Privacy Policy

1. Who we are

1.1 The Service is operated by Amunis Technologies LLP, Pune, Maharashtra, India. For personal data about you as our customer (your account, billing and usage data), we are the data fiduciary (data controller).

1.2 For personal data contained in your Content — for example, data about your own End Users stored in your databases or processed by your applications — you are the data fiduciary and we process it only on your behalf, to provide the Service. Your own privacy notice governs that data.

2. Information we collect

2.1 Account information: name, email address, mobile number, password (stored only as a secure hash), account type (individual or business), organisation name, team members you invite and their roles.

2.2 Sign-in and security information: two-factor authentication settings, passkey public keys, authenticator app enrolment, one-time codes sent by email or SMS, sign-in history, and, if you use it, basic profile information from Google sign-in (name, email address and profile identifier).

2.3 Billing and tax information: billing address, PAN, GSTIN, business verification documents where required, TDS certificates you upload, purchase history, invoices, and payment transaction details (transaction ID, amount, currency, method type, date and status). We do not receive or store your full card number, CVV, UPI PIN or net-banking credentials — these go directly to our payment processor.

2.4 Deployment information: the builds and files you upload, deployment configuration (plans, regions, scaling settings, domains, environment variables — sensitive values are stored encrypted), access keys (secrets stored encrypted), webhook URLs, and the Content your Deployments store or process.

2.5 Operational and usage data (including which access key, such as a CLI deploy key, performed a deploy): CPU, memory, disk and bandwidth usage; health checks; container status; application logs your Deployments produce; deployment events and operation history; Public API and webhook request records; and your use of dashboard and CLI features.

2.6 AI Assistant data: the messages you send to the AI Assistant, its responses, the proposals it creates and whether you confirmed them.

2.7 Device and technical data: IP address, browser and device type, operating system, approximate location derived from IP address, pages visited, referring URLs, and a device fingerprint used to prevent fraud and abuse of free credits. Our sign-up and login forms use Cloudflare Turnstile to detect bots.

2.8 Support and communications: support tickets, messages, attachments and our replies; records of emails, SMS and notifications we send you.

2.9 Early-access requests: if you request early access, the details you submit with your request.

3. How we use your information

3.1 To provide the Service: creating and securing your Account; deploying, running, scaling, monitoring and backing up your Deployments; issuing SSL certificates for your domains; calculating usage and deducting Credits; and providing the AI Assistant and support.

3.2 Billing and legal compliance: processing payments, issuing tax invoices, handling TDS, meeting accounting, tax and regulatory obligations, and responding to lawful requests from authorities.

3.3 Communications: sending essential service messages such as verification codes, security alerts, deployment notifications, low-balance reminders, billing messages and changes to our terms; and, where you have not opted out, product updates and offers.

3.4 Security, fraud and abuse prevention: detecting and preventing fraud, account takeover, payment abuse, duplicate accounts created to obtain free credits, and breaches of our Acceptable Use Policy; investigating security incidents; and protecting our customers, End Users and the public.

3.5 Improving the Service: analysing aggregated and de-identified usage to fix problems, plan capacity and develop features.

3.6 We do not sell your personal data, and we do not use your Content or your AI Assistant conversations to train AI models.

4. Legal basis

4.1 We process your personal data on the basis of your consent, given when you create an account and accept this Policy, and for legitimate uses permitted under the Digital Personal Data Protection Act, 2023, including providing the Service you requested, complying with law, responding to legal orders, and preventing fraud. You may withdraw consent at any time (Section 8), but we may then be unable to provide the Service.

5. How we share information

5.1 We share personal data only as described below, and only as much as needed.

5.2 Service providers who process data on our behalf, under confidentiality and data protection obligations:

• Payment processing: Razorpay
• Cloud storage and email delivery: Amazon Web Services (S3, SES)
• SMS delivery: our SMS provider (for one-time codes)
• WhatsApp and messaging providers: for service notifications, where used
• Hosting and data-centre providers: that run the servers your Deployments use
• DNS and certificate authorities: including Let's Encrypt, to issue SSL certificates for your domains
• Google: if you choose Google sign-in, and Cloudflare for bot protection on our forms
• AI model providers: when you use the AI Assistant, your messages and the account and deployment information needed to answer them are processed by a large language model run by us or by a third-party AI provider. Please do not include passwords, secret keys or other people's personal data in your messages.

5.3 Legal and safety reasons: we may disclose information to government, regulatory or law-enforcement authorities, courts or other parties where required by law, a court order or a lawful direction (including under the Information Technology Act, 2000 and CERT-In directions), or where we believe in good faith that disclosure is necessary to protect the rights, property or safety of us, our customers or others, or to investigate fraud or breaches of our terms.

5.4 Team members: people you add to your Account can see Account information according to the role you give them.

5.5 Business transfers: if our business is reorganised, merged or sold, personal data may be transferred to the new owner, who will be bound by this Policy.

5.6 With your consent: in any other case, we share data only with your consent.

6. Where your data is stored

6.1 We are based in India and your Account data is primarily stored and processed in India. Your Deployments and their Content are stored in the region you choose for them. Some service providers (for example, email, storage or AI providers) may process data in other countries. Where data is transferred outside India, we do so in line with applicable law and any restrictions notified by the Government of India.

7. How long we keep data

7.1 Account data: while your Account is open, and then until your account deletion request is processed (Section 8.3).

7.2 Deployments and Content: until you delete the Deployment, or it is deleted automatically (for example, when your credit balance reaches zero, as described in our Terms). Deleted Deployments, their Content and their backups are removed from active systems and cannot be recovered. A final database backup may be made available to you for a limited time (currently 24 hours) as described in our Terms. Residual copies in routine system backups or build storage are removed in the normal course of our deletion processes.

7.3 Logs and events: the deployment event history, platform activity and audit logs, and records of signed Public API access are kept for 180 days, in line with directions issued by CERT-In under the Information Technology Act, 2000. Application log archives you request are kept for at least 180 days. Webhook delivery records are kept for 30 days (failed deliveries for 90 days).

7.4 AI Assistant conversations: 30 days by default.

7.5 Invoices, payment and tax records: for as long as required by Indian tax and accounting laws (currently up to 8 years), even after your Account is closed.

7.6 Legal requirements: we may keep some information for longer where required by law, including to comply with directions issued by CERT-In or other authorities, or where needed for an ongoing investigation, dispute or legal claim.

8. Your rights

8.1 Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you have the right to:

• access a summary of the personal data we process about you;
• correct, complete or update inaccurate or incomplete personal data;
• erasure of personal data we no longer need to keep;
• withdraw consent;
• nominate another person to exercise your rights in the event of your death or incapacity; and
• raise a grievance with us, and, if you are not satisfied, with the Data Protection Board of India.

8.2 You can update most Account information yourself in the dashboard. For other requests, contact our Grievance Officer (Section 12).

8.3 Deleting your account: request account deletion from the dashboard. All your Deployments, with their data and backups, are deleted as soon as you make the request, so download anything you need first. You have 30 days to cancel the request (cancelling restores your account, not your Deployments). After that, we erase or irreversibly anonymise your personal data and delete any identity or tax documents you uploaded, except records we must keep by law (Section 7). Deletion cannot be undone.

8.4 Exporting your data: you can download your builds, database backups and invoices from the dashboard at any time while your Deployments exist.

8.5 Marketing: you can opt out of marketing emails at any time using the unsubscribe link or your account settings. You cannot opt out of essential service, security, billing or legal messages.

9. Security

9.1 We use technical and organisational measures to protect personal data, including encryption in transit (HTTPS/TLS), encryption of secrets and sensitive configuration at rest, hashed passwords, two-factor authentication options, role-based access controls, per-account network isolation for Deployments, signed API requests, and restricted internal access.

9.2 No system is completely secure. You are responsible for keeping your credentials, access keys and tokens safe and for the security of your own applications.

9.3 If a personal data breach affects you, we will notify you and the relevant authorities as required by law.

10. Cookies

10.1 Our dashboard uses essential cookies and similar technologies to keep you signed in, remember your preferences and protect against fraud. These are necessary for the Service to work.

10.2 Our website may use analytics cookies to understand how visitors use it. We do not use third-party advertising cookies or sell data to advertisers. You can control cookies through your browser settings.

11. Children

11.1 The Service is not intended for anyone under 18. We do not knowingly collect personal data from children. If we learn that we have, we will delete it.

12. Grievance Officer and contact

For questions, requests or complaints about this Policy or your personal data, contact:

Please use the subject line "Privacy Request" and send it from the email address registered on your Account. We will verify your identity before acting on a request. We acknowledge requests within 48 hours and aim to resolve them within 15 days.

13. Changes to this Policy

13.1 We may update this Policy from time to time. We will notify you of material changes by email or dashboard notification before they take effect. The "Last updated" date shows the latest version.