Privacy Policy

Last updated: 29 September 2026

Who We Are

Datavtar AI Private Limited ("Datavtar," "we," "us") operates the Datavtar AI operating system for logistics at one.datavtar.com and the marketing website at datavtar.com. Datavtar acts as a data processor for the content your organization provides to or connects with the platform, and as a data controller for account information, usage data, and platform operations.

What Data We Collect

Platform (one.datavtar.com)

When you use the Datavtar platform, we collect:

Account information: email address, name, organization name
Documents and knowledge you upload to the platform
Queries, conversations, and interactions with the AI
Usage data: feature usage, session duration, actions taken

Google account & Drive

When you connect your Google account, you grant Datavtar access via OAuth to:

Your basic Google profile (name, email) — to sign you in.
Specific Google Drive files you choose — via the drive.filepermission, which lets Datavtar access only the individual files you explicitly open with the app, or files the platform creates for you (for example, when an app you build saves its output to your Drive). Datavtar cannot see, read, or index any other file in your Drive.

Datavtar never receives or stores your Google password. The permission you grant is stored encrypted, and you can disconnect it at any time. Disconnecting in your Datavtar settings withdraws the permission at Google and deletes it from Datavtar. Removing Datavtar in your Google Account permissions stops Datavtar reaching your Drive, and the permission is deleted from Datavtar when Google reports the change, when you disconnect in your Datavtar settings, or when your organization is deleted.

Microsoft 365 mailbox (writing voice)

If you choose to learn your writing voice from emails you have sent, you grant Datavtar read access to your Microsoft 365 mail. This is the permission Microsoft offers for reading mail, so the Microsoft consent screen describes it as reading your mail. Datavtar uses it only to list your Sent Items and to read the emails you select there. The emails you select are read once and sent to the AI service that produces the description, which processes them under terms that prohibit training on them. Datavtar does not keep the emails themselves. Datavtar keeps only the resulting description of how you write, a few short style traits, and up to three example emails, one of which is an anonymised version of an email you selected, together with that email's original subject line and date. You can edit or delete these at any time. Datavtar discards its copy of the permission within 15 minutes, and as soon as the run finishes. The permission Microsoft issued expires on Microsoft's own schedule, and you can revoke it at any time from your Microsoft account. Your organization's administrator can turn this option off for the whole organization.

Google BigQuery

If you connect a BigQuery project with your Google account, you give Datavtar permission to query BigQuery on your behalf. Google's consent screen describes this permission as viewing and managing your BigQuery data, because running any query requires it. Datavtar uses it only to list the projects and datasets your account can already access, and to run read-only queries that answer your questions. What Datavtar can read is limited by your own BigQuery permissions. Your question, the names of the tables and columns involved, and the query results are processed by the AI service that writes your answer, under terms that prohibit training on them. Datavtar keeps the answers, charts and results of the reports you save, and, for the numbers and charts you keep on your Overview, the question and answer each came from and its values or results, including each earlier result, which it refreshes on a schedule. An answer you have not saved is kept for up to one hour, so that you can still save it. Each query Datavtar runs is recorded in your organization's audit log with its table, its query text and the number of rows it returned. If you share a saved report by link, anyone with the link can view that report until you stop sharing it or the link expires, and your organization's administrator can turn off sharing for a data source. Datavtar stores its permission encrypted. When you disconnect the source or remove your sign-in, when you are removed from your organization, or when your organization is deleted, Datavtar deletes that permission and revokes its access with Google, once no other data source in Datavtar still uses the same Google account. If Google can't be reached at that moment, Datavtar keeps the encrypted permission only to try again, and deletes it as soon as Google confirms the revocation. You can also revoke it at any time from your Google Account permissions.

Other connected systems

Beyond Google services, you may connect other business systems and data sources to the platform through connectors you choose to enable. Any data accessed through those connectors is processed as your organization's content — solely to provide the features you use, under the same isolation, encryption, and access controls described in this policy.

Website (datavtar.com)

When you visit our marketing website, we collect:

Information you provide through the Book a demo form: your name, work email, company, and job title. These details are submitted only when you choose to fill out and send the form, and are used to follow up about your interest in the Datavtar platform. The request also carries the page and campaign details described under "Where a sign-up or demo request came from" below, which Datavtar uses to count which pages and campaigns lead to demo requests.
With your consent, analytics and session-insight data describing how visitors interact with the website (see "Cookies, analytics and session insights" below). It is anonymous unless you then sign up or request a demo, when the details listed under "Where a sign-up or demo request came from" are kept with it.

When you send the form, Cloudflare Turnstile checks that the request comes from a person rather than an automated script. For this check, Cloudflare processes technical information from your browser, such as your IP address.

A demo request is stored in the Datavtar platform's database in France, as a task for the Datavtar team in Datavtar's own organization, separate from any customer organization's data. Access is restricted to authorized Datavtar personnel. We send you one email confirming the request. We do not share these details with third parties, and we do not use them for newsletters or marketing campaigns beyond responding to your specific request. You can ask us to delete the request at any time by emailing privacy@datavtar.com.

How We Use Google Data

Datavtar uses your Google data solely to provide the features you use. Your Google data is:

Used only to provide the search, analytics and application features you use
Never shared with other organizations or users outside your organization, unless you choose to share a saved report by link
Never used for advertising, marketing, or profiling purposes
Never sold to third parties or used for purposes other than providing the Service to you

When an app you build creates a file in your Drive, it is written directly to your Google Drive — not stored separately on Datavtar's servers.

We Never Train on Your Data

Your documents, conversations, business context, and any content you provide to the platform — including content accessed from connected sources — are never used to train, fine-tune, or improve any AI models, and we contractually require our AI providers not to use it for that purpose either. Your content is never shared with other organizations.

Data Isolation

Your document content and knowledge are stored in a dedicated, isolated store for your organization. Each organization gets its own separate knowledge store — your documents are never mixed with another organization's data. Account metadata and configuration are logically isolated per organization with strict access controls, ensuring no organization can access another's information.

Sub-Processors and Other Third Parties

Datavtar works with the following third parties to deliver and operate the Service. Most act as sub-processors, processing data on our behalf; where a party acts as an independent controller — such as our payment provider — that is indicated.

Infrastructure

Microsoft Azure — cloud hosting, compute, and delivery of the web application's static assets
Cloudflare — network security, content delivery, transactional email delivery, and the automated-request check on the website's demo form (Turnstile)

AI Providers

Google — AI processing and knowledge-content storage
Anthropic — AI processing
OpenAI — AI processing (application building)

We use leading AI providers — currently Google, Anthropic and OpenAI — to power search, knowledge, and application-building features. They process your content solely to deliver the features you use, under data processing agreements, and do not use it to train their AI models.

Billing and business operations

Paddle — billing and payment processing (merchant of record; independent controller for payment data)

Marketing website analytics

The following sub-processors operate only on the marketing website (datavtar.com) and only after you grant consent. They have no access to the Datavtar platform or to any customer organization's data.

Google LLC — Google Analytics 4 (anonymous web analytics)
Microsoft Corporation — Microsoft Clarity (heatmaps and anonymized session insights)

A complete sub-processor list with entity names, processing locations, and purposes is available upon request at privacy@datavtar.com. We will notify customers of any changes to sub-processors at least 30 days before the change takes effect.

Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data on the following legal bases:

Performance of a contract (Art. 6(1)(b) GDPR) — to provide the Service you signed up for, including account management, document processing, search, and AI-generated responses, and to respond to a demo request you send us before any contract exists
Consent (Art. 6(1)(a) GDPR) — when you connect your Google account via OAuth and select which folders Datavtar may access. You can withdraw this consent at any time by disconnecting your Google account.
Legitimate interest (Art. 6(1)(f) GDPR) — for platform security, fraud prevention, usage analytics to improve the Service, audit logging, and counting which pages of our website lead to sign-ups and demo requests. We do not use legitimate interest as a basis for sending marketing, for advertising, or for profiling.
Legal obligation (Art. 6(1)(c) GDPR) — where required by applicable law

International Data Transfers

Datavtar AI Private Limited is incorporated in India. The core platform — application, databases, and backups — is hosted within the European Union (France). Your data may be transferred to and processed in the following jurisdictions:

France (EU) — core platform infrastructure: application, databases, and backups
United States — AI processing by Google, Anthropic and OpenAI, including the storage and indexing of your uploaded knowledge content by Google to provide search; network, content-delivery, email and demo-form checking services (Cloudflare); marketing-website analytics with consent (Google LLC, Microsoft Corporation)
United Kingdom — billing and payment processing (Paddle)
India — engineering and support operations by the Datavtar team

Separately, the static files that make up the web application — code, stylesheets and images — are distributed through a global content delivery network so that pages load quickly wherever you are. Serving them involves transient connection data such as your IP address. No account data, uploaded content, or other personal data is stored at these edge locations.

For transfers outside the EEA, we rely on the following legally recognized mechanisms:

EU–US Data Privacy Framework (DPF) — primary safeguard for transfers to United States sub-processors that are DPF-certified, including Google LLC, Cloudflare, Inc., and Microsoft Corporation
Standard Contractual Clauses (SCCs) — per European Commission Decision 2021/914, incorporated into our agreements for transfers outside the EEA. Where your organization (as controller) entrusts content to Datavtar (as processor) — including access by our engineering and support team in India — the Controller-to-Processor module applies, as completed in our Data Processing Agreement; onward transfers to our sub-processors, such as the US AI providers, are made under the Processor-to-Processor module. This includes our onward transfers to Anthropic and OpenAI, which are not Data Privacy Framework participants
UK transfers — the UK International Data Transfer Addendum applies to any onward transfer of UK-origin personal data outside the United Kingdom. Our billing provider (Paddle) acts as an independent controller for payment data and is responsible for its own transfer safeguards
Adequacy decisions — where the European Commission has determined that a third country provides an adequate level of data protection

You can request a copy of the applicable transfer safeguards by contacting privacy@datavtar.com.

Cookies, analytics and session insights

Cookie and analytics behavior differs between the Datavtar platform and the marketing website. We describe each separately so that the distinction is precise.

Platform (one.datavtar.com)

The Datavtar platform uses only the cookies and session storage required for sign-in, security, and operation of the Service. The platform does not load any third-party analytics, session-recording, or advertising scripts, and no third-party cookies are set when you use the platform.

To improve the Service, Datavtar records which areas of the platform each person opens on each day, and reports of errors that occur in the browser. A usage record holds the area’s name, the date, and the identifiers of the person’s account and organization. An error report holds the error’s type and its message, with web addresses, email addresses, identifiers, numbers and longer quoted text removed; the path of the page, with identifiers replaced; the places in the app’s code where the error occurred; the area of the platform; the app’s version; the browser’s name and major version; and, when the person is signed in, the identifiers of their account and organization. Both stay in Datavtar’s own systems in the European Union.

When an organization is created, Datavtar keeps how the sign-up was made (email and password, Google or Microsoft) and where it came from, as the sign-up link carried it: the website page the sign-up started from and, where known, the first page of that visit, its campaign details and the referring website. A link to the platform from an email or an advertisement can carry campaign details in the same way.

Marketing website (datavtar.com)

The marketing website uses three categories of cookies and similar technologies. Only the first category loads by default; the other two require your prior consent through the cookie banner shown on your first visit. You can change your decision at any time via the "Cookie preferences" link in the website footer.

Strictly necessary

Used for sign-in to the administrative content area, basic security, and to remember your consent choice itself. These cookies do not require consent under Article 5(3) of the ePrivacy Directive because they are strictly necessary to provide the service you requested. They are set by datavtar.com only.

Analytics (opt-in)

With your consent, we use Google Analytics 4, provided by Google LLC (United States), to measure aggregate usage of the marketing website — which pages are viewed, how long visitors stay, where traffic originates. We have enabled IP anonymization and disabled Google Signals. We do not use Google Analytics for advertising, remarketing, or profiling. Google may act as an independent data controller for some forms of measurement; their privacy practices are described at policies.google.com/privacy.

Cookies set: _ga, _ga_<container>; session storage: dv:attribution:v1, for the visit only
Maximum retention: 14 months from last visit
Legal basis: consent (GDPR Art. 6(1)(a); ePrivacy Directive Art. 5(3))
Transfer mechanism for processing in the United States: Google LLC is certified under the EU–US Data Privacy Framework. Standard Contractual Clauses apply as a secondary safeguard.

Where a sign-up or demo request came from

The Get started link always carries the path of the website page it was clicked on, and a demo request carries the path of the page the form was opened from. Campaign details go with them when they are in the address of that page and the visit began there. With analytics consent, the website also keeps the first page of your visit, its campaign details and the referring website in your browser for the rest of the visit (dv:attribution:v1 in session storage, removed when you withdraw consent), and passes them on in the same way. Datavtar keeps these details with the organization you create or the demo request you send, and counts which pages and campaigns lead to sign-ups and demo requests.

Session insights (opt-in)

With your consent, we use Microsoft Clarity, provided by Microsoft Corporation (United States), to capture aggregated heatmaps and anonymized session replays. This helps us identify friction points in navigation and content. Form fields, credentials, and any element marked sensitive are masked at capture time. The administrative content area is excluded entirely — Clarity is never loaded on it. Microsoft's privacy practices are described at privacy.microsoft.com/privacystatement.

Cookies set: _clck, _clsk, and related local-storage entries
Maximum retention: 13 months
Legal basis: consent (GDPR Art. 6(1)(a); ePrivacy Directive Art. 5(3))
Transfer mechanism for processing in the United States: Microsoft Corporation is certified under the EU–US Data Privacy Framework. Standard Contractual Clauses apply as a secondary safeguard.

Withdrawing or changing consent

You can withdraw or change your consent at any time, with the same one-click ease with which you granted it, via the "Cookie preferences" link in the website footer. For analytics, withdrawal stops further data collection immediately. For session insights, the active recording session ends immediately and the underlying script is not reloaded on subsequent page loads. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Historical data collected prior to withdrawal will be deleted in accordance with the retention periods above, or earlier on request to privacy@datavtar.com.

What we do not do

We do not load advertising pixels or remarketing tags of any kind.
We do not engage in cross-site tracking or device fingerprinting beyond the cookies described above.
We do not sell or share personal information with third parties for advertising purposes (within the meaning of the California Consumer Privacy Act).
We do not use Global Privacy Control as a substitute for explicit consent, but we honor it where applicable.

Data Retention and Deletion

Account and organization data: retained while your account is active. Upon account deletion, your organization's content, conversations, knowledge, and account data enter a recovery window of up to 90 days (during which an export can be requested and the deletion reversed), after which the active data is permanently and irreversibly erased from our systems; residual copies in encrypted backups are purged on the standard backup rotation cycle and remain inaccessible for live use until then.
Documents and knowledge: retained while your account is active. When you delete a specific item, it is permanently removed within 30 days, including from sub-processor systems.
App previews and pre-change copies: when you ask for a change to an app you built, a preview runs on a copy of that app's data for 7 days, extendable once by a further 7 days. Datavtar deletes the preview and its copy of the data when the change is activated or discarded, or when the preview expires. A copy of the data taken immediately before a change is activated is kept for 30 days so the change can be reversed, then deleted. That copy is kept longer only while a move of the app's data is unfinished. Both are deleted with the app. Recovery copies kept by Datavtar's hosting provider are kept for up to 30 days after each deletion and then permanently removed.
Screenshots attached to a change request: captured only when an organization administrator has enabled them and you have chosen which screens to send. They are used only to prepare that request's summary. Datavtar deletes them from its storage when the request is approved or discarded, when the change cannot be summarized or built, or when an unsent draft is left after 7 days without activity. Recovery copies kept by Datavtar's hosting provider are kept for 30 days after that deletion and then permanently removed. The AI service that prepares the summary processes them under terms that prohibit training on them.
Queries, conversations, and AI interactions: retained while your account is active. Deleted upon account termination or individual deletion.
Audit logs and usage data: retained for security, fraud-prevention, billing, and compliance purposes. Authentication and security logs are permanently erased when your organization is deleted.
Product usage records: kept for 25 months, then deleted. A person’s records are deleted when they are removed from their organization, and an organization’s when it is permanently erased.
Browser error reports: kept for 90 days, then deleted. They are deleted sooner in the same cases as product usage records.
Sign-up source: kept for as long as the organization exists.
Access to your Google account: deleted immediately when you disconnect a Google account. If Google cannot be reached at that moment, Datavtar keeps asking and deletes it as soon as Google confirms. The names and links Datavtar recorded for the files it opened or created are kept until your organization is deleted.
Backups: residual copies in encrypted backups are purged on the standard rotation cycle and are inaccessible for live processing in the interim.

If you wish to delete your entire account and all associated data, contact us at privacy@datavtar.com.

Your Rights

Depending on your location, you may have the following rights under applicable data protection laws, including the GDPR:

Access (Art. 15) — request a copy of the personal data we hold about you
Rectification (Art. 16) — request correction of inaccurate or incomplete data
Erasure (Art. 17) — request deletion of your personal data ("right to be forgotten")
Restriction (Art. 18) — request that we limit processing of your data in certain circumstances
Data portability (Art. 20) — receive your data in a structured, machine-readable format or request transfer to another provider
Objection (Art. 21) — object to processing based on legitimate interest
Withdraw consent (Art. 7(3)) — withdraw consent at any time where processing is based on consent (e.g., Google Drive connection), without affecting the lawfulness of processing before withdrawal
Supervisory authority — lodge a complaint with your local data protection authority if you believe your rights have been violated

To exercise any of these rights, contact us at privacy@datavtar.com. We will respond within one month of your request, as the GDPR requires — extendable by up to two further months for complex or numerous requests, in which case we will let you know.

Where Datavtar processes personal data on behalf of your organization — the content in your knowledge store and the sources you connect — your organization is the data controller. If you are an employee or end user of a Datavtar customer, please direct requests concerning that content to your organization; we will assist the controller in responding. For personal data where Datavtar is the controller, such as your account and billing information, you may exercise these rights with us directly.

Security

We protect your data through the following measures:

Encryption — all data encrypted in transit (TLS 1.2+) and at rest. OAuth credentials stored in an isolated, encrypted credential vault.
Access controls — role-based access with organization-level isolation. Access to customer data is restricted to authorized personnel required for platform operations, and all access is logged.
Audit trails — administrative actions and changes to customer data are logged for accountability and compliance.
Infrastructure — the platform's application, databases and backups are hosted on Microsoft Azure (EU/France); AI processing is provided by Google, Anthropic and OpenAI. These providers maintain recognized independent security certifications such as SOC 2 Type II and ISO 27001. Datavtar is pursuing independent security certifications as the company scales.

Incident Response

In the event of a confirmed personal data breach affecting data for which Datavtar is the controller, such as account and billing information, we will notify the relevant supervisory authority without undue delay and within 72 hours of becoming aware, as required by GDPR Art. 33, and inform affected individuals where the breach is likely to result in a high risk to their rights. Where a breach affects personal data we process on behalf of your organization, we will notify your organization — the controller — without undue delay and within 72 hours of becoming aware of the breach, with the nature of the breach, its likely consequences, and the measures taken or proposed to address it, so that it can meet its own notification obligations.

Automated Decision-Making

Datavtar uses AI to process queries, generate responses, classify documents, and help you build and run applications. These features assist your team's work. Where you choose to deploy an application or schedule an automated task, it runs according to the rules and parameters you configure, under your control as the data controller. Datavtar does not use AI to make solely automated decisions that produce legal or similarly significant effects on individuals (GDPR Art. 22).

Sensitive Data

Datavtar does not intentionally collect special categories of personal data as defined by GDPR Art. 9, including data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation. If your uploaded documents or connected drive folders contain such data, it is processed solely to provide the Service and is subject to the same isolation, encryption, and access controls as all other data.

Applicability of Indian Data Protection Law

Datavtar AI Private Limited is incorporated in India. To the extent the Digital Personal Data Protection Act, 2023 (DPDPA) applies to our processing of your personal data, we comply with its requirements regarding consent, purpose limitation, data retention, and the rights of data principals. Your rights under the DPDPA — including the right to access, correction, erasure, and grievance redressal — may be exercised by contacting us at privacy@datavtar.com.

Children's Data

The Service is designed for business use and is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will promptly delete that information.

Google API Services — Limited Use Disclosure

Datavtar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We only use Google user data to provide or improve user-facing features that are prominent in the Datavtar platform's user interface
We only transfer Google user data to others if necessary to provide or improve user-facing features, with the user's affirmative consent, for security purposes, or to comply with applicable laws
We do not use or transfer Google user data for serving ads, including retargeting, personalized advertising, or interest-based advertising
We do not allow humans to read Google user data unless the user has provided affirmative consent, it is necessary for security purposes, it is necessary to comply with applicable law, or the data (including derivations) is aggregated and anonymized and used for internal operations in accordance with applicable privacy requirements

Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email to registered users at least 30 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.

EU Representative

Datavtar AI Private Limited is established outside the European Union. In accordance with Article 27 of the GDPR, we have designated a representative in the Union who may be contacted by data subjects and supervisory authorities on all issues relating to our processing of personal data:

HoSuMuKu Communications B.V. (trading as XPL-AI)
Schildgronden 24, 2134 ZW Hoofddorp, Netherlands
eugenius.otte@xpl-ai.tech

Contacting our EU representative does not affect your right to contact Datavtar directly, or to lodge a complaint with your local supervisory authority.

Contact

For privacy-related questions or requests, contact us at privacy@datavtar.com.

Datavtar AI Private Limited (CIN: U58200PN2025PTC244471)
SR. No. 2143, Flat No. D-408, Life Montage, Armament, Pune, Maharashtra 411021, India