Privacy Policy

Bachao.AI ("we", "us", or "our") is a cybersecurity SaaS platform operated by Dhisattva AI Pvt Ltd (operating as Bachao.AI), based in India. We provide AI-powered vulnerability assessment and penetration testing (VAPT), DPDP compliance tools, cloud security audits, API security testing, dark web monitoring, phishing simulation, and incident response services to businesses.

This Privacy Policy explains how we collect, use, store, and protect your information when you use our website and services at www.bachao.ai.

By using our services, you consent to the practices described in this policy. If you do not agree, please discontinue use of the platform.

We collect the following categories of data:

We use the data we collect for the following purposes:

• Security scanning and assessments: To perform VAPT scans, DPDP compliance checks, cloud security audits, API testing, and dark web monitoring on the domains and URLs you authorise.
• Report generation: To generate and deliver security reports and compliance assessments to your account.
• Payment processing: To process subscription payments and one-time charges via Cashfree.
• Communication: To send scan completion notifications, security alerts, invoices, and service updates via email.
• Authentication: To verify your identity through OTP-based login.
• Service improvement: To analyse usage patterns and improve our scanning accuracy and platform features.
• Legal compliance: To comply with applicable laws, including the Digital Personal Data Protection Act, 2023.

We share data with the following third-party processors, strictly for the purposes described:

• Cashfree: Payment processing. Cashfree receives payment instrument details necessary to complete transactions. See Cashfree's Privacy Policy.
• Resend: Transactional email delivery. Resend receives your email address to send OTPs, scan reports, and service notifications.
• Anthropic (Claude API): We use Anthropic's Claude AI to enhance scan reports, generate remediation guidance, and map findings to compliance frameworks. Only anonymised vulnerability metadata (finding titles, descriptions, severity) is shared — never source code, credentials, PII, or raw scan data. Anthropic does not train on API inputs per their Terms of Service. Processing occurs on US infrastructure. A Data Processing Agreement is in place.

We do not sell, rent, or trade your personal data to any third party. We do not share your data with advertising networks or data brokers.

Account data: Retained for as long as your account is active. Upon account deletion, we remove your personal data within 30 days, except where retention is required by law.

Scan reports: Retained for 12 months from the date of generation. You may download your reports at any time during this period.

Payment records: Retained for a minimum of 8 years as required under the Indian Income Tax Act and GST regulations.

Consent records: Retained for 3 years from the date of collection, or as required under the DPDP Act, 2023.

As an Indian company, Bachao.AI is committed to compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act). In accordance with the Act:

• We process personal data only for lawful purposes and with your informed consent.
• You have the right to access, correct, and request erasure of your personal data by contacting us.
• You may withdraw consent at any time by writing to us. Withdrawal of consent may result in discontinuation of services.
• We implement reasonable security safeguards to protect your data against unauthorised access, alteration, disclosure, or destruction.
• In the event of a data breach, we will notify affected individuals and the Data Protection Board of India as required under the Act.
• We do not process data of children (individuals under 18 years of age). Our services are intended for business use only.

We use the following types of cookies:

• Essential cookies: Required for authentication (session tokens) and platform functionality. These cannot be disabled.
• Analytics cookies: Used to understand how visitors interact with our website, helping us improve the user experience. These are anonymised where possible.

We do not use third-party advertising or tracking cookies. You may manage cookie preferences through your browser settings.

We employ industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest, access controls, regular security audits, and secure development practices. As a cybersecurity company, we hold ourselves to the highest standards of data protection.

However, no method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or through a prominent notice on our platform. The "Last updated" date at the top of this page reflects the most recent revision.