Privacy Policy & Data Protection Notice

SAURIK IT Private Limited (“SAURIK IT”, “we”, “us”, or “our”) is committed to protecting your privacy and digital personal data. This Privacy Policy outlines how we collect, process, store, and safeguard personal information across our website (https://www.saurikit.in), our software applications (Saurik Track, Arthos Invoice Studio), and our multi-tenant Saurik AI Chatbot platform.

1. Our Roles Under the DPDP Act 2023 & Rules 2025

Under Indian data protection jurisprudence, our legal role depends on how you interact with us:

• When you browse saurikit.in or submit an enquiry: SAURIK IT acts as the Data Fiduciary. We determine the purpose and means of collecting your contact information and requirement specifications.
• When you chat with a Saurik AI Chatbot embedded on a client’s third-party website: The client whose website you are visiting is the Data Fiduciary. SAURIK IT acts strictly as a Data Processor, processing your conversation queries and lead details solely upon the instructions of that business.

2. Personal Data We Collect & Process

• Direct Website Inquiries: Full name, email address, mobile phone number, company name (optional for residential CCTV), service topic, and requirement notes submitted via our contact forms.
• Saurik AI Chatbot Conversations: Visitor query transcripts, browser session tokens, device viewport metadata, and voluntary lead submissions (name, phone, specific requirement) with recorded consent timestamps.
• Client Account & Billing Data: Registered business name, legal entity address, GSTIN, primary contact details, and payment transaction references generated via Razorpay. (SAURIK IT never stores credit card or debit card numbers on its servers).
• Technical & Telemetry Data: IP addresses (anonymized for rate-limiting), HTTP referrer origins (for embed authorization), and error telemetry.

3. AI Processing, Grounding & Sub-Processors

We maintain strict security safeguards regarding how artificial intelligence interacts with data:

• Zero Training on Customer Data: Customer documents, conversation transcripts, and lead details are never used to train or fine-tune public foundation models (OpenAI, Anthropic, or open-source weights). Queries are processed via commercial API endpoints with zero-retention commitments.
• Strict Retrieval Bounds: The chatbot answers exclusively from client-approved documents, price lists, and web pages stored in tenant-isolated PostgreSQL pgvector tables.
• Authorized Sub-Processors: Indian cloud hosting providers (Mumbai region), PostgreSQL database infrastructure, and Razorpay (PCI-DSS compliant payment processing).

4. Row-Level Security & Tenant Isolation

To prevent cross-tenant leakage, our database architecture implements PostgreSQL Row-Level Security (RLS). Every document vector, chat message, and lead inquiry is tied to a cryptographically validated tenant_id session variable. One business’s chatbot cannot search, access, or retrieve another business’s data under any condition.

5. Data Retention & Erasure Schedules

• Chatbot Message Transcripts: Retained for a default period of ninety (90) days for quality assurance and debugging, after which automated purge jobs remove the records.
• Captured Leads: Stored securely in the client’s tenant account until the business exports or deletes them, or upon subscription termination.
• Tax & Accounting Records: Invoices, payment receipts, and GST ledgers are retained for the statutory period mandated by the Central Goods and Services Tax (CGST) Act.

6. Rights of Data Principals (Under DPDP Act 2023)

As an individual whose personal data is processed by SAURIK IT, you have the right to:

• Right to Access: Request a summary of your personal data processed by us and the identities of any data fiduciaries/processors with whom it has been shared.
• Right to Correction & Erasure: Request the correction of inaccurate data or the permanent deletion of personal data no longer necessary for the specified purpose.
• Right of Grievance Redressal: Register complaints with our designated Grievance Officer regarding the processing of your data.
• Right to Nominate: Designate an individual to exercise your data rights in the event of death or incapacity.

8. Data Processing Agreement (DPA) for B2B Clients

Businesses deploying the Saurik AI Chatbot on their public websites may execute our standard Data Processing Agreement (DPA), governing data transfer bounds, breach notification covenants (within 72 hours), and post-termination erasure guarantees. Contact our legal desk at contact@saurikit.in to request the execution-ready DPA.