Privacy policy

Who we are

VaaniAPI (“we”, “us”) provides AI-powered customer-support software. For data you upload into your workspace, you are the Data Fiduciary / Controller and we act as the Data Processor. For data about your own use of our website and dashboard, we are the Data Fiduciary.

Data we collect

• Account data - name, work email, business name, role, and hashed authentication credentials.
• Billing data - plan, invoices, GSTIN and billing address. Card and UPI details are handled by our payment gateway; we never see or store full card numbers.
• Knowledge-base content - documents, URLs and text you upload so the AI can answer from them.
• Conversation data - messages exchanged with your end customers through the widget or connected channels, plus the source chunks used for each answer.
• Usage and device data - pages viewed, feature usage, IP address, browser and device type, collected through cookies and server logs.
• Support communications - emails and messages you send us.

How we use it

• To provide the service: retrieving grounded answers, routing escalations and showing analytics.
• To bill you and issue GST-compliant invoices.
• To secure the platform: abuse detection, rate limiting and audit logs.
• To support you when you contact us.
• To improve the product in aggregate. We do not train foundation models on your knowledge-base or conversation content.
• To send service notices; marketing email only where you have opted in, with an unsubscribe link in every message.

Legal basis and consent

Where the DPDP Act, 2023 applies, we process personal data on the basis of your consent or for the legitimate uses the Act permits. Where the GDPR applies, our bases are contract performance, legitimate interests (security and product improvement) and consent for analytics and marketing cookies.

You can withdraw consent at any time by writing to us; withdrawal does not affect processing already carried out.

Cookies and analytics

Strictly necessary cookies keep you signed in and hold your theme preference. Analytics cookies (Google Analytics 4, and Microsoft Clarity where enabled) are only set after you accept them in the consent banner. We run Google Consent Mode v2 with storage denied by default, so no analytics cookies are written until you accept.

Sharing and sub-processors

We do not sell personal data. We share it only with vendors who process it on our behalf under contract: cloud hosting and storage, our payment gateway, transactional email delivery, the AI model provider used to generate answers, error monitoring and analytics.

A current sub-processor list is available on request at the contact address below, and we give notice before adding a new one that processes customer content.

Storage, retention and transfers

Customer content is stored in tenant-isolated databases; every query is scoped to a single business at the database layer. Data is encrypted in transit (TLS) and at rest.

We keep account and billing records for as long as the account is active and thereafter for the period Indian tax and company law requires. Conversation transcripts and knowledge-base content are deleted within 30 days of account closure or on request.

Where a sub-processor is located outside India, transfers are made under contractual safeguards and only to jurisdictions not restricted by the Government of India.

Your rights

We respond to verified requests within 30 days.

• Access - get a copy of the personal data we hold about you.
• Correction and erasure - fix inaccurate data or ask us to delete it.
• Withdrawal of consent - stop processing that relies on consent.
• Grievance redressal - raise a complaint with our grievance officer and, if unsatisfied, with the Data Protection Board of India.
• Nomination - nominate another person to exercise your rights in the event of death or incapacity, as provided by the DPDP Act.

Children

The service is not directed at children under 18. We do not knowingly collect their personal data, and where our customers operate in education we require that a parent or institution is the account holder.

Contact and grievance officer

Privacy questions and data requests: hello@vaaniapi.com. Grievance Officer (as required by the DPDP Act, 2023 and the IT Rules, 2021): the officer's name, designation and postal address are published on our contact page and in the account dashboard.

We will acknowledge a grievance within 24 hours and resolve it within 15 days.

Changes

Material changes are announced by email and in the dashboard at least 14 days before they take effect. The “last updated” date at the top of this page always reflects the current version.