Privacy policy

This policy explains what personal data SaarthiOS collects, why, who it is shared with, and the choices and rights you have. It covers our website and the SaarthiOS service, including every mailbox you connect, whether Gmail (Google) or Outlook / Microsoft 365 (Microsoft).

SaarthiOS is operated by AI Gurukul Pvt. Ltd., 804, N4 Type IV, 8th Floor, Supertech Czar, Omicron 1, Alpha Greater Noida, Gautam Buddha Nagar, Noida, Uttar Pradesh 201310, India (“SaarthiOS”, “we”, “us”). Please read it with our Terms and conditions.

1. Who is responsible for your data

• When you sign up for yourself, we decide how your data is used and are its Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).
• When your organisation signs up and connects its mailboxes, your organisation is the Data Fiduciary and we process the data on its behalf and on its instructions, as its Data Processor. Questions about that data may also go to your organisation.

2. What we collect

Data	Examples
Mailbox data	Messages, their headers (sender, recipients, subject, date) and attachments, from mailboxes you connect
Connection details	The mailbox’s email address and the connection key Google or Microsoft issues to us
Account details	Your name, work email, organisation and role
Usage and device data	IP address, browser, pages visited, times and error logs, used to run and secure the service
Communications	What you send us when you ask for support or write to us

Mailbox access is granted on Google’s or Microsoft’s own page and is read-only:

Provider	Permission
Gmail (Google)	gmail.readonly
Outlook / Microsoft 365	Mail.Read

SaarthiOS cannot send, delete or change any email. For a Microsoft 365 organisation, access is approved by its administrator for the mailboxes it chooses.

Your email naturally contains information about other people, such as those who write to you. We handle it under this same policy and use it only to provide SaarthiOS to you.

3. Why we use it

• To provide SaarthiOS: read your work email to find what needs your attention, who is waiting on whom, and the next step for each, and show them to you.
• To run and protect the service: keep it secure, prevent abuse, fix errors and support you.
• To meet legal duties: keep records and respond to lawful requests.

We process mailbox data on the basis of the consent you, or your organisation, give when connecting the mailbox. We use it for nothing else: we do not sell it, use it for advertising or build marketing profiles from it.

4. Artificial intelligence

To produce your results, parts of your email are processed by AI model providers that work for us under contract. They may use the data only to answer our request, and may not keep it for their own purposes or use it to train their models. Your email data, from Google or Microsoft, is never used to develop, improve or train AI or machine learning models, ours or anyone else’s.

5. Who can see it

People at SaarthiOS do not read your email, except: when you ask us to (for example, for support); when it is needed to investigate security or abuse; when the law requires; or in anonymised and combined form for running the service.

6. Sharing

• We never sell your data and never use it for advertising.
• We share it only with service providers that run SaarthiOS for us, under contracts that require them to protect it and use it only for us: Google Cloud (hosting) and our AI model providers.
• We disclose it when the law, a court or a government authority lawfully requires it.
• If SaarthiOS is merged or sold, your data may pass to the new owner under this policy. We will tell you before that happens.

7. Where it is kept

We store your data on Google Cloud servers in India. Our AI model providers may process parts of it in other countries to produce your results. Any such transfer is only to countries not restricted by the Government of India, and under contracts that require the same protection as this policy.

8. Data security

• Data is encrypted in transit (HTTPS/TLS) and encrypted at rest.
• Connection keys from Google and Microsoft are kept in a separately encrypted store and are never shown to the person who connected.
• Access is read-only by design: SaarthiOS cannot send, delete or change email.
• Only authorised staff can reach these systems, and only when their role needs it.
• If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires.

9. How long we keep it

• Mailbox data and connection keys: while the mailbox is connected. After you disconnect, we delete them within 30 days, and from backups within 90 days.
• Account details: while your account is open, then deleted on the same timeline.
• Records we must keep by law, such as security logs: only as long as the law requires.

10. Cookies

We use only the cookies the service needs to work: to sign you in safely and keep your session. We do not use advertising or tracking cookies.

11. Your rights and choices

Under the DPDP Act and other applicable law, you may:

• get a summary of the personal data we hold about you and how we use it;
• have it corrected, completed, updated or erased;
• withdraw your consent at any time, as easily as you gave it. This stops further processing but does not affect what was lawfully done before;
• nominate someone to exercise these rights if you die or are unable to;
• raise a grievance with us and, if not satisfied, with the Data Protection Board of India.

To withdraw consent for a mailbox, disconnect it:

• Gmail: on our Disconnect page, or at myaccount.google.com/connections: choose SaarthiOS and delete the connection.
• Microsoft 365: your administrator removes SaarthiOS under Microsoft Entra admin centre → Enterprise applications, or asks us to. A personal Microsoft account can remove it at account.live.com/consent/Manage.

Access stops at once. For any other request, write to hello@saarthios.com. We may need to confirm your identity first, and we reply within the time the law allows.

12. Google user data

For data from Gmail, in addition to everything above:

• We use it only to provide and improve the SaarthiOS features you see.
• We never use it for advertising, never sell it, and never use it to train AI or machine learning models.
• People at SaarthiOS do not read it, except with your agreement, for security, to comply with the law, or in anonymised and combined form for running the service.

SaarthiOS’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

13. Microsoft user data

For data from Outlook / Microsoft 365 we make the same promises as for Google above, and we use it in line with the Microsoft APIs Terms of Use.

14. Children’s data

SaarthiOS is not in any manner intended for children under the age of 18 (eighteen). We do not knowingly collect any personal data from children. If you believe a child has given us data, write to us and we will delete it.

15. Changes to this policy

If we change this policy we update the date above, and tell connected users by email before a material change applies.

16. Contact and grievance officer

• Privacy questions and requests: hello@saarthios.com.
• Grievance officer (Information Technology Act, 2000 and DPDP Act, 2023): hello@saarthios.com, AI Gurukul Pvt. Ltd., 804, N4 Type IV, 8th Floor, Supertech Czar, Omicron 1, Alpha Greater Noida, Gautam Buddha Nagar, Noida, Uttar Pradesh 201310, India.