Version 2026-10-12, effective 2026-10-12
Privacy Policy
DRAFT for legal review. Not final.
This policy explains what personal data ADIS ("the Service") collects, why, who handles it, how long we keep it and what rights you have. The Service is run by [TO CONFIRM: legal entity name], registered at [TO CONFIRM: registered office address] ("Spurtree", "we"). We aim to follow India's Digital Personal Data Protection Act, 2023 (DPDP Act). [TO CONFIRM: any other laws to cover, such as GDPR for EU users.]
1. Who is who
- For account and billing data about you, we decide why and how it is used (we are the data fiduciary).
- For the content your team puts into a workspace (requirements, tickets, source code, documents), you decide, and we process it for you. Your organisation is responsible for having the right to put that data into the Service. [TO CONFIRM: processor/fiduciary wording and any data processing addendum.]
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Email address, name, profile picture, whether the email is verified, sign-in method (password, Google, Microsoft, SSO, magic link), the terms version you accepted and when | Sign you in and identify you |
| Workspace membership | Your role, invites you sent or received, join requests, last workspace used | Control who can do what in a workspace |
| Sessions | Session id, when it started, last seen, when it ended | Keep you signed in, let you sign out |
| Technical | IP address (used for rate limiting and recorded in audit events), cookies | Security, abuse prevention, audit trail |
| Customer Content | Requirements, tickets (including requester name and email, email threads, comments, attachments), uploaded files, source code from repositories you connect, analysis results, AI prompts and outputs | Provide the Service |
| Integration credentials | Tokens or keys for Jira, GitHub, Bitbucket, Azure DevOps, or AI providers if you bring your own key | Connect to those services for you. Stored encrypted with a per-workspace key |
| Billing | Billing legal name, address, country, GST state, GSTIN (if you give one), billing email, Razorpay customer, subscription, order and payment ids, payment method type and status, invoices | Charge you, issue GST invoices, meet tax law |
| Usage and credits | Credit ledger, AI call logs (model, tokens, cost, and the prompt and result), usage counters | Meter credits, show usage, investigate problems |
| Audit | Workspace audit events (who did what, when, from which IP), support-access records | Security and accountability |
| Communications | Emails we send you (invites, trial and retention warnings, support access requests) | Run the Service |
We do not knowingly collect data from children. [TO CONFIRM: minimum age and DPDP verifiable parental consent position.]
3. Cookies
We use cookies that are needed for sign-in: HttpOnly cookies that hold your session and a short-lived cookie that protects the login flow. We do not use advertising cookies. [TO CONFIRM: any analytics or marketing tags on the public website.]
4. Who receives your data
We share data with the sub-processors listed on the Sub-processors page: cloud hosting (AWS), sign-in (WorkOS), payments (Razorpay), AI model providers (Anthropic, OpenAI), vector search (Pinecone) and graph storage (Neo4j). We also exchange data with tools you connect, such as Jira or GitHub. We do not sell personal data. We may disclose data if the law requires it. [TO CONFIRM: how we handle legal requests and a change of control.]
5. AI processing
To produce AI outputs (analysis, plans, code suggestions, security summaries), we send parts of your Customer Content to AI model providers. Which provider is used can depend on your workspace or project settings. If you provide your own provider key, the call is made with your key.
- Training: [TO CONFIRM: under each provider's current API terms, do they train on API inputs? Record the answer for Anthropic and OpenAI here.] We do not use your Customer Content to train our own models. [TO CONFIRM]
- AI outputs can be wrong. See the Terms of Service.
- We keep a log of AI calls, including the prompt and result, for metering, support and audit. See retention below.
6. Support access
Spurtree staff can open a customer workspace only through a time-limited grant. Support staff must give a reason. An Owner or Admin of your workspace must approve it, or can grant it themselves, and can revoke it at any time. A grant is read-only unless you explicitly allow changes. By default a grant lasts 24 hours. The longest read-only grant is 168 hours and the longest grant that allows changes is 24 hours. Every request, approval, denial and revocation is written to the workspace audit log, which Owners and Admins can see. [TO CONFIRM: that these defaults are unchanged at launch. They are platform settings.]
7. Security
- Each workspace has its own encryption key, wrapped with AWS KMS, used for secrets such as integration credentials.
- Data is separated per workspace across our database, vector, graph and file stores.
- Sign-in is handled by WorkOS and supports SSO for workspaces where it is enabled.
- Uploaded files are stored encrypted at rest on S3 [TO CONFIRM: encryption statement].
- No system is perfectly secure. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires. [TO CONFIRM: notification timeline.]
8. How long we keep data
| Data | Kept for |
|---|---|
| Trial | 14 days from workspace creation (a platform setting, default 14) |
| Workspace locked (trial ended, cancelled, or payment failed) | Read-only for 30 days (platform setting retention.days), then deleted. Owners get warning emails 7 days and 1 day before deletion (setting retention.warning_lead_days) |
| Owner deletes the workspace | 7-day undo window (setting retention.owner_delete_days), then deleted |
| Agency client workspace whose invited Owner never accepts | Deleted after 30 days (setting agency.pending_client_days) |
| After deletion | We purge database rows, files on S3, vectors in Pinecone, and graph and search data, and destroy the workspace's encryption key. Statutory records such as invoices and payment records are kept as required by tax law. [TO CONFIRM: statutory retention period, for example 8 years under Indian GST rules] |
| HTTP request logs | 30 days (default) |
| Audit logs | 730 days (default) |
| Scheduled job logs | 90 days (default) |
| AI call logs | 180 days (default); older prompt and result payloads are archived to S3 after 30 days |
| Integration sync events | 60 days (default) |
| Backups | [TO CONFIRM: backup retention and how deleted data ages out of backups] |
Log retention figures are defaults of our retention jobs and can be changed by configuration. [TO CONFIRM: that these apply unchanged to the SaaS deployment.]
9. Your rights
Under the DPDP Act you can ask to access, correct, complete or erase your personal data, to nominate someone to act for you, and to have your grievance heard. In the product:
- Export. A workspace Owner can download a ZIP export of the workspace's data. [TO CONFIRM: export contents once the feature ships.]
- Delete your account. Any user can delete their own account. A workspace Owner must first hand the workspace over to another Owner, or delete the workspace.
- Delete a workspace. An Owner can delete the workspace, with the 7-day undo above.
- Other requests. Contact us as set out below. [TO CONFIRM: response time, for example 30 days.]
If you only use the Service through your employer's workspace, your employer may need to handle some requests about workspace content.
10. Grievance Officer
Questions, complaints and rights requests can be sent to the Grievance Officer, whose name and email address are shown at the end of this policy.
- Postal address: [TO CONFIRM: registered office address]
- Response time: [TO CONFIRM]
If we do not resolve your complaint, you may approach the Data Protection Board of India.
11. Transfers outside India
Some sub-processors, including AI providers, may process data outside India. [TO CONFIRM: transfer position, restricted-country list under the DPDP Act, and any contractual safeguards.]
12. Changes
We will post changes here with a new version date. For significant changes we will tell you in the product or by email. Where the Terms change, you will be asked to accept the new version.
13. Contact
[TO CONFIRM: privacy contact email] and the Grievance Officer above.
Grievance Officer
The Grievance Officer's contact details will be published here.