Privacy Policy

This policy sets out what Aight stores, why, and who else processes it, and how to have it corrected or deleted. It follows India's Digital Personal Data Protection Act, 2023 (the "DPDP Act").

Stored

Account email and business details. API keys in a hashed form that cannot be read back. Metadata for each request: facts about it, never the text.

Not stored

Prompts or model replies, unless request logging is requested.

Processors

The cloud providers that host the models, and the payment provider for recharges.

Retention

One year after the last activity. Invoices longer, as tax law requires.

Rights

See, correct, delete, complain. Replies within 1 working day.

Tracking

No advertising cookies or trackers on the website.

01Who is responsible

Ashva Intelligence Pvt Ltd decides how and why the data is used. Under the DPDP Act that makes it the "data fiduciary". Its details are at the end of this page.

02What is collected

Account details

• Name, business name, email address, billing country and phone number, if given.
• GSTIN and billing address, for invoices.
• The email addresses and roles of people given access to the account.
• Records of messages sent to support.

API keys

• API keys are stored hashed. A hash is a scrambled form that cannot be read back.
• The full key is shown once, when it is created in the console. It cannot be shown again.

Request metadata

Metadata means facts about a request, never its text. For every API request, Aight records:

• the date and time;
• which key was used;
• which model was called;
• how many tokens went in and came out;
• the cost of the request;
• whether it succeeded, and the error code if not;
• the IP address it came from.

This metadata produces the usage details and the bill.

Payments

• Card, UPI and bank details are entered on the payment provider's page. Aight does not receive or store card numbers.
• Aight keeps the payment reference, amount, currency, date, status, exchange rate where applicable, and the invoice issued.

03What is not stored

1. The text, images or audio sent to a model ("prompts") are not stored.
2. What the model sends back ("outputs") is not stored.
3. Prompts and outputs pass through Aight's servers only for the time it takes to get a reply. They are not written to disk.
4. Request logging for debugging is available on request. Once it is on, prompts and outputs are stored for 7 days. Logging is off unless requested.
5. Prompts are never used to train models.
6. Microsoft (Azure), Google (Vertex AI) and Amazon (Bedrock) each state in their business terms that they do not train on customer data.

04Why the data is used

• To run the service: route requests and deduct the right amount.
• To bill and issue invoices, which tax law requires.
• To keep the service safe: spot leaked keys, abuse and fraud.
• To answer support messages.
• To send emails about the account, payments, price changes, outages and changes to these policies.

Aight does not sell data and does not send marketing on behalf of anyone else.

05Who else processes data, and where

These companies process data on Aight's behalf. Under the DPDP Act they are "data processors".

Models & pricing names the region for every model, so the location of a request is known before it is sent.

Data may also be shared where the law requires it, for example with a court or a government body. The customer is told when the law allows.

06How long it is kept

1. Account details and request metadata: one year after the last activity, then deleted.
2. Invoices and payment records: as long as GST law requires, currently six years from the end of the financial year.
3. Debug logs, where requested: 7 days.
4. When an account is closed, everything except invoices and payment records is deleted within 30 days.

07How it is protected

• All traffic to and from the API is encrypted in transit.
• API keys are stored only as hashes.
• Only the people who run the service can reach the database, and every access is logged.
• Backups are encrypted and kept in India.
• If a breach affects personal data, the people affected and the Data Protection Board are told within the legal deadline.

08Rights under the DPDP Act

At any time, a person can ask to:

• See the personal data held about them and who it was shared with.
• Correct anything that is wrong or out of date.
• Delete their data, except what tax law requires to be kept.
• Nominate someone to exercise these rights for them.
• Withdraw consent for any use that relied on it. That use then stops.

Write to hello@getaight.ai from the account email address. Replies within 1 working day; requests are completed within 7 working days. A complaint can also be made to the Data Protection Board of India.

09Cookies and the website

A cookie is a small file a website saves in the browser. The website sets no advertising or tracking cookies and uses no analytics that follow visitors to other sites. The console uses one cookie to keep a person signed in. The website may keep the current exchange rate in the browser's session storage for display prices.

10Children

Aight is for businesses. Data from anyone under 18 is not knowingly collected.

11Changes to this policy

Changes to this policy are emailed at least 7 days before they take effect.

12Contact and grievance officer

Under the DPDP Act and the Consumer Protection (E-Commerce) Rules, 2020, the grievance officer handles privacy complaints. Every complaint is acknowledged within 48 hours and resolved within one month.

Other routes:

• For any consumer complaint. National Consumer Helpline: 1915, or consumerhelpline.gov.in. It is run by the Government of India and is free.

Terms and Conditions · Refund and Cancellation Policy · Support