Privacy Policy
DRAFT FOR LEGAL REVIEW. NOT LEGAL ADVICE. NOT YET IN FORCE. Written to match how Textikraft works today. Text in [square brackets] is a placeholder or a decision for the business or its lawyer. Every statement below must stay true: if the product changes, change this text and publish a new version.
Version: [0.2-draft] · Effective date: [date]
[COMPANY LEGAL NAME] ("we", "us"), [address], runs Textikraft. This policy explains what personal data we handle, why, who receives it, how long we keep it, and what choices you have. It covers our website, the Textikraft web application and our API (together, the "Service").
1. Two roles
- Account, billing and usage data. For information about the people who sign up for and use the Service, and about the organisations they work for, we decide how the data is used. We are the "data fiduciary" under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the "controller" under the EU and UK GDPR where that applies.
- Documents our customers send us. A customer organisation decides which documents to send. For personal data inside those documents (for example names, addresses, bank details, or guest details on invoices, receipts and bookings), the customer is the data fiduciary or controller and we are its "data processor". We process that data only on the customer's instructions, under the Data Processing Terms (Schedule A of our Terms and Conditions). If you are a person named in a customer's document and want to exercise a right, please contact that customer; we will help them respond.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, work email, optional phone number, optional profile photo, role and menu access, password (stored only as a salted hash), two-step verification settings, sign-in method (password or your organisation's single sign-on) | You or your organisation's administrator |
| Organisation data | Organisation name and logo, organisation address (the sub-domain you choose), billing country, legal name, address, tax number (GSTIN) and state, plan, data-retention choice | Your organisation |
| Billing data | Top-ups, payments, invoices, statements, credit ledger, payment reference. We do not store card or UPI details; payments are taken by our payment provider or by bank transfer | You and our payment provider |
| Customer content | Sample documents, documents sent for processing, instructions typed in the training chat, output formats, extracted results, reviewer corrections, documents and approved results a customer keeps with an agent | Your organisation |
| Usage and technical data | Job records (identifier, status, time, credits used), API calls, IP address, browser and device information, sign-in and session records, an audit log of security-relevant actions | Automatically |
| Support data | Messages and attachments you send us | You |
We do not knowingly collect children's data and the Service is for businesses. If a document contains data about children, the customer must have a lawful basis to process it.
3. Why we use data, and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Provide the Service: create accounts, train and run agents, return results, show your usage | Account, organisation, content, usage | Performing our agreement with your organisation; your consent where the law requires it |
| Take payments, issue GST and other tax invoices, keep accounts | Billing, organisation, account | Contract; legal obligations (tax and accounting) |
| Keep the Service safe: detect abuse and attacks, investigate incidents, enforce limits | Usage, technical, audit log | Legitimate uses permitted by law; legal obligations |
| Support you | Account, usage, support data | Contract; legitimate uses |
| Improve the Service using data about how it is used (counts, timings, errors), never the contents of your documents | Usage | Legitimate uses; consent where required |
| Send service messages (verification, invitations, statements, low-balance and security alerts) | Account, billing | Contract; legitimate uses |
| Send product news [only if offered] | Name, email | Your consent, which you can withdraw at any time |
| Comply with law and respond to lawful requests | Any | Legal obligations |
4. How documents are processed (AI)
- A document is stored, read by software and, where needed, by an AI model. The AI provider receives the content of the document and the customer's instructions for that task, and returns the extracted data.
- We do not use customer documents or results to train AI models, and our agreements with AI providers do not allow them to [to be confirmed against each provider's current terms before launch, including whether the provider keeps requests for a limited time for abuse checks].
- Worked examples. When a customer reviews a document and chooses to keep it with an agent, or keeps sample documents with an agent, later documents for the same agent may be shown to the AI together with those approved results to improve accuracy. This happens only inside that customer's own agent. It never crosses to another customer.
- The service shows an estimated accuracy and flags uncertain values. A person should review results that matter. We do not make decisions about individuals based on this processing.
5. Who we share data with
We do not sell personal data. We share it only with:
- Sub-processors that help us run the Service, listed in Schedule B of the Terms (AI provider, hosting, email, payments, and any monitoring that sees only technical data). Each is bound by a contract that requires protection equivalent to this policy.
- Your organisation's administrators, who can see your name, email, role, sign-in activity and, in the audit log, what you did in the Service.
- Our sales and support staff, for the customers they look after, limited to account and billing information, and to document content only where a customer asks for help and access is recorded.
- Authorities and advisers where the law requires, or to protect rights, with notice to the customer where lawful. Professional advisers (lawyers, auditors) are bound by confidentiality.
- A successor if our business is sold or merged, on the same terms as this policy.
6. Where data is processed and transfers
The Service is hosted in [region/country]. AI processing takes place in [location(s) stated by the AI provider]. Where personal data is sent outside India, we do so as the DPDP Act and any restrictions notified under it allow. Where the EU or UK GDPR applies and data is sent to a country without an adequacy decision, we use [standard contractual clauses or another valid safeguard]. [Counsel: confirm cross-border position, data-residency options and any customer-specific commitments.]
7. How long we keep data
| Data | Kept for |
|---|---|
| Documents sent for processing and their results | The retention period the customer chooses, [30] days at most and by default, then deleted automatically; the customer can delete sooner at any time |
| Samples, approved results and test cases a customer keeps with an agent | Until the customer deletes them, or deletes the agent or account |
| Job records without document content (status, time, credits used), credit ledger | [8] years with billing records |
| Invoices, payments, tax records | [8] years, as tax law requires |
| Audit log and records of accepting our Terms | [period], for as long as needed to protect legal rights |
| Account data of a person who leaves | Until their organisation removes them or closes the account, then deleted within [30] days unless the law requires us to keep it |
| Backups | Overwritten on their normal cycle, within [35] days |
| Support messages | [2] years after the conversation ends |
8. Security
We use measures that include encryption in transit, salted password hashing, optional two-step verification, hashed API keys, encrypted storage of secrets, role-based access, rate limiting, validation of uploaded files, an append-only audit log, automatic deletion of documents after the retention period and recorded, need-based staff access. No system is perfectly secure. If a breach affects personal data we will notify those we must, as the law requires, and tell our customers without undue delay. [Add certifications or test reports when you have them.]
9. Your rights and how to use them
Subject to the law that applies to you, you may ask to access the personal data we hold about you, correct or complete it, erase it, withdraw consent you gave, nominate someone to exercise your rights if you die or cannot, and complain. To use these rights write to [privacy email]. We will reply within [30] days (or any shorter time the law sets) and may ask you to prove who you are.
For personal data inside a customer's documents, please ask the customer; we will assist them.
Grievance officer (India): [name], [email], [address]. We acknowledge a complaint within [48] hours and resolve it within [15] days. You may also approach the Data Protection Board of India. If you are in the EU or UK you may also complain to your supervisory authority.
10. Cookies and similar technologies
The web application uses only what it needs to work: a secure, HTTP-only cookie that keeps you signed in, a request header that protects against cross-site requests, and your browser's local storage for preferences such as light or dark mode. We do not use advertising cookies. [If analytics are added to the marketing website, describe them and add a consent banner.]
11. Changes to this policy
We will tell administrators by email and in the Service at least [30] days before a material change applies, with a short summary. The version in force and its date are shown at the top.
12. Contact
[COMPANY LEGAL NAME], [address] · Privacy: [privacy email] · Grievance officer: [name, email].