Privacy Policy

At Naagmani AI, we take privacy and data protection seriously. This Privacy Policy details our practices regarding the collection, processing, transfer, and safeguarding of information gathered through the Naagmani AI Runtime Platform, website, developer console, and APIs (the “Services”).

The Services are operated by Bhakha Services Private Limited (“Company,” “we,” “us,” or “our”), having its registered office at [Company Registered Address].

By accessing or using our Services, you acknowledge the collection and handling of your information as outlined in this Privacy Policy. If you are using the Services on behalf of an enterprise or organization, you represent that you have obtained all necessary consents from authorized users to share their business contact information with us.

We collect information in several distinct categories to operate and protect the platform:

A. Account Information

When you register for an Account or join an Organization, we collect basic identification and contact details such as your full name, email address, company name, organization identifier, job title, and password hash or single sign-on (SSO) profile credentials.

B. Technical & Device Information

When you access our website, developer dashboard, or API endpoints, our systems automatically log technical metadata, including:

• Internet Protocol (IP) address and approximate geographic location (country/city level);
• Browser type, user agent string, language settings, and operating system;
• Timestamps, incoming HTTP request headers, and unique request identifiers;
• Endpoint access paths, HTTP response status codes, and network latency metrics.

C. Usage Information

To manage runtime execution, allocate quotas, and generate accurate billing invoices, we record platform consumption metrics, including token usage (input, output, cached tokens), selected AI models, invocation latency, rate-limiting triggers, and error traces.

D. Billing Information

When you subscribe to paid plans or purchase credits, our third-party payment processors collect and process transaction details (such as billing address, tax identification numbers, and payment method tokens). Naagmani does not store full credit card numbers or banking secrets on its servers; all payment card data is securely handled by certified, PCI-DSS compliant payment gateways.

When using Naagmani APIs, your client applications transmit prompts, conversational messages, documents, code snippets, system instructions, and tool call parameters (collectively, “Payload Data”).

Processing Purpose: Payload Data is processed in real time to enforce configured security rules (such as rate limits and AI firewall policies), route queries to chosen upstream AI providers, and return model responses to your application.

Logging & Ephemeral Handling: By default, Naagmani handles payload data ephemerally during active streaming or HTTP request-response cycles. Depending on your project configuration and log retention settings in the developer console, request metadata and diagnostic samples may be retained for temporary debugging, error analysis, and security verification. We do not claim absolute zero-storage under all debugging configurations; users maintain control over their project audit logging settings.

We use the collected information for specific, legitimate business purposes, including to:

• Provide, maintain, and optimize the Naagmani AI Runtime Platform and APIs;
• Authenticate authorized users and enforce organization-level role-based permissions;
• Route requests intelligently across third-party models and failover endpoints;
• Enforce rate limits, abuse filters, security policies, and AI firewall protections;
• Process billing transactions, compute token consumption, and deliver invoices;
• Diagnose latency bottlenecks, identify runtime anomalies, and resolve platform bugs;
• Communicate critical service advisories, security alerts, and administrative updates;
• Comply with applicable statutory accounting, tax, and legal obligations.

We do not sell your personal data or user prompts to data brokers, advertising networks, or third parties for marketing purposes.

To fulfill inference requests, Naagmani transmits your prompts, messages, and model parameters to the specific upstream AI providers configured by your application (such as OpenAI, Anthropic, Google, DeepSeek, or other self-hosted/cloud providers).

Provider Policies: Once a payload is transmitted to an upstream provider, that data is processed subject to the provider’s own commercial agreements, data processing addenda, and data retention rules. Customers are encouraged to review the privacy and data retention commitments of each upstream vendor they choose to enable within their Naagmani project settings.

Our website and developer portal utilize cookies and browser local storage to maintain session states, secure authentication tokens, and preserve user preferences (such as light or dark theme choices).

For detailed information regarding the specific cookies we utilize and how you can manage your preferences, please consult our Cookie Policy.

We retain personal data and platform telemetry only for the duration necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is mandated or permitted by applicable law (such as statutory tax, legal dispute, or financial audit requirements).

Account records and billing history are retained for the duration of your active account plus applicable statutory retention periods. Operational request logs and telemetry are maintained according to organizational project configurations:

[Data Retention Period — To Be Finalized by Legal/Compliance]

When data is no longer required, we implement technical measures to delete, purge, or securely anonymize it.

We implement rigorous administrative, technical, and physical safeguards designed to protect personal information and customer data against unauthorized access, destruction, loss, alteration, or disclosure.

• Encryption in Transit: All web and API traffic is enforced over TLS 1.2 or TLS 1.3 using modern cryptographic cipher suites.
• Credential Vaulting: Sensitive provider secrets and upstream API keys are stored in encrypted form with strict role segregation.
• Logical Multi-Tenancy: Customer organizations and project workspaces are isolated logically to prevent cross-tenant data leakage.

While we maintain robust security measures, no transmission over the internet or cloud storage architecture can be guaranteed to be 100% impenetrable. We do not claim absolute, unbreakable security.

We share information solely with trusted third parties who assist us in operating our business:

• Upstream AI Providers: Selected AI model vendors required to fulfill application requests;
• Cloud Infrastructure Providers: Managed data centers, compute hosts, and database services;
• Payment Processors: Authorized payment gateways (e.g., Cashfree or similar providers) to execute transactions;
• Observability & Support Vendors: Diagnostic, logging, and customer support tool providers;
• Legal Authorities: Regulatory bodies, law enforcement, or courts when compelled by valid legal processes.

Because Naagmani operates as an international cloud platform interfacing with global AI model providers, your information may be transferred to, stored, and processed in jurisdictions other than your home country.

Where personal data is transferred internationally, we ensure that appropriate safeguards are implemented in compliance with applicable data protection legislation.

Depending on your geographic location and applicable local data privacy legislation (such as in India, the European Economic Area, the United Kingdom, or various US states), you may have certain statutory rights regarding your personal information, which may include:

• Access: The right to request confirmation of and access to personal data we hold about you;
• Rectification: The right to request correction of inaccurate or incomplete personal records;
• Erasure: The right to request deletion of your personal data where statutory grounds exist;
• Restriction: The right to request restriction of processing under specified legal conditions;
• Data Portability: The right to obtain your personal information in a structured, commonly used format;
• Withdrawal of Consent: The right to withdraw consent where processing relies solely on consent.

To exercise any applicable privacy rights, please submit a written request to info@bhakha.com.

Our Services are targeted exclusively at software developers, technical professionals, and commercial enterprises. We do not knowingly solicit, collect, or process personal data from children under the age of majority. If you become aware that an underage individual has provided personal information to us, please notify us immediately so we may purge such records.

We may update this Privacy Policy periodically to reflect technological advancements, operational changes, or new regulatory requirements. When revisions are made, we will update the “Last Updated” date at the top of this page. For material updates, we will provide additional notice via email or within the developer portal.

For questions, privacy inquiries, or data protection concerns, please contact our designated privacy desk at: