Privacy Policy

1. Who we are

DiscloseAI is operated by Vritah Technologies LLP, incorporated in India. This policy explains what data we collect through discloseai.tech, why, and the rights you have over it. It applies regardless of the size of our team — the obligations below don't scale down because we're a small company.

2. What we collect

• Inventory data: the jurisdictions and AI-tool answers you submit during an assessment, tied to a private access token and, if you save it, to your account.
• Email address: only if you voluntarily provide one during an assessment, or if you create an account.
• Account data: if you sign in, basic profile information (email, name) is handled by our authentication provider, Clerk.
• Payment data: for paid reports and plans, billing is handled by Paddle.net. We do not receive or store your card details — Paddle acts as merchant of record.
• Technical data: IP address, used transiently for rate-limiting abuse. The free scope check runs in your browser: the answers you give there are not sent to us unless you create an account, and then only the one EU answer that the inventory uses.

3. How we use it

To run the assessment you request, show your saved inventories on your dashboard, generate the paid PDF report, record who changed what and when for audit purposes, and prevent abuse of the free tier. For paid assessments saved to a team, we email the team's administrators a digest when a tool is overdue for review or the report was scored under rules that have since been updated.

We do not use your inventory answers to make any automated decision that produces legal or similarly significant effects about you. The verdicts our rule engine generates are advisory findings about the AI tools you describe, for your own use — they are not a decision made about you as a person, and nothing in the Service is used to profile visitors for advertising or similar purposes.

4. Legal basis for processing (EEA/UK visitors)

Where GDPR or UK GDPR applies, we rely on the following legal bases under Article 6(1):

• Contract (6(1)(b)): processing your inventory and account data to provide the assessment, report, and dashboard you've asked for.
• Legal obligation (6(1)(c)): retaining billing records as required by applicable tax and accounting law.
• Legitimate interests (6(1)(f)):rate-limiting abuse of the free assessment, and keeping the audit log that lets a team see who changed what — our interest in running a secure, accountable Service, balanced against your rights as described below.

5. Who we share it with

We use the following processors to run the Service:

• Vercel — application hosting and infrastructure. Vercel is US-headquartered; our project is hosted in an EU region. Vercel's own sub-processor list remains the authoritative detail.
• Neon — database hosting (PostgreSQL). Our database is hosted in Neon's eu-central-1 (Frankfurt, Germany) AWS region.
• Clerk — authentication and account management. Clerk is US-headquartered; our account is hosted in the EU. See Clerk's own sub-processor and data-residency documentation for detail.
• Paddle.net — payment processing and billing (merchant of record). Paddle is a UK-incorporated company; see Paddle's own sub-processor list for the regions its payment infrastructure uses.
• Resend — delivery of review-reminder emails. Resend is US-headquartered; our account sends from an EU region. See Resend's own sub-processor documentation for detail.
• GitHub — storage of our encrypted nightly database backups for 30 days. The backup files are encrypted before they are stored, and we hold the key. See GitHub's own documentation for its regions.

We do not sell your data. We do not share inventory data or account information with third parties for advertising purposes. If we add or replace a sub-processor, we will update this list and, for customers on a paid plan, note the change in our changelog or by email with reasonable notice before the new sub-processor begins processing your data.

6. International transfer

Vritah Technologies LLP is based in India. We host our infrastructure in the EU, but the providers listed above are headquartered outside the EU and may access data from outside it (for example for support or operations), and some of their own sub-processors may be outside the EU. Our team in India may also access data to run the Service. Where personal data protected by GDPR or UK GDPR is transferred outside the EEA/UK, we rely on that provider's own Standard Contractual Clauses or an equivalent safeguard as their transfer mechanism; we do not separately execute additional international transfer agreements at this time.

6a. EU/UK representative

Vritah Technologies LLP is not established in the EU/EEA or UK. Where GDPR Article 27 (or the equivalent under UK GDPR) requires us to appoint a representative in the EU/EEA or UK, we are in the process of doing so; this section will be updated with that representative's contact details once appointed.

7. Data retention

Inventory and audit data is retained while your account is active. If your account is deleted, we delete or anonymize inventory and account data within 30 days, except where we must keep it longer for a legal reason — for example, billing records required by tax law, or an audit-log entry that is itself the record of a change another user is entitled to see. Assessments started before sign-in was required and never saved to an account are deleted after 12 months of inactivity. Encrypted database backups are kept for 30 days and then deleted. You can request deletion of your account and associated data at any time by contacting us.

8. Security measures

Data in transit is encrypted (TLS) between your browser, our application, and our processors. Our database provider encrypts data at rest. Access to production data is limited to the people who operate the Service, and payment card details are never handled by us directly — Paddle, our merchant of record, handles that. We have not obtained a third-party security certification (such as SOC 2) at this time; if that matters for your organization's vendor requirements, contact us.

9. Your rights

Depending on your location, you may have some or all of these rights over your personal data:

• Access a copy of the data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data, subject to section 7's exceptions.
• Restrict or object to certain processing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent, where processing is based on consent.
• Lodge a complaint with your local data protection authority (in the EEA/UK) — this is in addition to, not instead of, contacting us directly.

To exercise any of these rights, contact us using the details in section 12. We will respond within the time limit your local law requires (for GDPR, generally one month).

10. Children's privacy

The Service is intended for business use and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

11. Data breach notification

If a breach involving your personal data occurs, we will notify affected users and, where legally required, the relevant supervisory authority, without undue delay after becoming aware of it.

12. Cookies

We use session cookies set by our authentication provider (Clerk) to keep you signed in. We do not use advertising or tracking cookies.

13. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the date at the top of this page.

14. Contact

Questions or data requests: contact@vritah.com