Your trust is our foundation.

How we protect your data, keep your conversations private, and align with India's data protection law.

TLS 1.3 in transit
AES-256 at rest
DPDP Act, 2023
72-hour breach notice

Principles

Six commitments we build around.

End-to-end encryption

All conversations are encrypted in transit using TLS 1.3. Data at rest is encrypted with AES-256.

No training on your data

Your conversations are never used to train or improve our AI models. Your queries stay private and confidential.

Data minimisation

We collect only what's needed to provide the service. No tracking pixels, no third-party analytics, no data brokers.

DPDP compliance

We comply with India's Digital Personal Data Protection Act, 2023. Your rights, our responsibility.

Incident response

In the unlikely event of a breach, we notify affected users within 72 hours, as per DPDP guidelines.

Regular audits

Security practices are reviewed quarterly by external auditors. We maintain SOC 2 Type II equivalent controls.

Your data

Exactly what we collect, and what we don't.

What we collect

Conversations: Your queries and our AI responses, for quality control and escalation context.
Contact information: Email and phone (optional), for human escalation and follow-ups.
Technical logs: IP addresses (anonymised after 7 days), timestamps and browser type, for security.
Payment data: Processed by payment gateway partners. We never store full card details.

What we never collect

Browsing history or third-party tracking
Location data beyond IP-based country detection
Social media profiles or contacts
Biometric or sensitive personal data (unless you explicitly share it)

Retention

How long we keep it

Active conversations
Legal compliance and service improvement
2 years
Anonymised logs
Aggregate analysis only, no personal data
Indefinite
Payment records
Required under Indian tax law
7 years
Deleted accounts
All personal data purged after a deletion request
30 days

DPDP Act

Your rights

Right to access your data
Right to correct inaccurate data
Right to erase your data (with legal exceptions)
Right to nominate a data guardian
Right to grievance redressal

To exercise your rights, email privacy@mysalahkar.com.

Third-party services

Trusted providers, under contract.

Every provider is vetted and contractually required to maintain data security. We never share customer data with advertisers, data brokers or unrelated third parties.

Category	Provider	Safeguards
Cloud infrastructure	AWS (Mumbai region)Hosting and data storage	Hosting and data storage
AI models	Anthropic Claude, OpenAI GPTData Processing Agreements in place	Data Processing Agreements in place
Payments	Razorpay, StripePCI DSS compliant processing	PCI DSS compliant processing
Communication	Twilio (WhatsApp), AWS SES (email)Encrypted channels	Encrypted channels

Questions about our security?

Our security and privacy teams are here to help.

security@mysalahkar.com privacy@mysalahkar.com