1. Who is responsible

• Mayank Kamani, sole proprietor trading as Atharva Atelier, registered address 3rd Floor, Flat No. B, Gitanjali, 216/3A, AJC Bose Road, Kolkata, West Bengal 700017, India, decides how Deft uses your personal data and is responsible for it.
• Grievance Officer: Mayank Kamani, grievance@heydeft.ai (see section 13).

2. What Deft uses, and why

• Deft sends an email or changes an event only when you ask it to or approve it, or, if you keep that setting on, when the person you're meeting moves or cancels on a call Deft made for you.
• Payments are handled by Razorpay. We do not store your card number or UPI PIN.
• Cookies and analytics: heydeft.ai uses one necessary cookie during sign-up, to remember your progress. No analytics. Its pages load nothing from other websites except Razorpay's payment window when you pay. Mission Control (the Deft app) uses one sign-in cookie, which is strictly necessary to keep you signed in and cannot be read by scripts on the page. No advertising or tracking cookies anywhere.

Sensitive information. Your emails, calls and notes may contain sensitive details (for example health, money or passwords someone sends you). We do not ask for them, use them only to provide your assistant to you, and never sell them.

3. Other people's information

Your assistant handles some information about other people: the people it calls for you, people who call you, people near the phone during a call, and people who appear in your email, calendar and notebook.

• Calls are recorded and transcribed. A voice-isolation step removes background voices.
• To check whose voice it is, a few seconds of the caller's speech go to our own voice-check service on our servers in India. It turns them into numbers and keeps nothing. Your assistant never makes a voiceprint of anyone else.
• Your assistant introduces itself as your assistant. If asked, it says that it is an AI and that the call is recorded.
• You are responsible for any consent your situation needs under the law of your place for the calls you ask your assistant to make, and for recordings.
• Anyone who believes Deft holds their personal data can write to our Grievance Officer at grievance@heydeft.ai.

4. What we never do

• We never sell your data.
• We never use it for advertising.
• We never use it to train AI models.

Shared know-how. When a client agrees, general calling know-how (how to book a table well, for example) can be shared across assistants. Nothing personal (names, numbers, conversations) ever leaves a client's own space.

People at Deft. A small number of Atharva Atelier staff can access your assistant's notes, call recordings and transcripts when needed to run, support or fix the service, or where the law requires it. Every such access is logged on our side. Emails and files your assistant reads from your Google account are an exception: a person looks at them only with your agreement for a specific request, for security, or where the law requires it.

5. AI processing

• Your assistant's replies and actions are produced by AI models. For chat, and for the work it does for you (look-ups, emails, errands), its thinking is done by Anthropic's Claude through Anthropic's API, in the USA. Anthropic processes your requests to answer them. Under its commercial API terms, it keeps inputs and outputs for up to 30 days for safety, then deletes them, and does not use them to train its models.
• On phone calls, your assistant hears the caller, talks and replies through Google's Gemini (Gemini Live), through Google's paid API, outside India. Under Google's terms for its paid Gemini API, Google keeps what is sent and answered for up to 55 days, only to detect misuse, and does not use it to improve its products or train its models.
• Voice notes you send in chat are heard as text by Google's Gemini, through the same paid API and terms as calls (outside India). Spoken replies in chat are voiced by Sarvam AI in India.

6. Who else handles your data (sub-processors)

We use these providers to run Deft. Each gets only what it needs for its job.

• Apps you choose to connect each handle what your assistant sends them (an order, a booking, a search) under their own terms and privacy policy.
• Your WhatsApp messages with your assistant, and with Deft's number while you sign up, go through Meta's WhatsApp Business service: Meta processes them for us, to deliver them. WhatsApp's own terms and privacy policy also apply to your use of WhatsApp.
• Telegram chats with bots are not end-to-end encrypted. Telegram's own privacy policy also applies to them.
• We may also share data when the law requires it (for example a valid order from a court or government authority).

7. Data sent outside India

Your data is stored in India, but some of it is processed outside India. Every request your assistant thinks about goes to Anthropic in the USA, and your calls' audio and words, and the voice notes you send in chat, go to Google's Gemini outside India. Plivo may keep call records in the USA. Meta (WhatsApp), Telegram, Google, Microsoft and Zoom use their global infrastructure, and Kapso, which passes WhatsApp messages to Meta for us, is in the USA. ai-coustics receives usage counts (never audio) in Germany/EU. The DPDP Act allows this, except to countries the Government of India restricts; we will follow any such restriction.

8. Google user data

Deft's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from your Google account is used only to provide the features you asked for, is not transferred to others except as needed to provide them (the AI processing above), and is never read by people at Deft unless you ask us to help with a problem, it is needed for security, or the law requires it. This covers Gmail, Google Calendar and Google Drive. Deft reads your Drive only if you allow Drive, and only to find and read a file you ask about; it never changes or deletes your Drive files, and it adds files to your Drive only in its own Deft folder: a file you ask it to save and, unless you switch it off in Settings (Daily rhythm), a copy of each file it files for you, such as bills, tickets and attachments.

Data from your Google account is never sold, never used for advertising, and never used to develop, improve or train AI or machine-learning models.

Each night, unless you turn it off in Settings, a short summary of the day's email, calendar and Drive changes is added to your assistant's notebook, so it remembers people and plans. One-time codes, card and ID numbers, passwords and bank alerts are left out. These notes stay while your account is active, until you delete them, and removing your Google account does not delete them.

How to disconnect Google, and how to delete what Deft learned from it: heydeft.ai/help/google.

9. Zoom data

If you connect Zoom, your assistant reaches your Zoom account through our Zoom app, with only the permissions you approve on Zoom's own page: finding your meetings and their details, reading Zoom's meeting summaries, listing and reading your cloud recordings and their transcripts, and booking, moving or cancelling a meeting when you ask (or when you approve it, if someone else asks).

• Data from your Zoom account is used only to do what you asked. It is never sold, never used for advertising, and never used to train AI models.
• We keep no separate copy of your Zoom meetings or recordings. What your assistant reads from Zoom passes through the AI processing in section 5. It may stay in your assistant's working files for up to [TO CONFIRM: 30] days, and what your assistant tells you stays in your chat history, like any message.
• The permission Zoom gives your assistant is kept only with your own data (and in your encrypted backups), and is never shown to anyone. Our central systems never hold it.
• To disconnect: Mission Control → Connections → Zoom → Disconnect, which also cancels the permission at Zoom. You can also remove the Deft app in your Zoom account (Zoom App Marketplace → Manage → Added Apps).

10. Where it is kept, and how it is protected

• Shared servers, each client's data walled off. Clients' assistants run on Deft's shared servers in India (Mumbai, Hostinger). Each client's data (notebook, messages, recordings, files and sign-ins) is kept in its own place there, walled off from every other client's. Clients' data is never mixed, and one client's assistant cannot read another's. A client who joined before the shared servers runs as its own account on our servers or in its own isolated container, in India (Mumbai, Hostinger), until it moves to them.
• Encrypted at rest. Clients' data on these servers is stored encrypted, and the keys are held by Deft's HQ, our own control system. The sign-ins for your connected accounts are also sealed with a key of your own.
• Backups are encrypted, made every night, and stored on a separate backup server in India.
• Secrets are never shown: the sign-in permissions for your connected accounts are stored with your assistant and never shown to anyone.
• Requests from public authorities: if a government body or other authority asks us for your data, we first check that the request is lawful, challenge it if it is not, share only the minimum the law requires, and keep a record of every request, our answer and the legal reasons for it.

11. How long we keep it

Download or close: download everything, or close your account, yourself in the Deft app: Settings → Your data. For anything else, email grievance@heydeft.ai.

12. Your rights and choices

Under the DPDP Act you can:

• Access: ask for a summary of the personal data we hold about you, what we do with it, and who we share it with.
• Correct or update data that is wrong or incomplete.
• Erase: ask us to delete your data, unless the law requires us to keep it (for example invoices).
• Withdraw consent at any time. It is as easy as giving it: disconnect an account in Mission Control (Connections), or in your Google, Microsoft or Zoom account's own settings, or close your account. What was done before you withdraw stays lawful, and features that need that data will stop. You can also write STOP or 'delete my data' to your assistant, or use heydeft.ai/stop: we ask you first, and once you confirm, everything stops at once and your data is deleted 7 days later unless you undo it. The same applies while your assistant is still being set up. Before you agree to our notice, nothing you typed is kept after STOP.
• Nominate someone to use these rights for you if you die or cannot act yourself. Email us their name and contact details.
• Complain to our Grievance Officer (section 13), and if you are not satisfied, to the Data Protection Board of India.

To use a right, email grievance@heydeft.ai from your registered email, or tell us your registered phone number, so we can confirm it is you. We acknowledge your request within 48 hours and complete it within one month. Please give accurate information when you use these rights; the DPDP Act also places some duties on you, such as not making false complaints.

13. Grievance Officer

• Name: Mayank Kamani
• Email: grievance@heydeft.ai
• We acknowledge complaints and data requests within 48 hours and resolve them within one month of receiving them.

14. If something goes wrong (data breach)

If a personal data breach affects you, we will tell you and the authorities as the law requires (the Data Protection Board of India, and CERT-In for cyber security incidents).

15. Children

Deft is not for anyone under 18. We do not knowingly create accounts for children. If we learn that an account belongs to someone under 18, we will close it and delete its data.

16. Changes to this policy

If this policy changes, we will update this page and its date, and tell you in advance of any important change.