1Overview & Scope
This Privacy Policy explains how FistAi(“we”, “our”, or “us”) collects, processes, stores, and protects personal and corporate information when you use our website (fistai.in), our conversational AI agents, customer support chatbots, retrieval-augmented generation (RAG) knowledge bases, AI-driven SEO auditing utilities, and associated APIs (collectively, the “Services”).
Zero Model Training Guarantee: Your proprietary business documents, vector embeddings, customer chat transcripts, and database inputs are strictly confidential. We do NOT sell, license, or use your private data to train general public large language models (LLMs).
By accessing or using our Services, you consent to the collection and use of your information in accordance with this Privacy Policy. If you do not agree with any term herein, please discontinue using the Services immediately.
2Information We Collect
We collect information directly from you, automatically through your device, and via third-party integrations you explicitly connect:
A. Account & Authentication Information
- Google OAuth & Profile Data: When signing in via Google, we collect your full name, email address, profile avatar URL, and authenticated Google ID.
- Account Credentials: If registered through administrative methods, your encrypted password hash (via bcrypt) and role designations.
- Billing & Contact Data: Corporate name, billing address, tax IDs, and payment receipt confirmations (handled via PCI-DSS compliant payment processors).
B. Workspace, Input & Agent Knowledge Data
- Knowledge Base Entries: Custom FAQs, guidelines, policy text, and structured business rules entered into your FistAi knowledge base for precise agent responses.
- Conversation Histories & Logs: Messages exchanged between end-users and your deployed FistAi chatbots, including sentiment and intent scores.
- SEO Audit Targets: URLs submitted for technical, on-page, and semantic performance analysis.
C. Automated Device & Telemetry Data
- Network & Technical Identifiers: IP address, browser type and version, operating system, time zone, referring URLs, and session duration.
- Performance Metrics: API latency, error logs, and agent response generation times used solely for service reliability.
3How We Use Your Information
We process your information based on legitimate business purposes, contractual obligations, and user consent:
4AI Processing & Model Training Disclaimers
We respect enterprise intellectual property and treat data boundaries with the highest rigor:
- No Public Foundation Training: Customer prompts, uploaded files, vector representations, and chatbot conversations are never transmitted to train foundation public models (such as GPT-4, Claude, or Gemini).
- Isolated Vector Stores: Your enterprise knowledge embeddings are segmented per organization, ensuring multi-tenant isolation and strict tenant boundary controls.
- Stateless Processing: Third-party foundation model APIs are contracted under zero-data-retention (ZDR) agreements where available, meaning external providers do not store inputs beyond the lifetime of the API call.
5Data Sharing & Subprocessors
FistAi never sells, rents, or trades your personal information. We disclose data only to trusted subprocessors essential to operating our infrastructure:
- Cloud Infrastructure Providers: High-security cloud hosts (e.g., AWS, GCP, Oracle Cloud) for virtual machines, MySQL databases, and encrypted file storage.
- Authentication Providers: Google Identity Services for verified Single Sign-On (SSO).
- AI Inference APIs: Enterprise AI gateway partners for executing model inference under strict confidentiality.
- Legal & Law Enforcement: Only when strictly required by applicable law, court order, or governmental regulation.
6Security & Infrastructure Safeguards
We employ industry-standard technical and organizational security measures to defend your data against accidental loss, destruction, alteration, or unauthorized access:
- Encryption in Transit: All HTTP traffic is secured via TLS 1.3 with Strict-Transport-Security (HSTS) preloading enabled.
- Encryption at Rest: Database backups and vector stores are encrypted with AES-256 standard encryption.
- Access Controls: Principle of least privilege, token-based session management via JOSE / NextAuth, and strict admin role segregation.
- Security Headers: We enforce rigid Content-Security-Policy (CSP), X-Frame-Options (SAMEORIGIN), and X-Content-Type-Options (nosniff) configurations.
7Data Retention & Deletion
We retain your account data and operational logs for as long as your workspace account remains active or as needed to deliver our Services.
Workspace administrators may request total workspace deletion at any time. Upon confirmed request, all indexed vector embeddings, chat histories, and uploaded documents will be permanently purged from our active databases within 30 days, except where retained to comply with legal, tax, or regulatory obligations.
8Your Legal Rights (GDPR / DPDP / CCPA)
Depending on your location, you hold statutory rights regarding your personal information under data protection laws (such as GDPR in the European Union, the California Consumer Privacy Act (CCPA), and India’s Digital Personal Data Protection Act 2023):
- Right to Access: Request copies of personal data held about you.
- Right to Rectification: Request correction of inaccurate or incomplete records.
- Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data.
- Right to Data Portability: Obtain your data in a structured, machine-readable format.
- Right to Object & Opt-Out: Object to processing based on legitimate interests or revoke marketing consent.
To exercise any of these rights, please submit a written request to our Data Protection team at privacy@fistai.in.
10Contact Our Privacy Team
If you have questions, feedback, or concerns regarding this Privacy Policy or our handling of your data, please contact our Data Protection Officer: