Privacy Policy

1. Who this policy covers

Wesence Technologies(“Wesence”, “we”, “us”) is the data fiduciary for personal data collected through AI Setu, in the sense used by India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”). This policy explains what we collect, why, how long we keep it, and the rights you have over it as a data principal.

2. What we collect

We collect different data depending on how you interact with us:

• Requesting early access. The request-access form on this site collects your work email address so we can respond about onboarding.
• Gateway customers. Once you have an AI Setu account, we hold account data (organization and member details, credentials you configure), usage metadata (which model and provider a request went to, token counts, latency, cost, cache hits, timestamps), and billing data.
• Prompts and responses. Request and response content passes through the gateway to route your call to the model provider you selected, and — where you have caching enabled — may be stored temporarily so a repeat or reworded call can be served from cache instead of the provider.

TODO (legal review): confirm and document the exact retention window for cached prompt/response content, and whether prompt/response bodies are retained in request logs beyond the metadata described above.

3. Why we process it

To operate your account and route requests; to meter usage and bill correctly; to detect abuse and keep the service reliable; to respond to support and access requests; and to meet our legal and tax obligations.

4. Retention

We keep account and billing data for as long as your account is active and for the period afterward needed to meet accounting and legal obligations. Usage metadata is kept to support billing disputes and product analytics.

TODO (legal review): specific retention periods (in days/months) per data category have not yet been finalized and will be filled in here before publication.

5. Who we share it with

We share data with the infrastructure and model providers needed to run the service — see the full list on the Subprocessors page. We do not sell personal data.

6. Your rights

Under the DPDP Act you may request access to the personal data we hold about you, correction of inaccurate data, and erasure once it is no longer needed for the purpose it was collected for. You may also withdraw consent where processing is based on consent, and nominate another individual to exercise your rights in the event of your death or incapacity.

7. Grievance officer

To exercise the rights above or raise a concern, contact our grievance officer:

TODO (legal review): grievance officer name and contact email required under Section 13 of the DPDP Act have not been designated yet — never invent a name or address here.

8. Changes to this policy

We’ll update the “Last updated” date above whenever this policy changes. While this document is marked DRAFT, treat any statement here as provisional.