{"title":"AskforWrite AI Company OS — Privacy Policy & Data Protection Declaration","effective_date":"2026-10-14","company":"ASKFORWRITE","enterprise_type":"MSME Registered Enterprise (Government of India)","udyam_registration":"UDYAM-RJ-14-0018404","registered_office":"Udaipur, Rajasthan, India - 313001","contact":"info@askforwrite.in","copyright":"© 2026 ASKFORWRITE (UDYAM-RJ-14-0018404). All Rights Reserved.","sections":[{"heading":"1. Data Collection Scope","body":"We collect: (a) Account Identifiers: Name, company name, work email address, and PBKDF2/bcrypt-hashed credentials; (b) Organizational Metadata: Tenant slug, subscription tier, and entitled capability SKUs; (c) Field Telematics: Device coordinates, geofence timestamps, and cryptographic visit proof images/OTP verifications; (d) Payment References: Bank UTR numbers, transaction hashes, and invoice metadata (no credit card numbers are ever stored); (e) Cryptographic Audit Blocks: SHA-256 and ECDSA signatures ensuring tamper-evident provenance."},{"heading":"2. Strict BYOK Gemini Key Privacy & Zero-Retention Guarantee","body":"When you supply a Bring-Your-Own-Key (BYOK) Gemini API key (via request headers or your Customer Portal), it is treated as strictly confidential tenant property. It is: (a) stored encrypted in tenant metadata and masked in all API responses (e.g. AIza••••••••••••••••1a2b); (b) never printed in application logs or shared with any third party; (c) never accessible to other tenants; (d) never used to power any system-wide operations; (e) purged immediately upon tenant self-service removal or account deletion. ASKFORWRITE never trains machine learning models on tenant data."},{"heading":"3. Tenant Isolation & Multi-Tenant Architecture","body":"All customer records are partitioned strictly by organization ID (`org_id`). Database queries enforce tenant-scoped foreign key filters. Row-level data is inaccessible to unauthorized tenants. API rate-limiting dynamically protects each tenant from noisy-neighbor interference."},{"heading":"4. Data Retention, Portability & Right to Erasure","body":"Tenant operational data is retained for the active subscription period plus a 90-day grace period, after which it is permanently purged upon request. Under the Digital Personal Data Protection Act, 2023 (DPDPA), users have the absolute right to access, rectify, export (via GET /v1/audit/export in JSON/CSV), or delete their personal data by contacting info@askforwrite.in."},{"heading":"5. Subprocessors & Third-Party Processors","body":"We utilize strictly vetted subprocessors under bilateral data protection standards: (a) Google Cloud / Google AI (Gemini inference via tenant BYOK key); (b) ICICI Bank & Sovereign DirectPay (payment settlement verification); (c) Sentry & LangSmith (error telemetry and optional trace telemetry with PII scrubbed); (d) Redis Labs / In-Memory (sliding-window rate limiting)."},{"heading":"6. Security Infrastructure & Compliance","body":"Platform security controls include: TLS 1.3 encryption in transit; AES-256 encryption at rest; ECDSA NIST P-256 cryptographic audit sealing; strict Content-Security-Policy, HSTS, and X-Frame-Options headers; and automated rate limiting on all authentication and approval endpoints."},{"heading":"7. Data Grievance Officer & Statutory Contact","body":"In accordance with the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, the details of the Data Grievance Officer are: Name: Vipul Kumar Chobisa | Firm: ASKFORWRITE (UDYAM-RJ-14-0018404) | Email: info@askforwrite.in | Address: Udaipur Bus Stand, Udaipur, Rajasthan, India - 313001. All grievances are acknowledged within 24 hours and resolved within statutory timeframes."}]}