Privacy Policy
PRIMEDHA Technologies Private Limited ("we") operates Smart DevOps AI Agent. This policy explains what personal data we collect, why, who receives it, how long we keep it, and your rights. Effective 24 October 2026. Contact: privacy@primedha.com. Grievance officer (India): Atul Nautiyal, atul.nautiyal@primedha.com.
1. Who is responsible for which data
- For the data of the people who use our service (account holders, invited team members, people who sign up) we decide why and how it is used: we are the data fiduciary / controller.
- For personal data that is inside your own workloads (your customers' records in the databases and applications you deploy with the service), you decide, and we only process it on your instructions to provide the service: we are your data processor. That is covered by the Data Processing Agreement, not by this policy.
2. What we collect
| Data | Source | Used for |
|---|---|---|
| Name, e-mail address, organization, role | you, at sign-up and when you invite a colleague | creating and securing your account, sending service messages, billing, support |
| Sign-in identity and security events (sign-in, failed sign-in, password reset, approvals) | the sign-in service | authentication, abuse prevention, audit |
| Deployment records: the specifications you submit, their saved state, what was created, repaired or removed, status and error messages | you and the service | running the service, showing you history, repair, support |
| Cloud account identifiers (project / account / subscription ids, role names, resource names) | you | acting in your account |
| Billing and usage data: plan, number of environments and repair actions, cost estimates, and (on plans that include it) cost figures your cloud provider reports for your environments | you, the service, your cloud provider | plan limits, the cost pages |
| Invoicing details: the legal name, address, state, GSTIN and billing e-mail you ask us to put on invoices, and the invoices and payment references themselves | you | issuing GST invoices, receiving payment, tax and accounting records |
| Record of changes to your plan, payments and access: what was done, by whom (your e-mail address or ours, stored encrypted), when, from which network address (encrypted) and why, and the payments recorded against your invoices (amount, date, bank reference) | you and us, when a plan is requested, approved, paid, paused, cancelled or suspended | an audit trail of billing and access, tax and accounting records, resolving disputes |
| Record of your acceptance of our legal documents: your e-mail address and organization, which documents and which version of each you accepted, the time, how (sign-up or team invitation) and the network address you accepted from (stored encrypted) | you, at sign-up and when you accept a team invitation | showing what you agreed to, and when |
| Technical logs: IP address, browser type, request time, errors | automatically | security, reliability, support. E-mail addresses in log lines are masked |
| Messages you send us | you | support |
We do not collect payment card numbers or your bank login: invoices are paid by bank transfer, and we see only what the transfer shows us (payer name, reference, amount). We do not knowingly collect data from children.
3. Why we use it, and on what basis
To provide the service you asked for and perform the contract; to keep it secure and prevent abuse (our legitimate interest); to send service notices (approvals, failures, invitations, security); to meet legal obligations (tax, accounting); and, where we ask, with your consent (for example product updates; you can withdraw it at any time). We do not sell personal data and do not use it for advertising.
4. Automated processing and language models
When an automatic repair runs, a diagnostic text (an error message, fragments of the specification, output from your cluster) is sent to a language-model provider so it can propose a fix. No personal data and no identifier of your cloud estate is sent. Before any text is sent, the platform replaces e-mail addresses and other personal data, your client identifier, cloud account, project and subscription identifiers, role names, domain and host names, IP addresses, bucket, registry and key-vault names, and all secrets, tokens and keys with placeholders, and then checks the result; if anything that identifies a person or your tenant is still in it, nothing is sent and the repair stops. The model's answer is matched back to your values only inside our platform. What the provider does receive is the technical content of the error and the names of your workloads and services.
That text is processed by Anthropic (Claude) as our sub-processor. Anthropic states in its public documentation that, by default, it does not use inputs or outputs of its commercial products, including its API, to train its models, and that API inputs and outputs are deleted from its systems within 30 days (longer only where its automated safety systems flag a request, or the law requires). We use Anthropic's service under its standard online commercial terms; we have no separately negotiated agreement with it. Repairs are limited in what they can change and are recorded. No decision with legal effect on a person is made by this automation.
5. Who receives it (sub-processors)
| Sub-processor | Purpose | Where |
|---|---|---|
| Google Cloud | hosting of the service and its database | [region, e.g. Mumbai, India] |
| Google Workspace | sending service e-mail | |
| Anthropic (Claude) | automatic repair: masked diagnostic text only (section 4) | [where Anthropic processes it] |
| Infracost | pricing queries for the pre-deploy cost estimate: resource types, sizes and regions; the Terraform plan, cloud credentials and secrets are not sent, and neither are your names or identifiers (Infracost states this in its public FAQ) | |
| [Accounting software and chartered accountant] | bookkeeping, GST invoices and returns (invoicing details only) | [India] |
| Our bank | receiving payments by bank transfer | India |
We also share data where the law requires, to protect rights and safety, and in a business transfer (with notice). We update this list on our website 30 days before adding one.
6. International transfers
The service is hosted in [region]. Some sub-processors process data in other countries. Where required we use safeguards such as standard contractual clauses and contractual limits.
7. How long we keep it
Account and billing data: while your account exists and for the period tax and accounting law requires afterwards. Invoices, credit notes and payment records: [8] years from the end of the financial year, as tax law requires (they cannot be deleted on request before that). The audit trail of plan, payment and access changes: for the same period. The record of your acceptance of our legal documents: while your account exists and for [3] years afterwards (the period in which a claim about the agreement can be brought). Deployment records and saved state: while the environment exists and [12] months after it is removed, then deleted. Security logs: [12] months. Backups of the service database: up to [35] days, after which they expire. You can ask for earlier deletion (section 9), except where we must keep data by law.
8. Security
E-mail addresses in the service database are encrypted at rest with authenticated encryption and looked up by a keyed hash; deployment state is encrypted; tenant environments are isolated; access to your cloud account uses short-lived federated credentials, not stored keys; the service runs with least privilege; we keep audit logs. No system is perfectly secure; we notify affected people and authorities of a breach as the law requires.
9. Your rights
Depending on where you live (India's Digital Personal Data Protection Act 2023, the EU/UK GDPR and similar laws) you may: ask what we hold about you and get a copy; correct it; have it erased; restrict or object to some processing; withdraw consent; receive your data in a common format; nominate someone to act for you; and complain to us or to the regulator (in India the Data Protection Board; in the EU your national authority). Write to privacy@primedha.com; we answer within 30 days (sooner where the law says). We may need to verify who you are.
10. Cookies
The console uses cookies needed to sign you in and keep your session (strictly necessary). We do not use advertising cookies. [If you add analytics, describe it here and ask for consent where required.]
11. Changes
We will post changes here and, for material changes, e-mail account holders 30 days before they take effect.