Privacy Policy
Draft v0.1, 2026-10-16. Written for the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Lawyer review pending.
Who we are. [LEGAL ENTITY NAME], [address], India ("we"). For the DPDP Act we are the Data Fiduciary for your account data and for the personal data in your requests that we process to run the Service.
1. What we collect and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Account data: name, email, organisation, phone (optional) | to create and secure your account, send service messages, support | consent at signup; performance of our contract | life of the account + [3] years |
| Payment data: amount, payment id, pack, invoice details, and the payer name and email our payment processor reports with each payment | billing, tax, fraud prevention, dispute defence | contract; legal obligation (tax) | [8] years (tax law); the payer name and email are removed on erasure requests, the amounts and ids are kept |
| API keys (stored hashed) and sign-in tokens | authentication | contract | until revoked |
| Call logs: tool used, time, cost, status, latency, your client tag, the Provider's call id | billing, failed-call refunds, reconciliation, abuse prevention, service quality | contract; legitimate use | [12] months, then aggregated |
| Inputs you send to tools that contain personal data (e.g. a person's name, email, LinkedIn URL) | to run the tool you asked for | you are the Data Fiduciary for that data and we process it on your instruction; see §4 | hashed in our logs; raw values are not kept after the call except for idempotent replay for up to 24 hours |
| Results returned by Providers | returned to you | your instruction | not stored, except for idempotent replay for up to 24 hours |
| Technical data: IP address, user agent, device signals | security, abuse prevention (e.g. multiple free-credit accounts) | legitimate use | [90] days |
| Support messages | to help you | consent | [2] years |
We do not sell personal data. We do not use your queries or results to build products for others. We do not share one customer's results with another customer.
2. Who we share data with
- Providers (the data vendors behind each tool, currently accessed through our upstream partner Treg): they receive the inputs needed to run your call, tagged with an anonymous customer id. They do not receive your name or email.
- Payment processor (Dodo Payments, as merchant of record): payment details, invoice details.
- Infrastructure: database and sign-in (Supabase, Mumbai region) and hosting (Fly.io, Mumbai region; Cloudflare for DNS and the public site), email delivery (Supabase Auth; Resend once enabled), error monitoring (Sentry, once enabled). Each receives only what it needs.
- Authorities when the law requires.
We do not transfer account data outside India except to the infrastructure and payment providers listed, under contracts that require them to protect it.
3. Your rights (DPDP Act)
You can: access a summary of your personal data; correct or update it; ask us to erase it (we keep what tax and other laws require); withdraw consent (which may end the Service); nominate a person to exercise your rights if you are unable to; and complain. Write to our Grievance Officer: [name], [email]. We respond within [30] days. If unsatisfied you may approach the Data Protection Board of India.
4. When you send other people's personal data
When you ask a tool to find or enrich information about a person, you decide the purpose and are the Data Fiduciary for that data. You must have a lawful basis to process it and must follow the Acceptable Use Policy. We act on your instruction and apply these protections: inputs are hashed in logs, raw results are not retained beyond 24 hours, and Providers receive only what the call needs.
5. Security
Secrets are stored in hosting-platform vaults, API keys are stored as one-way hashes, data is encrypted in transit and at rest, access is least-privilege, and money records are append-only. See our Security page. If a breach affects you, we will notify you and the Data Protection Board as the DPDP Act requires.
6. Cookies
The dashboard uses only strictly necessary cookies (session). No advertising trackers.
7. Children
The Service is for business use by adults. We do not knowingly process children's data.
8. Changes
We will notify material changes by email and in the dashboard at least 15 days before they take effect.
9. Contact
[LEGAL ENTITY NAME], [address]. Privacy: [email protected]. Grievance Officer: [name], [email].