Privacy Policy

Pothipath Studio (“we”) runs the AI Library. This policy explains what personal data we collect, why, and your rights under India’s Digital Personal Data Protection Act, 2023. We are the Data Fiduciary for this data.

What we collect and why

• Email address — to create your account, send login codes, payment confirmations and membership reminders.
• Login codes and session tokens — stored only in hashed form, to keep you logged in securely.
• Payment records — for memberships and credit packs: amount, date, Razorpay order and payment IDs, receipt number, and what was bought, to provide it and meet accounting and tax obligations. Your card, UPI or bank details go to Razorpay, not to us.
• Credits — your credit balance and a ledger of credits added and spent, so you can see where they went and so we can fix mistakes.
• Prompt agent chats and creations — what you type to the agent, its replies, and the prompts, chains and skills it writes for you, so you can return to them. Usage records (task, model tier, token counts, cost, time) are kept to run the daily limits and spending cap.
• Web search queries — when the agent searches the web for you, the search text it sent, so we can control cost and abuse.
• Newsletter and waitlists — your email address, when you signed up and confirmed, and where on the site you signed up. We send the newsletter only after you confirm by email.
• Promo code attempts — the code entered, result and time, to enforce usage limits and prevent abuse.
• Network address — stored only as a one-way hash, to limit abuse such as repeated code requests.

We do not sell personal data or show advertising. We use Google Analytics to measure how the site is used, but only if you accept it in the cookie banner (see “Cookies and storage” below). Newsletter emails contain no tracking pixels. Links in them carry a plain “utm” tag naming the issue, which tells us which issue a visit came from but not who made it.

The prompt agent and AI providers

The agent works by sending your messages to an AI model provider, which writes the reply. Depending on the task, this may be OpenAI, Anthropic, Google or another provider we configure. We send your messages and the instructions the agent needs; we do not send your email address or name. Each provider processes the text under its own terms for business API customers, which generally do not allow the text to be used to train their models. When web search is used, the search text goes to our search provider (Tavily or Brave Search). Do not put passwords, ID numbers, health records or other sensitive information into the agent.

Cookies and storage

Essential cookies are always on, because the site cannot work without them: one keeps you logged in, one protects forms against forgery, and one briefly carries on-screen messages. They are not used for tracking.

Google Analytics is off until you click Accept in the cookie banner. If you accept, Google Analytics sets cookies and measures which pages you visit, your device and browser type, your approximate location and how you arrived at the site (for example from a search or a link). We use this to see what is useful and what to improve. Google acts as our processor for this data and may process it outside India. If you click Decline, Google Analytics is not loaded and sets no cookies.

You can change your choice at any time with the “Cookie settings” link in the footer of every page. Declining or withdrawing does not affect your use of the site. Your choice is remembered in your browser’s local storage; if your browser blocks storage, we ask again on each visit.

Your browser’s local storage also keeps small preferences on your device, such as your light/dark theme, the agent mode you last used, and dismissed notices. None of that is sent to us.

Who we share data with

• Razorpay — to process payments.
• AI model providers — the text of your agent conversations, as described above.
• Web search provider — the search text only.
• Our web hosting and email provider — to run the site and send emails, including the newsletter.
• Authorities, only where Indian law requires it.

Some of these providers process data outside India. We use them under their standard business terms.

How long we keep it

• Account data, agent chats and creations: while your account exists. Delete chats one by one, or delete your account from your account page to remove all of them.
• Login codes: expire after 10 minutes and are deleted within a day. Sessions: up to 30 days.
• Agent usage records and web search queries: 90 days.
• Newsletter: until you unsubscribe. Every email has a one-click unsubscribe link. After you unsubscribe we keep your address marked as unsubscribed so we never email you again by mistake; ask us and we will erase it completely.
• Waitlists: until we announce the launch, then deleted or kept only if you also subscribed to the newsletter.
• Payment records: as long as Indian tax and accounting law requires, even after account deletion; they are then detached from your email.
• Abuse-prevention logs: up to 12 months.

Your rights

You can ask to access a summary of your data, correct it, or erase it, and withdraw consent at any time (for the newsletter, by unsubscribing; for everything else, by deleting your account). Deleting your account also removes your agent chats, creations, credits, newsletter subscription and waitlist entries. You can nominate someone to exercise these rights if you die or become unable to. Email hello@pothipath.com. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Security

We use encrypted connections (HTTPS), hash login codes, session tokens and network addresses, encrypt stored AI provider keys, and limit access to our database. If a breach affects your data, we will inform you and the Data Protection Board as the law requires.

Children

The Library is for people aged 18 and over. We do not knowingly collect data from children.

Grievance officer

Kamesh Vishwakarma, Pothipath Studio, H No. 160-A, Chhola Road, Bhopal 462038, Madhya Pradesh, India · hello@pothipath.com. We reply within 7 working days.

Changes

If we change this policy in a way that affects you, we will email you before it applies.