Privacy Policy.

1. Introduction

DemanualAI Pvt. Ltd. ("DemanualAI," "we," "us," or "our") operates the Dataviz by DemanualAI platform ("Service"), an AI-powered analytics tool that connects to your databases and translates natural language questions into SQL queries.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service, visit our website, or interact with us.

By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

2.2 Information We Collect Automatically

2.3 Information from Your Database (Query Results)

When you ask a question, our Service executes a SQL query against your connected database. The results are:

• Displayed to you in your browser or messaging channel (Slack, WhatsApp)
• Not permanently stored in our systems — results exist only for the duration of your active session
• Cached temporarily (configurable TTL) for performance — cache entries are automatically evicted

Important: We do not control what data exists in your database. If your database contains personal data (customer names, emails, addresses, etc.) and you query for that data, it will pass through our system temporarily. We recommend connecting with read-only credentials and being mindful of what data you query.

3. How We Use Your Information

We use collected information for:

4. How We Store and Protect Your Information

4.1 Credential Security

• Database passwords and SSH keys are encrypted using AES-256-GCM via Supabase Vault
• Credentials are decrypted only at the moment of query execution
• Passwords are never returned in API responses — they are redacted at every endpoint
• Every credential access is logged with the requesting user's identity and timestamp

4.2 Data at Rest

4.3 Data in Transit

All data transmitted between your browser, our servers, and third-party services is encrypted using TLS 1.2 or higher.

4.4 Access Controls

• Role-Based Access Control (RBAC) restricts what each user can do
• Row-Level Security (RLS) at the database level ensures tenant isolation
• Only authorized personnel can access production systems
• All access is logged and auditable

5. Data Sharing and Third-Party Processors

We share data with the following third-party processors, solely for the purpose of operating the Service:

AI Processing (AWS Bedrock): Your natural language questions are sent to AWS Bedrock for SQL generation. AWS Bedrock processes this data ephemerally — it is not stored, logged, or used for model training. AWS Bedrock is GDPR-ready and covered by AWS's Data Processing Addendum.

We do not share your data with any other third parties. We will notify you of any changes to our sub-processors at least 30 days in advance.

6. Your Rights

Depending on your jurisdiction, you may have the following rights:

6.1 Under GDPR (EU/EEA)

6.2 Under DPDP Act 2023 (India)

We will respond to all rights requests within 30 days. We may ask for identity verification before processing your request.

7. Data Retention

When you delete your account, all associated data (conversations, connections, reports, favorites) is permanently deleted within 30 days. Audit log entries are retained in anonymized form for compliance purposes.

8. Cookies and Tracking

8.1 Cookies We Use

8.2 What We Don't Use

• No advertising cookies
• No social media tracking pixels
• No cross-site advertising profiles or retargeting cookies

We use PostHog only on our own properties for product analytics. We do not track you across third-party websites, we do not build advertising profiles, and our session replay configuration masks all form inputs.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it promptly.

10. International Data Transfers

Your data may be processed in:

• India (ap-south-1, Mumbai) — Primary processing
• United States (us-east-1) — AI processing via AWS Bedrock (ephemeral only)

For transfers from the EU/EEA, we rely on:

• Standard Contractual Clauses (SCCs) maintained by our sub-processors (AWS, Supabase)
• Adequacy decisions where applicable

11. Security Incidents

In the event of a data breach affecting your personal data:

• We will notify affected users within 72 hours of confirming the breach
• We will notify the relevant data protection authority as required by law
• We will provide details on the nature of the breach, data affected, and remedial actions taken

To report a security vulnerability, contact: security@demanualai.com

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending an email notification to registered users for significant changes

Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related questions, data subject requests, or complaints:

This policy is effective as of March 18, 2026.