Privacy Policy

1. Corporate Identity & Data Controller

The data controller responsible for personal information processed through Gaatha AI is:

2. Categories of Information We Collect

We collect only information essential to providing the service:

• Account & Profile Information: When you register, we collect your email address, securely hashed password (using bcrypt/PBKDF2), and tenant organization identifiers. We do not store plaintext passwords.
• Conversations & Query Queries: Prompts submitted to the chat interface are stored in our secure PostgreSQL database associated with your authenticated user and session ID so that you can resume conversations across visits.
• Anonymous Visitor Counter: To measure unique aggregate visitors without invasive tracking, a pseudorandom client identifier is generated in your browser's localStorage. This identifier contains no personally identifiable information.
• Technical & Telemetry Data: Standard server access logs including IP address, browser user-agent, request timestamps, and HTTP response codes for system security and intrusion prevention.

3. Purpose and Legal Basis for Processing

We process information under the following legal bases:

• Contractual Performance: Providing authentication, session storage, and conversational scripture queries.
• Legitimate Interests: Defending server infrastructure against DDoS attacks, optimizing embedding retrieval performance, and preventing abusive query patterns.
• User Consent: For voluntary communications, feedback submissions, and elective newsletter notifications.

4. Third-Party Model Providers & Sub-processors

Gaatha AI combines on-premise vector search (FAISS semantic indexing) with high-speed language model inference APIs. When a query is processed, contextual scripture verses and your prompt are transmitted via encrypted TLS to our LLM inference provider (e.g., Groq API). Our agreements ensure that user queries sent to the inference pipeline are not used to train foundational third-party models.

5. Data Retention & Erasure

Your chat records remain in your account until you delete them or request account closure. You may request full erasure of your account, authentication records, and associated conversation history at any time by contacting support@gaatha.tech. Requests are completed within 30 days.

6. Data Security Measures

We implement industry-standard administrative, physical, and technical safeguards:

• Strict TLS 1.3/1.2 SSL encryption for all data in transit across https://ai.gaatha.tech.
• Database segregation with PostgreSQL accessible exclusively via private internal container networking (never exposed to the public internet).
• Secure JWT token authentication with configurable expiration lifetimes.
• Regular automated security auditing and least-privilege host configurations.

7. Your Rights

Under applicable data protection laws, including the Digital Personal Data Protection (DPDP) Act of India and GDPR principles where applicable, you possess:

• The right to access and receive a copy of your stored personal data.
• The right to rectify inaccurate or outdated account information.
• The right to complete erasure ("Right to be Forgotten").
• The right to withdraw consent at any time without affecting past lawful processing.

8. Contact Information

For any questions regarding this Privacy Policy or your personal information:

Email: support@gaatha.tech | gaatha.aidni@gmail.com

Address: Aidni Global LLP, Ahmedabad, Gujarat, India.