Effective date: 5 October 2026 · Last updated: 5 October 2026

This Privacy Policy explains how Drishti ("we", "us", "our") collects, uses, stores, and protects information when you visit our website, use our platform, or interact with an AI agent built on Drishti.

We are based in Muzaffarpur, Bihar, India. We operate under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and, where applicable, other data protection laws.

1. Who We Are

Operator: [YOUR FULL NAME], operating as Drishti Address: Muzaffarpur, Bihar, India Contact: hello@drishti.app Grievance Officer: [GRIEVANCE OFFICER NAME] Grievance Email: grievance@drishti.app

Drishti provides an AI-powered sales and support agent to businesses ("Clients"). Our Clients deploy Drishti on their websites and communication channels to handle customer enquiries. In this role:

• Our Clients are the Data Fiduciaries. They decide what customer data is collected and why.
• Drishti is a Data Processor. We process customer data on behalf of our Clients, according to their instructions and this policy.
• For our own website visitors and pilot applicants, Drishti is the Data Fiduciary. We decide what we collect on our marketing site and dashboard.

2. What We Collect

When you visit our website

• IP address, browser type, device type, and operating system (in server logs)
• Pages visited and time spent (only if analytics is enabled; see our Cookies Policy)
• Any information you voluntarily submit through forms (name, email, business name)

When you use the Drishti dashboard (as a Client)

• Your login email and hashed password
• Business configuration you enter: product catalogue, pricing, policies, brand settings, payment method details
• Conversation history and lead records generated by your Drishti agent

When you interact with a Drishti agent (as a customer of one of our Clients)

• Messages you send to the agent and the agent's replies
• Your name, if you provide it, or the name used in the conversation
• Phone number, if you provide it or if the Client's agent requires it for bookings
• Any documents you upload (such as prescriptions, if used by a hospital Client)
• Your IP address and request metadata (for security and rate limiting)

We do not collect:

• Payment card details — payments are handled by the Client's own payment processor
• Biometric data
• Data from children under 18 without verifiable parental consent

3. Why We Collect It

• To provide the service: the agent needs to remember conversations to have coherent dialogue
• To sync with your CRM: if you configure a webhook, we forward lead events to your configured endpoint
• To notify you: trial reminders, lead conversions, escalation alerts
• To secure the platform: rate limiting, abuse prevention, and lockout after failed login attempts
• To improve the product: aggregate analytics about usage patterns (never individual conversation content)

We do not sell your data. We do not use your data to train our AI models or anyone else's.

4. Where Your Data Lives

We use the following service providers (sub-processors) to operate Drishti:

• Neon — PostgreSQL database hosting (AWS US East)
• Railway — application server hosting
• Vercel — frontend hosting and edge network
• Cloudinary — media storage (product images, 360° tours, documents)
• Resend — transactional email delivery
• OpenRouter — LLM routing (conversation processing)
• Sentry — error tracking (no conversation content is sent)

Conversation content may be processed by AI language models to generate agent responses. These models do not store your data for training purposes.

5. How Long We Keep It

• Active Client accounts: for as long as the account is active
• Conversation and lead data: for the duration of the Client's subscription, then 30 days after cancellation
• Trial accounts that do not convert: 30 days after trial expiry
• Server logs: 30 days
• Webhook delivery logs: 90 days
• Login attempt records: 15 days

After these periods, data is deleted or anonymised.

6. Your Rights

Under the DPDP Act, 2023, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Erase your data, subject to legal retention requirements
• Withdraw consent at any time, without affecting the lawfulness of prior processing
• Grievance redressal — lodge a complaint with our Grievance Officer
• Nominate another individual to exercise these rights on your behalf

To exercise any of these rights, email grievance@drishti.app. We will respond within 30 days.

If you are a customer of one of our Clients (i.e., you spoke to a Drishti agent on a Client's website), please contact the Client directly first — they control that data. We will assist them on request.

7. Security

We protect data using:

• Row-level security (RLS) in our database, so no Client can access another Client's data
• Passwords hashed with bcrypt — never stored in plain text
• API keys hashed with SHA-256 before storage
• HTTPS/TLS for all network traffic
• HMAC-SHA256 signatures on all webhook deliveries
• Rate limiting and brute-force protection on authentication endpoints

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant authority as required by law.

8. Cookies

Our website uses minimal, essential storage. See our Cookie Policy for full details. We do not use tracking cookies for advertising.

9. Children

Drishti is not intended for use by individuals under 18. If you become aware that a child has provided us with personal data without verifiable parental consent, please contact us and we will delete it.

10. Changes to This Policy

We may update this policy. Material changes will be announced on this page with a new "Last updated" date. Continued use of Drishti after changes constitutes acceptance.

11. Governing Law

This policy is governed by the laws of India. Any disputes will be subject to the exclusive jurisdiction of the courts of Muzaffarpur, Bihar.

12. Contact

For any questions about this Privacy Policy:

Email: hello@drishti.app Grievance Officer: [GRIEVANCE OFFICER NAME] · grievance@drishti.app Address: Muzaffarpur, Bihar, India