Privacy Policy

DueVault.ai, a product of DTRAS-G Solutions Private Limited ("we", "our", "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

Key Principle: We prioritize your data privacy and provide transparency about how AI processes your information.

Important Information About How AI Processes Your Data

2.1 How We Use AI

Our Service uses artificial intelligence to:

• Generate suggested responses to security questionnaires
• Analyze your uploaded documents to build your knowledge base
• Match questionnaire questions with relevant information from your documents
• Provide confidence scores for AI-generated answers

2.2 Third-Party AI Providers

We use third-party AI services (such as OpenAI, Anthropic) to power our AI features. When you use AI features:

• Your questionnaire questions may be sent to these providers for processing
• Relevant excerpts from your knowledge base may be included for context
• We use API configurations that request providers not to train on your data
• Responses are returned to our system and displayed to you

Note: Third-party AI providers have their own privacy policies. We recommend reviewing:

• OpenAI Privacy Policy: openai.com/privacy
• Anthropic Privacy Policy: anthropic.com/privacy

2.3 AI Training and Model Improvement

We do NOT use your data to train AI models.

• Your documents are not used to train or improve third-party AI models
• Your questionnaire responses are not used for model training
• We use API settings that opt out of training data usage where available

2.4 AI Output Logging

For compliance, security, and service improvement, we log:

• AI-generated responses (stored securely with your account)
• Confidence scores and flags
• User edits and approvals of AI content
• Timestamps and metadata

These logs are retained for audit purposes and to help you track changes. They are not shared with third parties except as required by law.

Account Information:

• Name and email address
• Company name and size
• Billing information (processed by Stripe)
• Account preferences and settings

Knowledge Base Documents:

• Documents you upload (policies, procedures, certifications)
• Document metadata (filename, upload date, type)
• Extracted text and embeddings for AI retrieval

Questionnaire Data:

• Uploaded questionnaires
• AI-generated responses
• Your edits and modifications
• Approval status and export history

Usage Data:

• Feature usage patterns
• AI response quality metrics
• Performance and error logs

Technical Information:

• IP address (for security)
• Browser and device information
• Login timestamps

We use collected information to:

• Provide the Service: Generate AI responses, manage your knowledge base, process questionnaires
• Improve AI Accuracy: Use your documents to provide relevant, context-aware responses
• Maintain Audit Trails: Log AI outputs and user actions for compliance
• Billing: Process payments and send invoices
• Support: Respond to inquiries and troubleshoot issues
• Security: Detect fraud, prevent abuse, protect systems
• Service Improvement: Analyze usage patterns to enhance features

Encryption:

• TLS 1.3 for data in transit
• AES-256 for data at rest
• Encrypted document storage
• Encrypted database backups

Access Controls:

• Role-based access control (RBAC)
• Multi-factor authentication (MFA) available
• Principle of least privilege
• Regular security audits

Data Isolation:

• Your knowledge base is isolated from other customers
• AI queries include only your organization's data
• No cross-customer data sharing

We DO NOT sell your data.

We may share information with:

• AI Providers: Questionnaire text and knowledge base excerpts are sent to AI providers (OpenAI, Anthropic) for processing. See Section 2.2 for details.
• Service Providers: Stripe (payments), cloud hosting providers (infrastructure)
• Legal Requirements: If required by law, court order, or government request
• Business Transfers: In case of merger, acquisition, or sale of assets

Knowledge Base Documents: Retained until you delete them or close your account

Questionnaires and Responses: Retained for 2 years, or until you delete them

AI Audit Logs: Retained for 7 years (for compliance requirements)

Account Data: Until account deletion, then 30 days for backups

Billing Records: 7 years (tax and legal requirements)

You have the right to:

• Access: Request a copy of your data, including AI-generated content
• Rectification: Correct inaccurate data
• Deletion: Request deletion of your data ("right to be forgotten")
• Portability: Export your data in machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to certain processing activities
• AI Transparency: Request information about how AI processes your data

To exercise these rights, contact us at bd@dtrasglobal.com

Essential Cookies: Required for authentication and session management

Analytics Cookies: Track usage patterns (can be disabled)

No Third-Party Tracking: We do not use advertising or tracking pixels

Your data may be transferred to and processed in countries other than your own. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs)
• Data Processing Agreements (DPAs)
• Compliance with GDPR and local regulations

Our Service is not intended for children under 13. We do not knowingly collect information from children. If you believe we have collected data from a child, contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or dashboard notification. Continued use after changes constitutes acceptance.

For privacy-related questions or to exercise your rights:

• Email: bd@dtrasglobal.com
• Data Protection Officer: bd@dtrasglobal.com
• Support: bd@dtrasglobal.com