Privacy Policy
This page describes how SutraAI handles personal data. It is provided as a template and should be reviewed with your legal counsel before publication.
Who we are
SutraAI is a multi-tenant AI assistant platform. When you use a tenant\u2019s assistant, that tenant is the data fiduciary/controller for their end-users\u2019 data; SutraAI acts as the processor. Primary data is hosted in India (AWS ap-south-1).
What we process
- Account data: name, email, and authentication details for tenant administrators and agents.
- Interaction data: questions and answers exchanged with an assistant (chat history).
- Uploaded knowledge: documents a tenant provides for their assistant to answer from.
- Consent records and audit metadata for accountability.
How we protect it
Field-level encryption for secrets, role-based access control with multi-factor authentication, strict per-tenant isolation, real-time PII masking, a prompt-injection firewall, and response lineage/audit trails. Security & privacy by design. Designed to align with India’s DPDP Act 2023 and the EU GDPR.
Retention
Personal data is retained only as long as needed for the purpose it was collected, per configurable per-tenant retention policies, after which it is automatically purged.
Your rights
Subject to applicable law (India\u2019s DPDP Act 2023 and the EU GDPR), you may request access to, a copy of (portability), correction of, or erasure of your personal data, and you may withdraw consent for non-essential processing at any time.
Make a data request
Use the form below to submit an access/export, correction, or erasure request. We may need to verify your identity before we act on it.
Grievance Officer / Data Protection Contact
For privacy questions, consent changes, or to exercise your data rights.
Data Protection Office — privacy@sutra.ai