1.Who we are, and how to reach us
This Privacy Policy covers GRACE, operated by Ayush Suri, 228 DL Road, Dehradun, Uttarakhand 248001, India. We are the data fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP”), and the controller for the purposes of the GDPR where it applies.
Grievance Officer (as required under the DPDP and the IT Rules): Ayush Suri, [email protected], 228 DL Road, Dehradun, Uttarakhand 248001, India.
2.What we collect
Not much, by design. Four categories:
- Account data — what Google hands us when you sign in: your name, email address and profile picture. Nothing else, because we do not ask for more.
- Content — the files in your workspace, your prompts, the transcripts, and the outputs the agent produces. This exists because the product does; it is yours, and it stays isolated to your account.
- Technical and usage data — run counts, timestamps, feature usage, errors, browser and device basics, IP address and server logs. This is how we keep the service up and catch abuse.
- Billing data — your plan, invoices and payment status. The payment processors hold your card, UPI and netbanking details; we do not, and we do not want to.
3.What we do with it
- Provide the Service: authenticate you, run the agent on your tasks, store your workspace, count your allowance.
- Bill you, keep tax-compliant records, and fight fraud and chargebacks.
- Keep the Service working: debug, monitor, and respond to incidents.
- Investigate abuse of the Service under the Acceptable Use Policy.
- Answer you, when you write to support.
- Comply with law.
Two things we do not do: we do not sell your personal data, and we do not use your Content to train any model — ours or anyone else’s.
4.Why we are allowed to (legal bases)
In India, under the DPDP, we rely on your consent and on the Act’s legitimate uses: performing the contract you entered by subscribing, complying with legal obligations, and responding to threats of harm or abuse. You can withdraw consent at any time — see “Your rights”. Withdrawal may mean we cannot continue providing the Service where the processing in question was necessary to provide it.
Where the GDPR applies, the bases map as follows: performance of a contract (account, content, billing), legitimate interests in security and abuse prevention (technical data), and consent where you have opted in (product emails, if you ever ask for them).
5.What happens when the agent runs (the AI part)
To work on your task, the agent needs a model. We send your prompt and the portions of your workspace the task requires to Google’s Gemini API, which processes them to generate the response. That is the only third party your Content goes to, for that purpose, under Google’s API terms.
Outputs come back to us and are stored only in your workspace. We do not send your Content to any analytics service, advertiser, or anyone else’s model.
6.Sub-processors
| Provider | Purpose | Processing location |
|---|---|---|
| Render | Application hosting (backend API) | United States (Ohio) |
| Cloudflare | Frontend hosting and CDN | Cloudflare network (global edge) |
| Google Cloud | Account, billing and workspace data storage; model inference for agent runs; product analytics | United States and Google’s API regions |
| PayU | Payment processing (India) | India |
| Wise | International payment transfers | United States and the sender’s country |
We give thirty days’ notice by email before adding any sub-processor that processes Content. This table is the list; there is no other one hiding behind it.
7.Where your data lives, and cross-border transfers
Primary hosting is in the United States: the backend API runs on Render in Ohio, frontend assets are served through Cloudflare’s network, and account, billing and workspace data is stored in Google Cloud. The sub-processors above may process data in the regions listed, which can include transfers outside India.
Under the DPDP, transfers outside India are permitted except to countries the Central Government has notified as restricted. None are notified as of this policy’s date, and we will comply if that changes. Where the GDPR applies to a transfer out of the EEA, we rely on adequacy decisions or the European Commission’s standard contractual clauses.
8.How long we keep it
| Data | How long |
|---|---|
| Account data | While your account is open, then up to 30 days for closure and disputes |
| Workspace Content — files, prompts, transcripts, outputs | Until you delete it, or 30 days after account closure |
| Backups | Up to 35 days, rolling |
| Technical logs | Up to 90 days |
| Billing and tax records | As long as Indian tax law requires — up to eight years |
| Content subject to a legal hold | Until the hold ends |
Deletion means deletion: when we say something is deleted, backups age out on the schedule above, and then it is gone.
9.How we protect it
- Every workspace is isolated per account. No other account can read your files; sandboxes are destroyed after each task.
- Data is encrypted in transit (TLS) and at rest.
- Staff access to workspace Content is limited to two cases — support you have asked for, and abuse investigation — and every access is logged.
- We follow reasonable security practices under Rule 3 of the IT (Reasonable Security Practices and Procedures) Rules, 2011, as they read with the DPDP.
If a breach happens that the law requires us to notify you about, we will — without waiting for the deadline.
10.Your rights
If you are in India (a DPDP data principal), you can: ask for a summary of the personal data we process about you and who we have shared it with; correct it; have it erased; nominate someone to exercise your rights if something happens to you; withdraw consent; and complain to our Grievance Officer and, after that, to the Data Protection Board of India.
If you are in the EEA or UK (GDPR), you additionally have rights of access, rectification, erasure, restriction, portability and objection, and you can complain to your supervisory authority.
Everywhere else, we offer the same practical deal, because rights should not depend on your postcode.
Ask by writing to [email protected], or use the delete controls in your workspace. We will verify you own the account, respond within thirty days — or sooner where the law demands it — and tell you if we need longer.
Deleting your account deletes your workspace with it, within thirty days, minus the records the law makes us keep.
11.Children
GRACE is for adults. In India, the DPDP treats anyone under 18 as a child requiring verifiable parental consent; we do not offer that, so the Service is 18+ everywhere. If we learn we hold a child’s data, we delete it promptly.
13.Changes to this policy
We will post changes here with a new “last updated” date. Material ones go out by email as well, at least fourteen days ahead where the law or basic decency requires. Continuing to use GRACE after that date means you accept the updated policy.
14.Contact
Privacy questions: [email protected]. Grievance Officer: Ayush Suri, [email protected]. Postal: 228 DL Road, Dehradun, Uttarakhand 248001, India.