Privacy, in plain language first.

LAST UPDATED 2026-07-06VERSION 1.0

This policy is unusual because the product is: BodhAI is built so that we cannot see your data. Every section below tells you exactly what that means in practice — what we hold, what we mathematically cannot hold, and where everything lives.

1 · Who we are

BodhAI is a product of the company named in our Terms of Service — the data fiduciary for the limited personal data described in §3.

The legal entity behind BodhAI is identified in our Terms of Service (§1), which is also the data fiduciary for the limited personal data described in §3 below. All correspondence about this policy runs through the contact form — we intentionally keep no direct public email addresses on this site.

2 · What this covers

Four things: this website, the cloud portal, the local product, and the online playground. Each handles data differently.

Website (bodhai.app) — marketing pages, this policy.
Cloud portal — where an admin creates an org, gets a license, and manages billing.
Local product — the server your organisation installs on its own hardware. This is where all your content lives.
Playground — a shared demo environment we host. Different rules; see §11.

3 · What we collect

Your admin’s email, your org’s name and plan, billing details required by law, and anonymous operational metrics. That’s the whole list.

Account: administrator email, name, organisation name, industry, and the org context you optionally provide at setup.
License & fleet: license key and status, plan, seat count, your server’s version and a last-seen heartbeat timestamp.
Seat activity: to enforce seat counts, your server syncs opaque user IDs with last-active timestamps. No names, no emails, no activity content — we cannot tell who your users are.
Billing: what Razorpay needs and Indian tax law requires — GSTIN, legal name, billing state, payment events, GST invoices. We never see card numbers (§8).
Invites: email addresses you invite to the portal, until consumed or expired.
Tunnel metadata: the Cloudflare tunnel and DNS record IDs that connect your server to your web client.
Correspondence: whatever you send us via the contact form or email.

4 · Telemetry, field by field

When your server answers a question, we learn that a question was answered and how fast — never what was asked.

Telemetry fields collected from the local server
Field	Example	What it can reveal
event_type	"query" / "ingest"	That the server did work
org_id	UUID	Which customer (not which user)
query_hash	SHA-256, first 16 hex	Nothing — one-way hash, text unrecoverable
retrieval / rerank counts	14, 5	Pipeline behaviour
timings (ms)	retrieval_ms, llm_total_ms…	Performance only
model_used, server_version	"qwen3-14b", "0.2.0"	What software ran
ingest: file_type, size	"pdf", 2.4 MB	Format & size — never name or content

There is no field in the schema that could carry document content, filenames, member identities, or answer text. This is enforced by the event structs in the shipping code, not by policy.

5 · What we never collect

Your documents, your questions, your answers, your people.

Documents, extracted text, previews, or embeddings
Questions (only one-way hashes), answers, or chat history
The knowledge graph — entities, relationships, communities
Generated artifacts (reports, exports)
Your members’ names, emails, or roles — accounts exist only on your server

6 · Where data lives

Everything content-shaped: your server. Everything account-shaped: our cloud.

Your server stores documents on disk (originals are never deleted — portability is a product guarantee), structured data and chat history in SQLite, and vectors in Qdrant — all on hardware you control. Our cloud (AWS) stores only §3.

7 · Emails we send

Invites, password resets, and receipts — via Amazon SES. No marketing without opt-in.

8 · Payments & GST

Razorpay processes payments; we never see your card. GST invoices are kept as tax law requires.

Payment instruments are handled entirely by Razorpay. We retain payment events and GST invoices for 2 years, as required for statutory and tax-filing purposes.

9 · Subprocessors

Three: AWS (hosting, email, transfer staging), Cloudflare (tunnel & DNS), Razorpay (payments).

Subprocessors and what they can see
Subprocessor	Purpose	Sees your documents?
Amazon Web Services	Cloud hosting, SES email, S3 transfer staging	NO — staged uploads are client-side encrypted
Cloudflare	Tunnel between your server & browser, DNS	NO — TLS pass-through
Razorpay	Payment processing	NO

10 · Retention & deletion

Cloud-staged uploads self-delete in 24 hours. Account data lives until you ask us to delete it. Local data was never ours to delete.

S3-staged transfers: deleted by lifecycle policy within 24 hours, always.
Telemetry: retained in aggregate for 90 days.
Account & billing: for the life of the account + statutory retention for tax records.
Local product data: on your hardware; uninstalling leaves your original files in place.

11 · The playground exception

The playground is our demo server, not your vault. Don’t upload anything confidential there.

Playground documents are processed on BodhAI-operated infrastructure and wiped periodically. It exists so you can feel the product before installing it — treat it like a public demo, because it is one.

12 · Cookies & local storage

No third-party advertising trackers. A session token, your preferences, and a flag that remembers you’ve seen our intro animation.

13 · How we secure what we do hold

Short-lived signed tokens, TLS everywhere, client-side encryption for anything staged.

Access tokens are RS256-signed and expire in 15 minutes; your server verifies them offline.
All traffic is TLS; the tunnel between your browser and your server is end-to-end.
Anything staged through our infrastructure is AES-256-GCM encrypted before it leaves your browser.
Bug reports pass a local PII scrubber (NER + regex) before transmission.

14 · Your rights under the DPDP Act

Ask what we hold about you, correct it, or erase it — one email.

Under the Digital Personal Data Protection Act, 2023 you may request access, correction, or erasure of the personal data described in §3. All grievances and DPDP requests are routed through the contact form — choose "Security" as the purpose — which reaches our team directly; we do not operate a separate DSAR portal at our current scale. For everything that lives on your own server, your organisation is the data fiduciary — requests go to your admin, not to us.

15 · Changes & contact

Material changes: 30 days’ notice by email. Questions: the contact form.

Material changes are announced to account admins by email with 30 days’ notice. Questions: through the contact form — every submission reaches the team directly.