Privacy Policy

1.1 This policy explains how DigAI Technologies Pvt. Ltd. ("DigAI", "we", "us"), registered at Outer Ring Road, Bellandur, Bengaluru, Karnataka 560103, India, handles personal data when you visit digai.in, use the DigAI platform at app.digai.in (the "Services"), or communicate with us.

1.2 Two roles. (a) For data about you as our customer or visitor (account, billing, usage, website enquiries), we decide why and how it is processed — we are the Data Fiduciary under the DPDP Act (and controller under GDPR). (b) For data you load into DigAI about your own customers, leads, students, patients or staff ("Customer Content"), you are the Data Fiduciary/controller and we are your Data Processor; that processing is governed by our Terms and the Data Processing Agreement, and this policy applies to Customer Content only where it says so.

2.1 You give us: name, email address, phone number and country code, country, time zone and password (we store only a salted bcrypt hash, never the password itself); business name; GST and invoicing details you enter; messages to support; information in sales, demo, partner, careers and press forms; newsletter email.

2.2 Collected automatically: login activity (IP address, browser/device user-agent, time); session information (a strictly necessary cookie, see the Cookie Policy); security and diagnostic logs; basic usage of product features needed to run limits (for example contact counts, staff seats, email volume).

2.3 From integrations you enable: when you connect Meta (WhatsApp Business, Lead Ads, Facebook/Instagram), Google (Sheets, Calendar), an email (SMTP) provider, an SMS provider or an AI provider, we receive the data those services send us so the integration works (for example incoming WhatsApp messages, lead-form submissions, spreadsheet rows).

2.4 Customer Content (processor role). Contacts and their fields; conversations on WhatsApp, web chat, email and SMS; bookings; forms and submissions; pipeline, deal and payment records you enter; files and media; courses, students and school records; short-link click data (referrer, country, city, browser, device); email open and click events. We process it only to provide the Services.

2.5 Chat widget visitors. If you visit a website that embeds a DigAI chat widget, the widget operator (not DigAI) decides what is collected — typically your name, phone and messages.

2.7 Additional data from channels and features: Instagram direct messages and comments and the public profile details Meta provides (name, username, profile photo) when you connect Instagram; SMS content and delivery receipts via your SMS gateway; voice-call metadata (number, time, duration, outcome) and, if you enable recording, call audio and transcripts; events you choose to send to Meta through the Conversions API (for example a purchase or lead event with hashed contact identifiers); WhatsApp Flow responses; push-notification tokens and device identifiers if you use the DigAI mobile app; and webinar registrations.

2.6 What we do not collect: we do not knowingly collect card numbers on DigAI servers. Payments, when enabled, are handled by Razorpay (and, for international payments, Stripe), who receives the payment details directly.

We do not use Customer Content to train AI models for our own benefit.

4.1 Service providers (subprocessors) that host, deliver email, process payments or support us — listed on the Subprocessors page with their purpose and location.

4.2 Third parties you choose. If you connect Meta, Google, an AI provider (OpenAI, Anthropic or Google Gemini using your API key), an email provider or an SMS provider, data flows to them under your agreement with them; their privacy terms apply.

4.3 Legal and safety. To comply with law, court orders or lawful government requests, or to protect rights and security.

4.4 Business transfers. In a merger, acquisition or asset sale, with notice to you and the same protections.

4.5 We do not sell personal data and do not share it for third-party advertising.

Our infrastructure and providers may be located outside India. Where personal data is transferred, we rely on the transfer routes permitted by the DPDP Act and, for GDPR-covered data, appropriate safeguards such as Standard Contractual Clauses. Hosting: our cloud infrastructure providers listed on the Subprocessors page.

See the Cookie Policy and Cookie Preferences. Essential cookies keep the site and product working; analytics and marketing cookies load only after you opt in.

7.1 Account data: kept while your account is active and for 90 days after closure for legal, tax and dispute purposes.

7.2 Billing records: kept for 8 years as required by tax and company law.

7.3 Customer Content: kept while your account is active. After cancellation or deletion we keep it for 30 days so you can export it, then delete it.

7.4 Login and security logs: kept for 180 days.

7.5 Marketing enquiries: kept for 24 months unless you become a customer or ask us to delete them.

7.6 Backups roll off within 35 days after deletion.

We use measures appropriate to the risk, including: salted bcrypt password hashing; HttpOnly, Secure session cookies with 7-day expiry and the ability to sign out other devices; per-organization data isolation verified by automated tests; role-based staff permissions enforced on the server; API rate limiting; signature verification of Meta webhooks; and audit logging of platform-administrator actions. Additional measures: encryption of data in transit and at rest; scheduled, access-controlled backups; optional two-factor authentication and, on eligible plans, single sign-on; scoped API keys that you can revoke. No system is perfectly secure; you must also protect your credentials and staff access.

9.1 Under the DPDP Act you may: obtain a summary of the data we process and who it was shared with; ask us to correct, complete or update it; ask us to erase it (unless retention is required by law); withdraw consent; use our grievance process; and nominate another person to exercise these rights if you die or become unable to.

9.2 Under GDPR (where it applies) you also have the rights of portability, restriction and objection, and to complain to your supervisory authority.

9.3 How: email our Data Protection team at privacy@digai.in or use the contact page. We verify your identity and respond within 30 days (earlier where law requires). Where you are a contact in a customer's DigAI account, please contact that business first; we will help them respond.

9.4 You can export or delete many items yourself in the product (contacts, messages, files). Closing an account deactivates it immediately.

DigAI is a business product and is not directed at anyone under 18. We do not knowingly collect personal data from children. Schools and educators using the School features act as the Data Fiduciary for student data and are responsible for any verifiable parental consent that law requires; we process that data only on their instructions.

Features such as AI Agents and Micro-Brains generate replies using the AI provider you configure and the knowledge you provide. They are decision-support tools; you remain responsible for reviewing them. Our Responsible AI page explains the controls.

If a breach affecting your personal data occurs, we will notify the Data Protection Board of India and affected people as the DPDP Act and its rules require, and notify affected customers without undue delay so they can meet their own duties.

We will post updates here, change the version and date, and give notice by email or in-product for material changes at least 30 days before they take effect.

Grievance Officer: DigAI Technologies Pvt. Ltd., Outer Ring Road, Bellandur, Bengaluru, Karnataka 560103, India. Email grievance@digai.in. We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are unsatisfied you may approach the Data Protection Board of India (or your local authority).

Privacy contact: our Data Protection team at privacy@digai.in.