Privacy Policy India

1. Scope & Applicability

This Privacy Policy operates in accordance with:

• Information Technology Act, 2000
• IT (SPDI) Rules, 2011
• Digital Personal Data Protection Act, 2023 (DPDP Act)

2. Information We Collect

2.1 Account Information

• Name, email address, company name
• Account identifiers and authentication data

2.2 Usage & Technical Data

• IP address, device and browser metadata
• Logs, timestamps, feature usage

2.3 Conversation Data

• Chat messages
• Voice call recordings or transcripts (if enabled)
• AI-generated responses

3. Purpose of Data Processing

We process personal data to:

• Provide and operate AI chat and voice services
• Manage billing, usage, and support
• Improve system performance and security
• Comply with legal and regulatory obligations

4. Data Sharing & Subprocessors

We may share data with trusted third-party vendors, including:

• International LLM Providers — OpenAI, Anthropic, Google Gemini (data may be processed outside India)
• Indian AI Providers — Sarvam AI (STT, LLM, TTS) — all data stays in India
• Speech-to-Text (STT) and Text-to-Speech (TTS) providers
• Telephony and WebRTC providers
• Cloud infrastructure — Google Cloud Platform, Mumbai region (asia-south1)
• Payment processor — Razorpay (India-based; all payment data stored in India per RBI mandate)

All vendors are bound by contractual confidentiality and security obligations.

4A. WhatsApp Business Platform & Meta Data Processing

ThinnestAI is a Meta Tech Provider, integrating with the WhatsApp Business Platform so that businesses using ThinnestAI ("Business Customers") can send and receive WhatsApp messages through our AI chat agents.

As part of this integration, we process the following on a Business Customer's behalf:

• The WhatsApp phone number of the person messaging the Business Customer
• Message content — text, media, and interactive replies — exchanged with the Business Customer's WhatsApp number
• Message metadata, including timestamps and delivery/read status
• The Business Customer's WhatsApp Business Account (WABA) profile information and approved message templates

This data is used solely to operate the AI agent answering on the Business Customer's behalf and to give that Business Customer visibility into their own conversations. For this data, ThinnestAI acts as a processor / technology provider — the Business Customer remains the data controller for their own end-customers' conversations. Meta's own handling of data that passes through the WhatsApp Business Platform is governed separately by Meta's Privacy Policy and the WhatsApp Business Solution Terms.

WhatsApp conversation data is retained under the same practices described in Section 5 below, and can be deleted on request — see our Data Deletion Instructions.

5. Data Retention

• Personal and conversation data is retained only as long as necessary to provide Services or meet legal requirements.
• You may request deletion of your data, subject to applicable law.

6. Data Security

We implement reasonable administrative, technical, and physical safeguards, including:

• Encryption in transit
• Access controls and monitoring

No system is completely secure; use of the Services is at your own risk.

6A. Data Residency & Indian Providers

When you use Indian AI providers (Sarvam STT, Sarvam LLM, our own TTS engine), all voice and conversation data is processed and stored exclusively in India within our GCP Mumbai (asia-south1) infrastructure.

When you use international providers (OpenAI, Anthropic, Google Gemini), data may be processed in the provider's data centers outside India, subject to the provider's own data processing policies.

All payment data is processed by Razorpay and stored in India in compliance with RBI data localization requirements.

Our infrastructure runs on Google Cloud Platform, Mumbai region:

• Cloud Run — application servers
• Cloud SQL — PostgreSQL database
• Memorystore — Redis cache
• Cloud Storage — file and voice recording storage

6B. Regulatory Compliance

ThinnestAI complies with the following Indian regulations:

• DPDPA 2023 — consent management, configurable data retention (default 180 days with auto-purge), right to erasure, and 72-hour breach notification
• RBI Data Localization — all payment data stored exclusively in India via Razorpay
• TRAI Telecom Compliance — DND/NCPR scrubbing, IST time-boxing (9 AM – 9 PM), AI disclosure, and 140-series number support

For full regulatory compliance details, please refer to our main Legal and Compliance page.

7. User Rights (India)

Subject to Indian law, you may:

• Request access to your personal data
• Request correction or erasure
• Withdraw consent where applicable

Requests can be sent to hello@thinnest.ai, or via our Data Deletion Instructions page.

8. Cookies

We use cookies and similar technologies to maintain sessions, analyze usage, and improve performance. Disabling cookies may impact functionality.

9. Children’s Privacy

Thinnest.ai does not knowingly collect personal data from individuals under 18 years of age.

10. Policy Updates

We may update this Privacy Policy from time to time. Continued use of the Services constitutes acceptance of the updated policy.

11. Grievance & Contact

For privacy or data-related concerns:

📧 hello@thinnest.ai