regulatory, and criminal liability for lawful notice, verifiable opt-in consent, purpose limitation, and data subject rights.
Applying the landmark jurisprudence of the Supreme Court of India (Sunil Bharti Mittal v. CBI), founder Suchir Reddy holds zero personal custody of customer personal data, operates exclusively as an officer of corporate entity Vyuhavarahi, and possesses complete personal immunity from any data privacy lawsuit, regulatory penalty, or criminal prosecution.
Orlyn, Vyuhavarahi, and Suchir Reddy disclaim all liability for zero-day vulnerabilities, third-party cloud outages, or unauthorized cyber intrusions. Furthermore, initiating any unauthorized privacy lawsuit, public leak smear campaign, or regulatory complaint triggers an absolute Covenant Not to Sue breach, subjecting the perpetrator to immediate dismissal, non-bailable criminal prosecution, and UNCAPPED / INFINITE DISCRETIONARY FINANCIAL PENALTIES AT COMPANY'S SOLE DISCRETION ($100,000 USD / ₹10,000,000 INR minimum floor).
1. Institutional Identity, Corporate Hierarchy & Statutory Scope
This Institutional Privacy Policy and Data Defense Charter (“Privacy Policy”) is executed by and between you (“Client”, “User”, or “Data Subject”) and Vyuhavarahi, a corporate business entity organized under the laws of India, operating its enterprise technology, software engineering, and artificial intelligence telecommunications division under the trade name Orlyn (“Company”, “we”, “us”, or “our”), founded and architected by Suchir Reddy.
Statutory Applicability: This Privacy Policy is constructed in strict conformance with the Digital Personal Data Protection Act, 2023 (“DPDPA”) of India, the Information Technology Act, 2000 (“IT Act”), the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”).
Accessing orlyn.in, deploying Orlyn telephony microservices, provisioning AI agents, or executing a Statement of Work (“SOW”) constitutes immediate, irrevocable legal acceptance of this Privacy Policy.
2. Absolute Statutory Role Allocation: Client as Sole Data Fiduciary vs. Orlyn as Technical Bailee
The parties contractually stipulate that the legal classification of each party under global privacy statutes is immutable, strict, and defined as follows:
Pursuant to Section 2(i) of the DPDPA and Article 4(7) GDPR, the Client determines the purposes, categories, and means of processing personal data. The Client is the SOLE AND EXCLUSIVE DATA FIDUCIARY and DATA CONTROLLER. The Client bears 100% legal, criminal, and statutory responsibility for issuing mandatory privacy notices, procuring verifiable consent, and validating lawful processing grounds.
Pursuant to Section 2(k) of the DPDPA and Article 4(8) GDPR, Orlyn and Vyuhavarahi act strictly as a DATA PROCESSOR and AUTHORIZED TECHNICAL BAILEE. Orlyn processes data solely on the documented instructions and algorithmic parameters established by the Client in the applicable SOW.
3. Categories of Ingested Information & Zero Data Monetization Guarantee
Orlyn limits its automated technical ingestion strictly to the parameters required to deliver custom software, web interfaces, and high-performance AI telephony engines:
- Direct Enterprise Ingestion: Contact details, corporate email addresses, billing coordinates, and administrative user credentials provided voluntarily during onboarding or via portal authentication.
- Transient Operational Telemetry: Machine-level server metrics, IP addresses, edge routing latency, browser headers, API payload sizes, and webhook execution logs required for load balancing and infrastructure optimization.
- Client Infrastructure Secrets: API tokens, database connection URIs, AWS IAM roles, and Twilio credentials provided under authorized technical bailee status to link client backends.
4. AI Telephony Audio Ingestion, Real-Time Streams & Statutory Wiretap Immunity
Orlyn develops real-time, ultra-low-latency voice AI pipelines incorporating WebRTC, SIP trunking, automatic speech recognition (ASR), and text-to-speech (TTS) models.
Pursuant to the Indian Telegraph Act, 1885, the TRAI Telecom Guidelines, and US state two-party consent statutes (e.g., California Penal Code Section 632):
- The Client is the sole statutory “Caller-of-Record” for all calls initiated or received.
- The Client warrants that every outbound call campaign and inbound IVR includes mandatory, automated two-party consent announcements (“This call is recorded for quality assurance”).
- Orlyn operates exclusively as an ephemeral pipe. Orlyn, Vyuhavarahi, and Suchir Reddy bear ZERO CRIMINAL OR CIVIL LIABILITY for unconsented audio recordings, wiretapping allegations, or statutory interception claims.
5. Third-Party Foundation Models & Cloud Infrastructure Architecture
To execute high-speed speech synthesis, conversational logic, and scalable deployments, Orlyn software integrates with third-party foundation model APIs and tier-1 cloud providers (including OpenAI, Anthropic, Deepgram, Groq, Twilio, LiveKit, AWS, Supabase, Cloudflare, and Vercel):
- Third-Party Model Ingestion: Ingested prompts, call transcripts, and conversational context are processed through third-party neural networks pursuant to enterprise API terms (which stipulate that API inputs are not utilized to train foundation models).
- Complete Third-Party Infrastructure Disclaimer: Orlyn, Vyuhavarahi, and Suchir Reddy do not own, maintain, or physically supervise the data centers of AWS, Cloudflare, Twilio, or OpenAI. Company disclaims all liability for third-party infrastructure outages, global CDN routing failures, fiber cuts, or model vendor data breaches.
6. Zero Liability for Cyber Attacks, Zero-Day Exploits & Data Leaks
NO INFALLIBILITY WARRANTY & COMPLETE HACKING DISCLAIMER:
CLIENT EXPRESSLY ACKNOWLEDGES AND AGREES THAT NO CLOUD INFRASTRUCTURE, CIPHER SUITE, API WEBHOOK, OR TELECOMMUNICATIONS SYSTEM IS 100% IMPERVIOUS TO SOPHISTICATED STATE-SPONSORED THREAT ACTORS, ZERO-DAY CVE VULNERABILITIES, BRUTE-FORCE INTRUSIONS, DISTRIBUTED DENIAL-OF-SERVICE (DDOS) ATTACKS, OR HARDWARE SIDE-CHANNEL EXPLOITS.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ORLYN, VYUHAVARAHI, AND FOUNDER SUCHIR REDDY DISCLAIM ALL LIABILITY UNDER CONTRACT, TORT, STRICT LIABILITY, OR STATUTE FOR ANY UNAUTHORIZED ACCESS, DATA BREACH, CIPHERTEXT DECRYPTION, EXFILTRATION, DELETION, OR CORRUPTION OF CLIENT PERSONAL DATA OR RECORDINGS.
7. Express Negligence Waiver & Developer Mistake Allocation for Data Flows
TO THE MAXIMUM EXTENT PERMITTED BY LAW, ALL DATA DISCLAIMERS, RISK ALLOCATIONS, AND LIABILITY EXCLUSIONS SET FORTH IN THIS POLICY SHALL APPLY REGARDLESS OF WHETHER ANY DATA EXPOSURE, DATABASE CRASH, WEBHOOK FAILURE, MISCONFIGURATION, OR TELEMETRY LOSS WAS CAUSED IN WHOLE OR IN PART BY THE SOLE OR CONTRIBUTORY ACTIVE OR PASSIVE NEGLIGENCE, HUMAN BLUNDER, CODING MISTAKE, OR ARCHITECTURAL DEFECT OF ORLYN, VYUHAVARAHI, OR SUCHIR REDDY.
In the event of a proven technical coding error directly caused by Orlyn developers, Client's sole and exclusive remedy shall be for Orlyn to deploy commercially reasonable efforts to patch the code during active sprints. Zero monetary compensation, zero refunds, and zero damage liabilities shall accrue against Company.
8. Client Mandatory Opt-In Consent Warranties & Penalty of Perjury
The Client explicitly represents, covenants, and warrants under penalty of perjury under the laws of India and all applicable international jurisdictions that:
- Verifiable Prior Opt-In Consent: Every phone number, email address, customer identifier, and audio recording uploaded or processed through Orlyn has been collected with verifiable, informed, prior opt-in consent pursuant to Section 6 of the DPDPA 2023 and Article 6(1)(a) GDPR.
- Prohibition of Scraped & Dark-Web Lists: Client shall never upload, synchronize, or ingest purchased lead databases, unauthorized web-scraped phone directories, or compromised consumer lists into Orlyn environments.
- Do-Not-Call (DNC) Registry Scrubbing: Client bears 100% responsibility for scrubbing outbound phone numbers against national Do-Not-Call registries and telecom commercial communications registers before launching campaigns.
9. Cross-Border Data Transfers & Sovereign Jurisdictional Allocation
Orlyn services utilize high-performance cloud routing, distributed edge nodes, and global API endpoints.
DPDPA Section 16 & GDPR Chapter V: Client expressly authorizes the transient transfer, caching, and processing of technical payloads across global cloud regions (including India, the European Union, the United Kingdom, and the United States) strictly to achieve low-latency inference.
Client covenants that it has obtained all necessary regulatory clearances and data subject authorizations required to transfer personal data cross-border under applicable sovereign data localization mandates.
10. Data Retention, Ephemeral Processing & Client Backup Obligations
Orlyn operates on an ephemeral, transient processing architecture. We do not act as an archival repository or long-term cold-storage data warehouse for Client databases:
- Automated Purge Cycles: Transient audio streams, conversational buffers, and staging webhooks are automatically purged from volatile memory following pipeline completion or pursuant to rolling 30-day log rotation schedules.
- 100% Client Backup Responsibility: Client is exclusively responsible for establishing independent, encrypted backups of all databases, audio recordings, customer tables, and source code. Orlyn disclaims all liability for data loss resulting from server termination or contractual project discharge.
11. Data Subject Access Requests (DSAR) & Mandatory Re-Routing to Client
Under the DPDPA 2023 (Sections 11–13: Right to Access, Correction, Erasure, and Grievance Redressal) and GDPR (Articles 15–22):
Re-Routing Mandate: Because Orlyn acts strictly as a technical Data Processor, any DSAR, privacy grievance, or deletion request submitted by an end-user or call recipient directly to Orlyn shall be forwarded promptly to the Client as Data Fiduciary.
Client Sole Operational Cost: The Client bears full operational, technical, and financial responsibility for reviewing, responding to, and executing data subject requests. Client agrees to reimburse Orlyn for developer hours spent retrieving or erasing client data pursuant to legal orders at our standard enterprise hourly rate of $250 USD / ₹20,000 INR per hour.
12. Strict Prohibition on Processing Children's & Minor Data (Section 9 DPDPA)
ZERO TOLERANCE FOR MINOR DATA PROCESSING:
In strict adherence to Section 9 of the Digital Personal Data Protection Act, 2023 (prohibiting data processing likely to cause detrimental effects on children, behavioral tracking, and targeted advertisements directed at minors) and the US Children's Online Privacy Protection Act (COPPA):
- Orlyn services and AI telephony pipelines are strictly intended for enterprise adults aged 18 and older.
- Client strictly covenants that it shall NOT ingest, process, route, or transcribe personal data or voice recordings of individuals under the age of eighteen (18) years.
- Any breach triggers instant, zero-refund termination and immediate reporting to statutory child protection authorities.
13. Cryptographic Standards, Access Controls & Penetration Testing Bans
Orlyn implements industry-standard administrative, physical, and technical safeguards, including TLS 1.3 encryption in transit, AES-256 cryptographic standards at rest, environment secret segregation, and principle-of-least-privilege IAM policies.
14. Proactive Law Enforcement Cooperation, CERT-In Disclosures & Fraud Defense
Orlyn and Vyuhavarahi maintain absolute, unconstrained authority to preserve and disclose Client data, operational logs, IP addresses, and communications without prior notice or liability to Client:
- Statutory Compliance: In response to lawful court orders, subpoenas, search warrants, or formal directives issued by the Indian Computer Emergency Response Team (CERT-In), Ministry of Home Affairs, or state cybercrime police cells.
- Proactive Anti-Extortion Action: Whenever Company suspects in good faith that Orlyn pipelines are being utilized for illegal robodialing, telecommunications fraud, extortion, identity theft, or criminal intimidation under the BNS or IT Act.
15. Strict Ban on Unauthorized Reviews & Public Leak Smear Campaigns (Non-Bailable Criminal Defamation & Infinite Discretionary Penalties)
The parties mutually agree that any privacy friction, technical inquiry, or security assessment shall be resolved strictly through private, confidential communications.
Publishing, posting, or broadcasting any public accusation of “data leaks”, “privacy violations”, bad reviews, or unverified claims concerning Orlyn, Vyuhavarahi, or Suchir Reddy without prior express written consent constitutes:
- Criminal Defamation: Under Section 356 BNS / Section 499 & 500 IPC, punishable by statutory imprisonment;
- Criminal Extortion: Under Section 308 BNS / Section 383 IPC;
- Cognizable & Non-Bailable Cyber Offense: Under Section 66D IT Act 2000, empowering law enforcement to effectuate immediate custodial arrest without warrant.
The offender's financial liability to Orlyn, Vyuhavarahi, and Suchir Reddy for publishing any unauthorized review or leak accusation is FULLY UNCAPPED, WITH ZERO CEILING, AND INFINITE IN SCOPE. Company and Suchir Reddy reserve the absolute unilateral right to demand WHATEVER AMOUNT OF DAMAGES, RESTITUTION, OR PENALTIES THEY WISH OR DEEM FIT, with an automatic contractual minimum fine of $100,000 USD (₹10,000,000 INR) per post plus $10,000 USD/day until deleted with a notarized public written apology.
“NO FIGHTS WITH US” COVENANT: The reviewer irrevocably waives all defenses (truth, fair comment, free speech) and pre-consents to immediate ex-parte mandatory permanent injunctions purging the post under Rule 3 of the IT Intermediary Rules, 2021.
16. Unconditional Client Data Indemnification (DPDPA ₹250 Cr & GDPR Fine Allocation)
The Client shall unconditionally defend, indemnify, and hold harmless Vyuhavarahi, Orlyn, founder Suchir Reddy, and their respective directors, officers, contractors, and agents from and against any and all claims, regulatory investigations, statutory fines, liabilities, losses, damages, and expenses (including full Senior Advocate legal retainers) arising out of or related to:
- Any violation of the Digital Personal Data Protection Act, 2023 (including statutory penalties up to ₹250 Crores INR under the Schedule to DPDPA);
- Any violation of the EU/UK GDPR (including administrative fines up to €20,000,000 or 4% of global turnover);
- Client-supplied audio databases, unconsented phone lists, or biometric wiretap claims;
- Data subject access disputes or regulatory audits initiated by the Data Protection Board of India.
17. Asymmetric Liability Architecture: Strict Company Ceiling vs. Uncapped Client Liability
18. Mandatory Confidential Arbitration, Strict Covenant Not to Sue & Anti-Litigation Penalty
Any dispute, claim, or regulatory question arising out of or related to this Privacy Policy shall be resolved exclusively through confidential individual arbitration in Hyderabad, Telangana, India, under the Indian Arbitration and Conciliation Act, 1996.
The Client expressly covenants that it shall NOT FILE, MAINTAIN, OR PARTICIPATE IN ANY CIVIL LAWSUIT, DATA PRIVACY COMPLAINT, CLASS ACTION, OR REGULATORY PETITION against Orlyn, Vyuhavarahi, or Suchir Reddy. Any breach triggers an immediate minimum fine of $100,000 USD (₹10,000,000 INR), plus $5,000 USD/day, plus billing founder Suchir Reddy's defense time at $1,500 USD/hour (20-hour minimum).
19. Supreme Court Director Immunity Doctrine (Suchir Reddy Personal Shield)
Pursuant to established Supreme Court of India jurisprudence (Sunil Bharti Mittal v. CBI and Sharad Kumar Sanghi v. Sangita Rane):
Corporate directors and founders cannot be held vicariously or personally liable for data processing activities conducted by a corporate legal entity. All data operations exist strictly between Client and Vyuhavarahi.
- Founder Suchir Reddy holds zero personal custody of client personal data;
- Suchir Reddy is fully immune from personal civil, regulatory, or criminal liability;
- Client is permanently estopped from naming Suchir Reddy individually in any privacy, regulatory, or judicial complaint.
20. Cookies, Web Telemetry & Anonymous Performance Analytics
Orlyn websites utilize technical session cookies, local storage authentication tokens, and anonymous edge telemetry strictly necessary to maintain portal sessions, prevent cross-site request forgery (CSRF), and optimize CDN asset delivery. Users may adjust browser cookie settings at any time; disabling cookies may impact portal functionality.
21. Electronic Contracting & Statutory Clickwrap Enforceability (Section 10A IT Act 2000)
This Privacy Policy carries full legal validity, evidentiary admissibility, and electronic enforceability under Section 10A of the Indian Information Technology Act, 2000, the US E-SIGN Act of 2000, and Uniform Electronic Transactions Act (UETA). Navigating orlyn.in or engaging Orlyn services represents voluntary electronic assent having the identical legal effect as a handwritten signature.
22. Severability, Survival, Amendments & Privacy Officer Desk
- Governing Law: Governed exclusively by the laws of India, without regard to conflict-of-law principles.
- Perpetual Survival: All risk allocations, express negligence waivers, client indemnities, covenants not to sue, and founder immunity provisions shall survive project termination indefinitely.
- Severability: If any provision is deemed unenforceable by an arbitral tribunal, it shall be reformed to the minimal extent necessary to preserve its economic intent, and all remaining provisions shall remain fully operative.
Have Privacy, DPDPA or GDPR Questions?
Executed Data Processing Addenda (DPAs), Standard Contractual Clauses (SCCs), and regulatory compliance filings can be coordinated directly with our Data Protection Officer.