Privacy Policy

1. Who We Are

Sarathi-AI Business Technologies ("Sarathi-AI", "we", "us") provides an AI-powered financial advisor CRM platform for insurance advisors, agents, and firms in India. Our services include client relationship management, insurance calculators, branded reports, and communication tools.

Contact: [email protected]

2. Information We Collect

2.1 Tenant (Advisor) Information

When you sign up, we collect:

• Firm name and owner name
• Phone number (used for login via OTP)
• Email address (optional, used for notifications)
• City and IRDAI license number (optional)
• Branding preferences (tagline, CTA, colors)

2.2 Client Data (Managed by You)

As a CRM platform, you store your clients' data through our system:

• Client names, phone numbers, and email addresses
• Insurance policy details (type, premium, dates)
• Lead status and interaction notes
• Follow-up schedules and reminders

2.3 Automatically Collected Data

• IP address and browser type (for security and rate limiting)
• Usage timestamps and feature access logs
• Calculator usage statistics (aggregate, not client-specific)

3. How We Use Your Information

• Service delivery: CRM features, calculators, reports, reminders
• Authentication: OTP-based login via phone number
• Communication: Trial reminders, payment receipts, service updates
• Security: Fraud prevention, abuse detection, rate limiting
• Improvement: Aggregate analytics to improve our platform (no individual tracking)

4. Data Sharing

We do not sell, rent, or trade your personal data or your client data to third parties.

We share data only with the services below, and only what each one needs to run your features:

• Oracle Cloud (Mumbai, India): hosts the service and stores all data.
• Razorpay: payments: the firm owner's name, email and phone, the firm name, plan and amount. No client data.
• Telegram: the Sarathi bots you use: your messages, voice notes and files, and the bots' replies, which carry your CRM data (client names, phone numbers, policy numbers, premiums, renewal dates) and microsite enquiries (the visitor's name, phone, city and message).
• Meta (WhatsApp Business): messages sent from Sarathi's WhatsApp number: your login codes and, to your clients, birthday and anniversary greetings, renewal and EMI reminders, calculator summaries and report links, and campaign messages. They carry the client's phone number and first name, policy number, renewal date and premium, and your name, phone and firm.
• Email (Brevo and Google's Gmail mail servers; Resend only if configured): account and billing emails to you (login codes, receipts, renewal notices); microsite enquiries to the firm owner (the visitor's name, phone, city and message); support tickets to our team; and, for email campaigns, your message to your clients' email addresses.
• Fast2SMS (only if configured): login and account-recovery codes by SMS: your phone number and the code. No SMS to clients.
• Google AI (Gemini): runs the AI features below. What is sent through them is processed by Google outside India, including in the USA. What each feature sends:
  • Voice and text commands (Telegram bot, web dashboard, or your firm's own Telegram bot): your voice recording or message, with the names of recent leads so the AI can act on them. AI answers can draw on your CRM: lead names, stages, needs, renewal and follow-up dates and notes.
  • Lead AI tools (lead score, pitch, follow-up, policy suggestions, renewal strategy, message templates): the lead's profile (name, city, need, stage, budget, sum insured, notes, date of birth or age, occupation, family size, income), recent interactions, and policy details (insurer, plan, premium, sum insured, renewal date).
  • Policy document scan: the whole document (PDF text, or photos of up to 5 pages), which can include name, phone, email, date of birth, PAN, address, policy numbers, insured members, nominees and vehicle details.
  • Nudges from a firm owner to an advisor: the lead's name, phone number, need, stage, city, budget, sum insured, notes and last interaction.
  • Ask-AI questions and objection handling: the question or objection you type or say.
  • Homepage guide chat and support tickets: what a visitor or user types (for a ticket, its subject and description; contact details are not sent).
  • Marketing posts and videos: your firm name and the topic you choose; no client data.
  • System health checks (Sarathi staff): technical event logs, which can include firm or advisor names and partial phone numbers.
  हिन्दी में — Google AI (Gemini): नीचे दिए AI फीचर इसी से चलते हैं। इनके ज़रिए भेजी गई जानकारी Google भारत के बाहर, USA समेत, प्रोसेस करता है। हर फीचर क्या भेजता है:

  • वॉइस और टेक्स्ट कमांड (Telegram बॉट, वेब डैशबोर्ड, या आपकी फर्म का अपना Telegram बॉट): आपकी वॉइस रिकॉर्डिंग या मैसेज, साथ में हाल की लीड्स के नाम ताकि AI उन पर काम कर सके। AI के जवाब में आपके CRM की जानकारी आ सकती है: लीड के नाम, स्टेज, ज़रूरत, रिन्यूअल और फॉलो-अप की तारीखें और नोट्स।
  • लीड AI टूल्स (लीड स्कोर, पिच, फॉलो-अप, पॉलिसी सुझाव, रिन्यूअल रणनीति, मैसेज टेम्पलेट): लीड की प्रोफाइल (नाम, शहर, ज़रूरत, स्टेज, बजट, सम इंश्योर्ड, नोट्स, जन्मतिथि या उम्र, पेशा, परिवार का आकार, आय), हाल की बातचीत, और पॉलिसी की जानकारी (बीमा कंपनी, प्लान, प्रीमियम, सम इंश्योर्ड, रिन्यूअल तारीख)।
  • पॉलिसी डॉक्यूमेंट स्कैन: पूरा डॉक्यूमेंट (PDF का टेक्स्ट, या 5 पेज तक की फोटो), जिसमें नाम, फोन, ईमेल, जन्मतिथि, PAN, पता, पॉलिसी नंबर, बीमित सदस्य, नॉमिनी और वाहन की जानकारी हो सकती है।
  • फर्म ओनर के नज मैसेज एडवाइज़र के लिए: लीड का नाम, फोन नंबर, ज़रूरत, स्टेज, शहर, बजट, सम इंश्योर्ड, नोट्स और पिछली बातचीत।
  • Ask-AI सवाल और ऑब्जेक्शन हैंडलिंग: जो सवाल या ऑब्जेक्शन आप लिखते या बोलते हैं।
  • होमपेज गाइड चैट और सपोर्ट टिकट: विज़िटर या यूज़र जो लिखता है (टिकट में उसका विषय और विवरण; संपर्क की जानकारी नहीं भेजी जाती)।
  • मार्केटिंग पोस्ट और वीडियो: आपकी फर्म का नाम और आपका चुना हुआ विषय; क्लाइंट का कोई डेटा नहीं।
  • सिस्टम हेल्थ चेक (Sarathi टीम): तकनीकी इवेंट लॉग, जिनमें फर्म या एडवाइज़र के नाम और फोन नंबर का कुछ हिस्सा हो सकता है।
• Google sign-in: if you sign in with Google, Google confirms your account to us.
• Google Drive and Sheets (your own Google account, if you connect it): reports you choose to save (client name, calculator figures, your name) go to a folder in your Drive; sheets you choose to import are read from it.
• Google Cloud Storage (Mumbai, India; asia-south1): the nightly off-site copy of the backup of all data, kept 90 days and then removed by a rule on the storage. Our backup account can only add copies, never read, change or delete them.
• Pexels: background photos for marketing posts: a search made of a few words from the post title. No client data.
• Creatomate: marketing videos: the post's title and text, the poster image and your logo. No client data.
• QR Server (api.qrserver.com, backup only): your microsite link, to draw its QR code.
• Google Fonts, jsDelivr and cdnjs: fonts and page scripts; like any website they see your browser's IP address.

5. Data Security

We implement industry-standard security measures:

• JWT-based authentication with HMAC-SHA256 signing
• OTP verification for login (no passwords stored)
• HTTPS encryption for all data in transit
• Tenant isolation — each firm's data is logically separated
• Rate limiting and input sanitization against attacks
• httpOnly cookies to prevent XSS token theft

6. When your plan ends

Your data stays yours.

• Active accounts: Data retained as long as your subscription is active
• When a plan or trial ends, nothing is thrown away. Your account is archived and kept safely, and it comes back exactly as you left it when you renew.
• We never delete your firm's data on our own. If you want it deleted, ask us from your dashboard or by email. We confirm with you first, delete it, and tell you when it is done.
• You can ask for a copy of your data at any time.
• While archived, your data stays private: no one can use the account, and our team opens it only to help you when you ask.
• Backup copies are kept for safety: on our server for 14 days, and in Google Cloud Storage in Mumbai, India for 90 days, after which each copy is removed by a storage rule. A deletion you ask for reaches the backups as those copies are removed, within 90 days.

7. DPDP Act 2023

7.1 Lawful Basis for Processing

• Consent: Collected at signup and before processing personal data (DPDP §6)
• Contractual necessity: Processing required to deliver the subscribed service
• Legitimate use: Analytics, security monitoring, and fraud prevention

7.2 Consent Management

Consent is collected via explicit opt-in at registration. You may withdraw consent at any time by contacting the Grievance Officer (see §12). Withdrawal does not affect the lawfulness of processing prior to withdrawal.

7.3 Cross-Border Data Transfers

Your data may be processed by Google AI (USA) for AI features. Such transfers are arranged to follow DPDP §16. Infrastructure is hosted on Oracle Cloud (India region) to minimize cross-border transfers.

7.4 Data Breach Notification

In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals without undue delay, as required by DPDP §8.

8. Your Rights (Data Principal Rights)

Under the DPDP Act 2023, you have the right to:

• Access: View all data associated with your account via the dashboard
• Export: Download your data in standard formats
• Deletion: Request complete deletion of your account and all data
• Correction: Update your information via the dashboard or by contacting us
• Portability: Request your data in a machine-readable format
• Grievance redressal: File a complaint with our Grievance Officer or the Data Protection Board of India

To exercise these rights, contact our Grievance Officer at [email protected] or email [email protected].

9. Cookies

We use minimal cookies:

• sarathi_token: Authentication cookie (httpOnly, session-based). Required for the service to work.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

10. Children's Privacy

Sarathi-AI is a business tool intended for insurance professionals (18+). We do not knowingly collect information from children under 18.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you via email when significant changes are made. Continued use after changes constitutes acceptance.

12. Grievance Officer & Contact

For privacy-related questions, data requests, or grievances:

• Grievance Officer: Data Protection Team, Sarathi-AI Business Technologies
• Email: [email protected]
• Support: [email protected]
• Telegram: @SarathiBizBot
• Response time: Within 72 hours of receipt

If unsatisfied with our response, you may file a complaint with the Data Protection Board of India as established under the DPDP Act 2023.