Privacy Policy India

1. Scope & Applicability

This Privacy Policy operates in accordance with:

• Information Technology Act, 2000
• IT (SPDI) Rules, 2011
• Digital Personal Data Protection Act, 2023 (DPDP Act)

2. Information We Collect

2.1 Account Information

• Name, email address, company name
• Account identifiers and authentication data

2.2 Usage & Technical Data

• IP address, device and browser metadata
• Logs, timestamps, feature usage

2.3 Conversation Data

• Chat messages
• Voice call recordings or transcripts (if enabled)
• AI-generated responses

3. Purpose of Data Processing

We process personal data to:

• Provide and operate AI chat and voice services
• Manage billing, usage, and support
• Improve system performance and security
• Comply with legal and regulatory obligations

4. Data Sharing & Subprocessors

We may share data with trusted third-party vendors, including:

• International LLM Providers — OpenAI, Anthropic, Google Gemini (data may be processed outside India)
• Indian AI Providers — Sarvam AI (STT, LLM, TTS) — all data stays in India
• Speech-to-Text (STT) and Text-to-Speech (TTS) providers
• Telephony and WebRTC providers
• Cloud infrastructure — Google Cloud Platform, Mumbai region (asia-south1)
• Payment processor — Razorpay (India-based; all payment data stored in India per RBI mandate)

All vendors are bound by contractual confidentiality and security obligations.

5. Data Retention

• Personal and conversation data is retained only as long as necessary to provide Services or meet legal requirements.
• You may request deletion of your data, subject to applicable law.

6. Data Security

We implement reasonable administrative, technical, and physical safeguards, including:

• Encryption in transit
• Access controls and monitoring

No system is completely secure; use of the Services is at your own risk.

6A. Data Residency & Indian Providers

When you use Indian AI providers (Sarvam STT, Sarvam LLM, Aero TTS), all voice and conversation data is processed and stored exclusively in India within our GCP Mumbai (asia-south1) infrastructure.

When you use international providers (OpenAI, Anthropic, Google Gemini), data may be processed in the provider's data centers outside India, subject to the provider's own data processing policies.

All payment data is processed by Razorpay and stored in India in compliance with RBI data localization requirements.

Our infrastructure runs on Google Cloud Platform, Mumbai region:

• Cloud Run — application servers
• Cloud SQL — PostgreSQL database
• Memorystore — Redis cache
• Cloud Storage — file and voice recording storage

6B. Regulatory Compliance

ThinnestAI complies with the following Indian regulations:

• DPDPA 2023 — consent management, configurable data retention (default 180 days with auto-purge), right to erasure, and 72-hour breach notification
• RBI Data Localization — all payment data stored exclusively in India via Razorpay
• TRAI Telecom Compliance — DND/NCPR scrubbing, IST time-boxing (9 AM – 9 PM), AI disclosure, and 140-series number support

For full regulatory compliance details, please refer to our main Legal and Compliance page.

7. User Rights (India)

Subject to Indian law, you may:

• Request access to your personal data
• Request correction or erasure
• Withdraw consent where applicable

Requests can be sent to hello@thinnest.ai.

8. Cookies

We use cookies and similar technologies to maintain sessions, analyze usage, and improve performance. Disabling cookies may impact functionality.

9. Children’s Privacy

Thinnest.ai does not knowingly collect personal data from individuals under 18 years of age.

10. Policy Updates

We may update this Privacy Policy from time to time. Continued use of the Services constitutes acceptance of the updated policy.

11. Grievance & Contact

For privacy or data-related concerns:

📧 hello@thinnest.ai