Privacy Notice

This notice explains what personal data AI Suite collects about you, why, who else sees it, how long it is kept, and what you can do about any of it. It is given under s. 5 of the Digital Personal Data Protection Act, 2023, before your data is processed rather than afterwards.

In the language of that Act, Deepsoch AI is the Data Fiduciary and you are the Data Principal. Version 2026-09-02.

Who to contact

Write to support@deepsoch.ai. Questions about what is held about you, the requests set out under Your rights below, and grievances under s. 13 all go to that one address. Section 8(9) requires a published contact able to answer for the processing of your personal data, and s. 6(3) requires the same contact on every consent request.

From inside the console there is a second route to the same people. The help button at the bottom right of every page opens Report a problem, which files a ticket and returns a reference you can quote. It shows you everything it is about to attach before it sends. Use the address above if you are not signed in, or no longer are: a notice you can only act on from behind a sign-in is not a notice.

No Data Protection Officer has been appointed, because that duty falls on a Significant Data Fiduciary under s. 10(2)(a) and the Central Government has not notified us as one. Section 8(9) asks everybody else for the contact of a person able to answer, and that is the address above.

What we collect, and what for

Every item below is collected for the purpose stated beside it, and is limited to what that purpose needs (s. 6(1)).

Your account

• Email address. Identifying your account and signing you in. It is the only field required to register.
• Name, display name and profile picture. Shown to you and to colleagues on shared work. Supplied by you, or by Google if you signed in with Google.
• Time zone and language preferences. Showing dates in your own time, and dictating and writing in the language you chose.
• Your confirmation that you are 18 or older, and the version of this notice you accepted. Keeping the console to adults, for the reason set out under Children below, and proving what wording was in front of you when you agreed (s. 6(10)). A yes or no and a date, never your age or your date of birth.
• Password, stored as an argon2id hash. Signing you in. The password itself is never stored and cannot be recovered from the hash. Passkeys, where you have registered them, are stored as public keys: the private half never leaves your device.

Your work

• Prompts, briefs and the settings of each run. Producing what you asked for, and letting you find and repeat it.
• Images, video and audio you upload. Used as the input to the run you uploaded them for.
• Dictation. Speech you record is transcribed to text for the prompt box. The audio is not kept after transcription.
• Generated outputs. Stored so your gallery survives, and retained after account closure: see Retention below, which is the one item on this page worth reading twice.
• Conversations with Anaya. Kept so a thread can be reopened.

Payments and generation time

• Amount, plan, currency, dates and the payment gateway’s own reference numbers. Taking payment, issuing receipts, and the statutory books of account.
• The generation-time ledger. Every grant, every charge and every refund, with how long the run took and what it came to, so your balance is auditable rather than asserted. A run that was not charged has a row saying why.

Card details never reach us.They are entered on the payment gateway’s own form and we receive only the outcome and a reference.

Security

• Sign-in times and method, failed attempt counts, IP address and browser user-agent string. Detecting and investigating unauthorised access, and rate-limiting attacks. Kept under s. 8(5), which obliges us to take reasonable security safeguards, and s. 17(1)(c).
• An audit record of administrative actions. Who changed what, and when.

Who else processes it

These are Data Processors under s. 2(k): they act on our instructions and for no purpose of their own.

Your work is not sold, and is not used to advertise to you. Nothing here is shared with anyone not listed above except where a law requires it.

Retention

When you close your account, most of what is listed above is destroyed. Three categories are not, and each has a reason:

• Payments, refunds and the billing ledger are kept, with your email removed. The Companies Act 2013, the Income-tax Rules and the CGST Act each require books of account to be retained for several years, and s. 12(3) permits retention that a law requires. What is kept is the amount, the date and the reference number, not you.
• The security and audit record is kept, with your email, IP address and user-agent removed. Under s. 8(5) and s. 17(1)(c).
• Generated outputs are kept, separated from you. The prompt that produced each one, the files you uploaded to make it and the tags you filed it under are all destroyed; the resulting image or video is retained without anything linking it to you. If you would rather it were destroyed too, say so when you ask for erasure and we will delete it.

Everything else, your profile, your password and passkeys, your conversations, your stories and briefs, your prompts, your uploads and your API keys, is destroyed.

What generating costs

Not a privacy matter, but the question that most often follows the one above. How a generation is charged, when it is free, and how long each kind usually takes are all set out at How charging works in your account. It is one page rather than two so that the policy and the figures it quotes cannot disagree.

Your rights, and how to use them

Required content under s. 5(1)(ii).

• Withdraw your consent: s. 6(4). Go to Security & sign-in in your profile and delete your account. It takes as few steps as signing up did, which is what that clause requires.
• Ask what we hold: s. 11. A summary of your personal data, what we do with it, and who it has been shared with. Ask the contact above. This is not yet self-service in the console.
• Correct or complete it: s. 12(1). Your name, display name, time zone and languages are editable in your profile. For anything else, ask the contact above.
• Ask for erasure: s. 12(3). The same button as withdrawing consent. Your account is locked immediately and everything above is destroyed after 30 days. The delay exists so a mistake, or somebody using your account without permission, can be undone, during that period an administrator can restore the account, and after it nothing can.
• Raise a grievance: s. 13. Use the contact above. We must respond within the period prescribed by the Rules made under the Act.
• Nominate someone: s. 14. You may name another person to exercise these rights if you die or become unable to. Ask the contact above.

The generation time you have not used is forfeited when you delete your account. Section 6(5) puts the consequences of withdrawing consent on you, so this is lawful, and it is stated here, before you press anything, because that is the condition on which it is lawful. Use it first if you want it.

Complaining to the Board

Required content under s. 5(1)(iii).

If you are not satisfied with our answer, you may complain to the Data Protection Board of India, established under s. 18. It functions as a digital office (s. 28(1)), so a complaint is made, heard and decided online. s. 13(3) requires you to raise the grievance with us first and give us the chance to answer, before approaching the Board. Its decisions can be appealed to the Telecom Disputes Settlement and Appellate Tribunal within sixty days (s. 29).

Children

A child is anyone under eighteen, s. 2(f) , and processing a child’s personal data requires verifiable consent from a parent or lawful guardian, who is then the Data Principal , s. 9(1) and s. 2(j)(i).

This console is for adults only. There is no parental-consent mechanism here and none of the verification s. 9(1) asks for, so rather than offer the service to under-eighteens without it, we do not offer it to them at all. Before the console opens for the first time, and again whenever this notice changes, you are asked to confirm you are 18 or older, in the same place you accept this notice and the terms. That confirmation is recorded with your acceptance. The Terms of Service make it a condition of holding an account.

A declaration is not verification, and this page will not call it one. It is the most we can ask without holding more about you than the question needs: an age or a date of birth would be a new piece of personal data kept on every adult in order to turn away a few, which is the opposite of what s. 6(1) asks for. If we find that an account belongs to a child, we close it and erase it. If you believe a child holds one, write to the address at the top of this page.

We do not track or profile children’s behaviour and do not direct advertising at children (s. 9(3)). This is true of every account: the console shows no advertising at all.

If something goes wrong

In the event of a personal data breach we are obliged to inform both the Board and every affected person, s. 8(6) , in the form the Rules prescribe.

Your own duties

Section 15 places a few on you, and they are short: do not impersonate somebody else when giving personal data, do not suppress material information, do not file a false or frivolous grievance, and give information that is authentic when asking for a correction. The Act attaches a penalty of up to ten thousand rupees to a breach of these.

Changes to this notice

Consent is specific to a purpose. When the wording here changes in a way that affects what you agreed to, the version above changes with it and you will be asked to read and accept it again the next time you sign in. Your previous acceptance is not treated as covering new wording.

Reading this in another language

Section 5(3) entitles you to this notice in English or in any language listed in the Eighth Schedule to the Constitution. English is what is published here. Ask at support@deepsoch.ai for any of those languages and we will send you this notice in it, at no charge, along with the terms if you want them too.

A translation is given so you can read it, not so it can replace what you agreed to. The version number above names the English wording, and that is the wording your acceptance is recorded against, so where a translation and the English differ, the English is the notice.