Privacy Policy

01Who is responsible

Ashva Intelligence Pvt Ltd decides how and why your data is used. Under the DPDP Act that makes us the "data fiduciary". Our details are at the end of this page.

02What we collect

Account details

• Your name, business name, email address and phone number, if you give one.
• Your GSTIN (GST number) and billing address, for invoices.
• Records of the emails you send us.

API keys

An "API key" is a secret code your software sends with each request. It tells us which account to charge.

• We store your API keys "hashed". A hash is a scrambled form we cannot read back.
• You see the full key once, when you create it in your console. We cannot show it to you again.
• Your "console" is the web page where you manage keys and see spend.

Request metadata

"Metadata" means facts about a request, never the text of it. For every request sent to our API we record:

• the date and time;
• which key was used;
• which model was called;
• how many tokens went in and came out (a token is a piece of text, about four characters);
• the cost of the request;
• whether it succeeded, and the error code if not;
• the IP address it came from, meaning the internet address of the computer that sent it.

This is what makes your usage report and your bill.

Payments

• Razorpay, our payment provider, handles your card, UPI or bank details. We never see or store them.
• We keep the payment ID, amount, date and status, and the invoice we issued.

03What we do not store

1. We do not store the text, images or audio you send to a model ("prompts"). A "model" is an AI system that reads your text and writes a reply, such as GPT or Gemini.
2. We do not store what the model sends back ("outputs").
3. Prompts and outputs pass through our servers only for the seconds it takes to get a reply. We never write them to disk.
4. If you want request logging for debugging, email us. We turn it on the same working day. We then store your prompts and outputs for 7 days. Logging is off unless you ask.
5. We never use your prompts to train models.
6. Our three cloud providers say the same in their business terms. Microsoft (Azure OpenAI), Google (Vertex AI) and Amazon (Bedrock) each state they do not train on customer data.

04Why we use your data

• To run the service: route your requests and deduct the right amount.
• To bill you and issue GST invoices, which tax law requires.
• To keep the service safe: spot leaked keys, abuse and fraud.
• To answer your support messages.
• To email you about price changes, outages and changes to these policies.

We do not sell your data. We do not send marketing on behalf of anyone else.

05Who else processes your data, and where

These companies handle data on our behalf. Under the DPDP Act they are "data processors". Microsoft, Google and Amazon are our cloud providers: they host the models in their data centres. OpenAI, Google and Anthropic make the models.

We state the route for each model before you buy; email us for the current sheet. So you know where a prompt goes before you send it. GPT models run in India. Claude and Gemini may run outside India; the model list says which.

We may also share data when the law requires it, for example with a court or a government body. We will tell you when we are allowed to.

06How long we keep it

1. Account details and request metadata: one year after your last activity, then deleted.
2. Invoices and payment records: as long as GST law requires, currently six years from the end of the financial year.
3. Debug logs, if you ask us to turn them on: 7 days.
4. If you close your account, we delete everything except the invoices within 30 days.

07How we protect it

• All traffic to and from our API is protected on the way. No one in between can read it.
• API keys are stored only as hashes, the scrambled form described in section 02.
• Only the people who run the service can reach the database, and every access is logged.
• Backups are scrambled the same way and kept in India.
• If a breach affects your data, we will tell you and the Data Protection Board within the legal deadline.

08Your rights under the DPDP Act

You can ask us, at any time, to:

• Show you the personal data we hold about you and who we shared it with.
• Correct anything that is wrong or out of date.
• Delete your data, except what tax law makes us keep.
• Nominate someone to exercise these rights for you if you cannot.
• Withdraw consent for any use that relied on it. We will then stop that use.

Email vaibhav@getaight.ai. We reply within 1 working day. Write from your account email address. We complete the request within 7 working days. If you are not satisfied, you can complain to the Data Protection Board of India.

09Cookies and the website

A cookie is a small file a website saves in your browser. Our website sets no advertising or tracking cookies. Your console uses one cookie, to keep you signed in. We do not use analytics tools that follow you to other sites.

10Children

Aight is for businesses. We do not knowingly collect data from anyone under 18.

11Changes to this policy

If we change this policy we will email you at least 7 days before the change takes effect. The date at the top always shows the current version.

12Contact and grievance officer

Under the DPDP Act and the Consumer Protection (E-Commerce) Rules, 2020, our grievance officer handles privacy complaints.

Our grievance officer is Vaibhav Chawla, the founder. We are a small company, so he is also the person who answers support. We acknowledge every complaint within 48 hours and resolve it within one month.

If you would rather not go through the founder, or we have not fixed it, use these routes.

• For a payment. Raise a dispute with Razorpay, our payment provider, at razorpay.com/support. Razorpay handles card, UPI and net-banking disputes independently of us.
• For any consumer complaint. Call the National Consumer Helpline on 1915, or visit consumerhelpline.gov.in. It is run by the Government of India and is free.