Privacy Policy

Effective date: July 5, 2026

This Privacy Policy explains how Sandhāna ("we", "our", "us") collects, uses, stores, and protects information when you use the Sandhāna website, web application, desktop application, and Chrome extension (collectively, the "Service").

1. Information We Collect

Account information: When you register, we collect your name, email address, and a hashed version of your password. We never store passwords in plain text.

Integration credentials: When you connect third-party tools, we store Personal Access Tokens (PATs) or API keys encrypted at rest. We use these solely to fetch read-only data on your behalf.

Usage data: We log API requests (endpoint, timestamp, IP address) for security monitoring and rate limiting. We do not log request body content except as needed to detect abuse.

Uploaded documents: Files you upload are processed to extract text for search and AI Q&A. We do not sell or share uploaded content with third parties for advertising.

Chat history: Your AI chat messages are stored to provide session continuity. You can delete your chat history at any time.

Cookies: We use HttpOnly session cookies to maintain your authenticated session. We do not use advertising cookies or third-party tracking cookies.

2. Chrome Extension

If you install the Sandhāna Chrome extension, the following applies in addition to this policy:

• Tab context: When you open or use the side panel, we access the active browser tab's title and URL so chat answers can reference what you are viewing. We do not read or collect full page HTML through the extension unless you explicitly ask a question that requires page content through the Sandhāna chat interface.
• Page shortcut: The extension injects a small "Ask Sandhāna" button on web pages. This content script does not scrape page content, track browsing history, or modify page behavior. It only displays the shortcut and opens the side panel when you click it.
• Side panel: The chat UI loads from https://sandhana.vercel.app inside a sandboxed iframe. Authentication, chat processing, and enterprise integrations occur within the Sandhāna web application under the same terms as our main Service.
• Local storage: The extension may store optional UI preferences (such as shortcut placement) locally using chrome.storage. This data stays on your device unless you sync Chrome settings across devices.
• Permissions: We request sidePanel, tabs, storage, and host access only to provide the features above. We do not sell browsing data.

3. How We Use Your Information

• To authenticate you and maintain your session securely.
• To fetch and aggregate data from your connected tools in read-only mode.
• To generate AI-powered search results, Q&A responses, and intelligence digests.
• To provide tab-aware assistance in the Chrome extension when you choose to use it.
• To detect and prevent fraud, abuse, bot attacks, and security threats.
• To improve the Service through anonymised usage analytics.
• To send transactional emails (e.g. password reset, security alerts). We do not send marketing emails without your opt-in consent.

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA) or United Kingdom, we process your data under these legal bases:

• Contract performance — processing necessary to provide the Service you requested.
• Legitimate interests — security monitoring, fraud prevention, and service improvement.
• Consent — for optional analytics or marketing communications, where we obtain your explicit consent.
• Legal obligation — where required by applicable law.

5. Data Sharing & Third Parties

We do not sell your personal data. We share data only in these limited circumstances:

• AI inference providers: Queries may be sent to third-party AI models (e.g. Ollama-hosted models, Anam.ai for voice features). Sensitive data is redacted before transmission.
• Infrastructure providers: We use Vercel (hosting) and MongoDB-compatible storage under their data processing agreements.
• Legal requirements: We may disclose information if required by law, regulation, court order, or to protect rights, property, or safety.

6. PII Redaction Before AI Processing

Before user content is sent to AI models, we automatically redact API keys, tokens, passwords, email addresses, SSNs, phone numbers, credit card numbers, and known secret formats. Redacted values are replaced with placeholders and are not transmitted to external AI services.

7. Data Retention

• Sessions: Expire after 7 days of inactivity and are deleted.
• Chat history: Retained for 90 days unless you delete it earlier.
• Integration credentials: Retained until you disconnect the integration or delete your account.
• Security logs: Retained for 30 days.
• Account data: Retained until you request deletion.

8. Your Rights

Depending on your location, you may have the right to access, correct, delete, port, restrict, or object to processing of your personal data, and to withdraw consent where processing is consent-based.

To exercise these rights, email privacy@sandhana.ai. We will respond within 30 days. EEA/UK residents may also lodge a complaint with their local supervisory authority.

9. CCPA (California Residents)

California residents may request disclosure or deletion of personal information. We do not sell personal information. Contact privacy@sandhana.ai.

10. Security

We use HTTPS/TLS, HttpOnly session cookies, PBKDF2-SHA256 password hashing, rate limiting, CSP headers, input validation, and PII redaction before AI processing. Report vulnerabilities to security@sandhana.ai.

11. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children.

12. International Data Transfers

Your data may be processed in the United States or other countries. For EEA/UK transfers we rely on Standard Contractual Clauses or equivalent safeguards.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or a prominent notice in the Service. Continued use after changes constitutes acceptance.

14. Contact Us

For privacy questions or data requests, contact privacy@sandhana.ai.