privacy policy
patrapi handles identity and financial documents, so we keep as little as we can, for as short as we can. This page says exactly what that means.
1. who we are
Samyak Systems runs patrapi and is responsible for your account data. For the personal data inside documents you upload, you (our customer) decide why it is processed, and we process it on your behalf, under the Digital Personal Data Protection Act, 2023.
2. what we collect
- Account data: your name, email address and a hashed password.
- Documents you upload and the fields read from them.
- Usage records: which workflow ran, page counts, credits charged, API request times and status codes, and your IP address in request logs. These never contain document contents.
- Payment records from Dodo Payments: what you bought and when. We never see or store card or bank details.
3. how long we keep it
- Uploaded files are stored encrypted only while they are being read, and deleted as soon as the result is ready. A file that never finishes is deleted within 24 hours.
- Files waiting for review are kept encrypted for up to 7 days so a reviewer can see them, and deleted when approved, rejected or at the end of that period.
- Results are kept for 90 days by default so you can fetch them again, then deleted. Aadhaar numbers are stored masked to the last four digits unless you choose otherwise.
- Account, usage and payment records are kept while your account is open, and payment records for as long as tax law requires after that.
4. what we use it for
To run your workflows, bill for them, keep the service secure, and answer you when you write to us. We do not sell personal data, show ads, or use your documents or results to train AI models.
5. who else processes it
We use these providers, each only for the job listed:
- Railway: hosting and the database, in Singapore.
- AI model providers (Anthropic, through OpenRouter): read the document to extract fields. Requests are sent with data collection turned off, and providers may not train on them.
- Dodo Payments: payments, GST and invoices, as merchant of record.
- Cloudflare: DNS and sending account emails.
Some of these process data outside India. We choose providers that protect it to the standard this policy describes, and move data abroad only as Indian law permits.
6. security
Files are encrypted at rest, traffic is encrypted in transit, API keys are stored only as hashes, and each account's data is kept apart from every other account's.
7. your rights
You can see, correct or delete your account data, and ask us to delete documents and results early. Email hello@miraigadgetlab.com and we will act within 30 days. If someone named in a document you did not upload writes to us, we will pass the request to the customer who uploaded it.
8. cookies
We set one cookie, to keep you signed in. There are no advertising or tracking cookies.
9. changes
We will email you before a material change takes effect. Questions or complaints go to our grievance contact at hello@miraigadgetlab.com.