Privacy Policy

1. Data we collect

• Account data — name, email address, company name (optional), and password (stored only as a secure hash).
• Billing data — wallet balance, transactions, GSTIN (optional), and invoices. Payments are handled by Razorpay; we do not store your full card or bank account numbers.
• API usage metadata — per-request records containing the model used, token counts, cost, latency, status code, and timestamp.
• Technical data — IP address, browser type, and cookies necessary to operate the dashboard.

2. What we do NOT store

We do not store the content of your prompts or the model completions returned to you. Our usage logs record only metadata (tokens, cost, latency, model, and timestamp) — never the text you send or receive. Prompt content is transmitted to the upstream model provider purely to generate a response and is not retained by us.

3. How we use your data

• To provide, operate, meter, and bill the Service.
• To authenticate requests and enforce rate limits and security controls.
• To provide usage analytics and invoices in your dashboard.
• To send service, security, and billing communications.
• To comply with legal obligations and prevent fraud or abuse.

4. Legal basis

We process personal data on the basis of your consent (given when you create an account) and for the legitimate uses permitted under the DPDP Act, including providing a service you have requested and complying with law.

5. Sharing and sub-processors

We share data only with service providers who help us operate the Service:

• OVHcloud — performs model inference. Your prompts are sent here to generate responses. Inference occurs in the European Union (OVHcloud, GRA region).
• Razorpay — processes payments.
• Supabase — database, authentication, and storage infrastructure.
• Email and monitoring providers — transactional email and operational monitoring.

We do not sell your personal data or share it for third-party advertising.

6. International transfer

Because model inference is performed by OVHcloud in the European Union, the contents of your API requests are transferred outside India for processing. We rely on the provider’s contractual and technical safeguards for this transfer.

7. Data retention

Usage analytics are retained according to your plan — 7 days (Free), 30 days (Developer), and 365 days (Pro). Account, billing, and invoice records are retained as long as your account is active and thereafter as required for legal, tax, and accounting purposes.

8. Security

We apply industry-standard safeguards, including encryption in transit, SHA-256 hashing of API keys (we never store the raw key), row-level access controls, and the principle of least privilege. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Under the DPDP Act, you may:

• Access and obtain a copy of your personal data (your dashboard provides a data export).
• Request correction or completion of inaccurate data.
• Request erasure of your data and account.
• Withdraw consent and raise a grievance with our Grievance Officer.

You can export your data or delete your account directly from your account settings, or contact us using the details below.

10. Grievance Officer

In accordance with the DPDP Act and the Information Technology Act, 2000, you may contact our Grievance Officer at info@habilesoft.com for any privacy concern or complaint. We will respond within the timelines prescribed by law.

11. Children

The Service is not directed to individuals under 18, and we do not knowingly collect their data.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date and, for material changes, provide reasonable notice.

13. Contact

Habilesoft Pvt. Ltd. — info@habilesoft.com.