Privacy Policy & Terms of Service

Nanostuffs Technologies Private Limited is registered in India, with its registered office at Office No. 1201 to 1208, 12th Floor, Apex Business Court Phase 2 (Raviraj Cru Mall), near Gangadham Chowk, Bibvewadi, Pune, Maharashtra 411037. We also operate from offices in Dubai, New York, and Sydney. For the purposes of applicable data protection laws, Nanostuffs is the "data fiduciary" (under India's DPDP Act, 2023) and "data controller" (under the GDPR) for personal information collected through this Service.

2.1 Account Information

When you create an account or use the Service, we collect:

• Full name and email address
• Password (stored encrypted)
• Organization/company name (if applicable)
• User role and permissions within your organization
• Profile preferences and settings

2.2 Document and Content Data

The core functionality of our Service involves processing documents you upload:

• Document files (PDFs, Word documents, text files, etc.)
• Document metadata (file names, upload timestamps, folder organization)
• Extracted content (text, embeddings, vector representations)
• Chat interactions (questions you ask, AI-generated responses, cited sources)
• Project contexts (project names, descriptions, associated documents)
• Classifications and tags (user-assigned or AI-suggested categorizations)

Important: The documents and content you upload may contain sensitive, proprietary, or confidential information. We process this data solely to provide the Service and do not use it for any other purpose without your explicit consent.

2.3 Usage and Technical Information

We automatically collect technical and usage data:

• IP address, device type, browser type and version
• Operating system and device identifiers
• Pages visited, features used, time spent on the platform
• Search queries and filter selections
• Performance metrics (response times, error rates)
• Session information and authentication tokens

2.4 AI Model Usage Data

When you use AI features, we may log:

• Selected AI provider and model (e.g., Claude, GPT, Gemini, Sarvam)
• Query content and generated responses
• Token usage and API consumption metrics
• Model performance and accuracy feedback

2.5 Payment Information (if applicable)

For paid subscriptions, we collect payment information through secure third-party processors. We do not store full credit card details on our servers.

We use the collected information for:

• Service Delivery: Processing documents, generating embeddings, providing AI-powered search and question-answering
• Account Management: Creating and managing user accounts, authentication, access control
• Platform Improvement: Analyzing usage patterns, improving AI model accuracy, fixing bugs
• Communication: Sending service updates, security alerts, feature announcements, responding to support requests
• Security: Detecting fraud, preventing abuse, protecting against unauthorized access
• Compliance: Meeting legal obligations, enforcing our terms, responding to lawful requests
• Analytics: Understanding feature adoption, user engagement, system performance

We do not:

• Sell your personal information or documents to third parties
• Use your uploaded documents to train AI models without explicit consent
• Share your content with other users unless you explicitly grant access
• Use your data for marketing purposes beyond our own Service communications

Where the GDPR applies (e.g., users in the EU/EEA), we process personal data on the following legal bases:

• Contract Performance — to provide the Service you've signed up for
• Consent — when you explicitly agree to specific processing activities
• Legitimate Interests — improving our Service, security, fraud prevention, analytics
• Legal Obligation — complying with applicable laws and regulations

You may withdraw consent at any time by contacting us at the details in Section 12.

Our Service integrates with multiple third-party AI model providers to power intelligent search and question-answering:

• Anthropic (Claude) — for advanced reasoning and analysis
• OpenAI (GPT models) — for general-purpose language understanding
• Google (Gemini) — for multimodal capabilities
• Sarvam AI — for India-region data residency compliance
• Other providers — as we expand our model offerings

Important considerations:

• When you send queries, relevant document excerpts may be transmitted to the selected AI provider's API
• We select providers that offer enterprise-grade privacy protections and do not use API data for model training
• You can choose specific providers based on your data residency and compliance requirements
• We implement secure API communications and do not expose full documents unnecessarily

Each AI provider operates under their own privacy policies. We recommend reviewing their policies if you have specific concerns about data processing outside our platform.

6.1 Where We Store Data

Data is stored in secure cloud infrastructure:

• Primary database — using industry-standard encrypted storage
• Document storage — secure object storage with encryption at rest
• Vector embeddings — specialized vector database for semantic search
• Backups — regular encrypted backups for disaster recovery

6.2 Security Measures

We implement comprehensive security controls:

• Encryption: TLS/SSL for data in transit, AES-256 encryption for data at rest
• Access Control: Role-based permissions, multi-tenant isolation, authentication tokens
• Monitoring: Continuous security monitoring, intrusion detection, audit logging
• Vulnerability Management: Regular security assessments, patch management, penetration testing
• Incident Response: Documented procedures for security breach notification and remediation

Despite these measures, no internet-based service is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

We do not sell or rent personal information. We may share information with:

• AI Model Providers — to process your queries as described in Section 5
• Infrastructure Providers — cloud hosting, database services, CDN providers bound by confidentiality agreements
• Service Providers — email delivery, payment processing, analytics tools, customer support platforms
• Within Your Organization — other users in your tenant/workspace based on your configured access controls
• Legal Authorities — when required by law, court order, subpoena, or to protect legal rights
• Business Transfers — in the event of a merger, acquisition, or sale of assets, subject to confidentiality protections

All third-party service providers are carefully vetted and contractually required to maintain appropriate data protection standards.

As Nanostuffs operates globally (India, UAE, US, Australia), and our AI providers are based worldwide, personal information may be transferred to and processed in countries other than your own.

For transfers from the EU/EEA, we rely on:

• Standard Contractual Clauses (SCCs) — EU Commission-approved data transfer mechanisms
• Adequacy Decisions — transfers to countries deemed adequate by the EU Commission
• Your Explicit Consent — where you have been informed and agreed to the transfer

You may request a copy of the relevant transfer safeguards by contacting our Grievance Officer.

We retain personal information for different periods depending on the purpose:

• Active Accounts — data retained as long as your account is active and in use
• Document Content — retained until you delete documents or close your account
• Chat History — retained based on your project settings (can be cleared by users)
• Audit Logs — retained for security and compliance purposes (typically 1-3 years)
• Closed Accounts — deleted within 90 days unless legally required to retain longer
• Backups — may persist in backup systems for up to 90 days after deletion

You can request deletion of your data at any time by contacting us or using in-platform deletion features.

10.1 Under India's Digital Personal Data Protection Act, 2023 (DPDP Act)

You have the right to:

• Access — obtain a summary of personal data we hold about you
• Correction — request correction, completion, or updating of your personal data
• Erasure — request deletion of your personal data (subject to legal retention requirements)
• Nominate — designate another individual to exercise these rights on your behalf
• Withdraw Consent — withdraw consent at any time where processing is based on consent
• Grievance Redressal — lodge a complaint with our Grievance Officer or the Data Protection Board of India

10.2 Under the GDPR (EU/EEA users)

You additionally have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure (Right to be Forgotten) — request deletion in certain circumstances
• Restriction — limit how we process your data
• Data Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests or direct marketing
• Lodge Complaints — file a complaint with your local supervisory authority

10.3 Under the CCPA/CPRA (California residents)

California residents have the right to:

• Know — what personal information is collected, used, shared, or sold
• Delete — request deletion of personal information
• Correct — request correction of inaccurate information
• Opt-Out — opt out of the sale or sharing of personal information (we do not sell personal information)
• Limit Use — limit use of sensitive personal information
• Non-Discrimination — not be discriminated against for exercising privacy rights

To exercise any of the above rights, contact us using the details in Section 12. We will respond within the legally required timeframe (typically 30-45 days).

11.1 Acceptance of Terms

By accessing or using the Nano AI RAG Agent Service, you agree to be bound by these Terms and Conditions. If you do not agree, you must not use the Service.

11.2 Service Description

Nano AI RAG Agent provides:

• Document upload, storage, and organization capabilities
• AI-powered semantic search and question-answering
• Multi-model AI integration (Claude, GPT, Gemini, Sarvam, etc.)
• Vector database and embedding generation
• Chat-based interaction with your document corpus
• Project and folder management tools
• Role-based access control for teams

11.3 User Responsibilities

You agree to:

• Provide accurate account information and keep credentials secure
• Only upload content you have the right to use and process
• Not upload malicious files, viruses, or harmful code
• Not attempt to reverse-engineer, hack, or compromise the Service
• Not use the Service for illegal purposes or to violate others' rights
• Not share account access outside your authorized organization
• Comply with all applicable laws and regulations in your jurisdiction
• Respect intellectual property rights of third parties

11.4 Intellectual Property

Your Content: You retain all intellectual property rights to documents and content you upload. By using the Service, you grant us a limited license to process, store, and transmit your content solely to provide the Service.

Our Platform: The Nano AI RAG Agent platform, including its code, design, AI orchestration logic, and proprietary algorithms, is owned by Nanostuffs and protected by intellectual property laws. You may not copy, modify, distribute, or create derivative works without explicit written permission.

11.5 Acceptable Use Policy

You must not:

• Use the Service to generate, store, or distribute illegal, harmful, or offensive content
• Violate privacy laws or upload personal data without proper consent
• Attempt to access other users' data or bypass security controls
• Use automated tools to scrape, download, or exfiltrate data at scale
• Overload or disrupt the Service infrastructure
• Resell or redistribute the Service without authorization

11.6 Service Availability and Modifications

We strive for high availability but do not guarantee uninterrupted access. We reserve the right to:

• Modify, suspend, or discontinue features with reasonable notice
• Perform maintenance that may temporarily affect availability
• Update terms and conditions with notice to users
• Change pricing for paid tiers (existing subscriptions honored until renewal)

11.7 Limitation of Liability

To the maximum extent permitted by law:

• The Service is provided 'as is' without warranties of any kind
• We are not liable for accuracy of AI-generated responses
• We are not responsible for data loss (though we implement backups)
• We are not liable for indirect, incidental, or consequential damages
• Our total liability is limited to the amount you paid for the Service in the past 12 months
• We are not liable for third-party services (AI providers, hosting providers)

Important: AI-generated responses may contain errors, inaccuracies, or hallucinations. You are responsible for verifying information before relying on it for critical decisions.

11.8 Termination

We may suspend or terminate your access if you:

• Violate these Terms and Conditions
• Engage in fraudulent or illegal activity
• Fail to pay for paid subscriptions
• Pose a security risk to the platform or other users

You may terminate your account at any time through the platform settings or by contacting support. Upon termination, your data will be deleted according to our retention policy (Section 9).

11.9 Governing Law and Dispute Resolution

These Terms are governed by the laws of India. Any disputes shall be subject to the exclusive jurisdiction of the courts in Pune, Maharashtra, India.

For users outside India, we will make reasonable efforts to resolve disputes amicably before resorting to legal proceedings.

11.10 Indemnification

You agree to indemnify and hold harmless Nanostuffs, its officers, directors, employees, and agents from any claims, damages, or expenses arising from your use of the Service, violation of these Terms, or infringement of third-party rights.

We use cookies and similar technologies for:

• Essential cookies — authentication, session management, security
• Functional cookies — user preferences, language settings, UI customization
• Analytics cookies — understanding usage patterns, feature adoption, performance monitoring
• Third-party cookies — may be set by AI providers, hosting services, or analytics tools

You can control cookies through your browser settings. Note that disabling essential cookies may impair Service functionality.

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that a child has provided personal information, we will take steps to delete it promptly.

If you are a parent or guardian and believe your child has provided personal information to us, please contact us immediately.

The Service may contain links to third-party websites, services, or integrations (e.g., AI model provider websites, documentation, support forums). We are not responsible for the privacy practices or content of these third parties.

We encourage you to review the privacy policies of any third-party services you interact with through our platform.

In the event of a data breach that may compromise your personal information, we will:

• Notify affected users via email within 72 hours of discovering the breach (where feasible)
• Provide details about the nature of the breach, data affected, and steps being taken
• Notify relevant supervisory authorities as required by applicable laws
• Take immediate remedial action to secure systems and prevent further unauthorized access

We may update this Privacy Policy and Terms & Conditions periodically to reflect:

• Changes in our data processing practices
• New features or services
• Legal or regulatory requirements
• Feedback from users and stakeholders

Material changes will be communicated via email or prominent notice in the platform. The "Last Updated" date at the top of this document reflects the most recent changes. Continued use of the Service after changes constitutes acceptance of the updated policy.

For privacy-related questions, rights requests, security concerns, or general inquiries:

We aim to respond to all privacy-related inquiries within 30 days. For urgent security matters, please mark your email as 'URGENT - SECURITY'.