Privacy Policy

01Who is responsible

GPHInnovation, a sole proprietorship firm based in Uttar Pradesh, India, operating as gphlab.ai, is responsible for your personal data under this policy. This policy covers our website gphlab.ai, our enquiry forms and our App at app.gphlab.ai. We handle personal data in line with India's Digital Personal Data Protection Act, 2023 and other applicable laws.

02What we collect

When you contact us or request a quote

• Name, business name, email address, phone number (optional), the service you are interested in, your message and the page you sent it from.
• Your IP address, used to prevent spam and abuse.

When you use the App

• Account details: name, email address and password. Passwords are stored only in hashed form, so we cannot read them.
• Your inputs: answers you give in the wizard, such as your skills, experience, goals and market, plus questions you ask the AI strategist.
• Content you create or upload: prompts, documents, images, knowledge-base files and project files you add while using the App's tools.
• Results: the blueprints, sources and progress that the App creates for you.
• Contacts you collect: enquiries that arrive through your lead sources, and contacts you import or add. See "Leads you collect through the App" below.
• Credits and payments: your credit balance and history, and payment references such as a UPI or bank reference. We do not store card numbers.
• Technical data: IP address, login times and basic logs, used for security, rate limiting and fixing problems.

03Leads you collect through the App

When you use Contacts, we store the names, emails, phone numbers, messages and other details of people who contact your business. For this information:

• You are in charge of it (the data fiduciary). You decide what to collect and are responsible for having a lawful reason and any required consent, and for telling those people how you use their details.
• We act only on your instructions (as your data processor). We store and display it so you can manage your leads. We never sell it, never contact those people, and never use it for our own marketing or to train AI models.
• If one of your leads asks us about their data, we will pass the request to you and help you respond.
• It is deleted when you delete the contact, and all of it is deleted when your account is deleted, as described under "How long we keep it".

04How we use it

• To reply to your enquiry and prepare for your consultation.
• To create and run your account, and to produce the AI research and blueprints you ask for.
• To manage credits, payments and refunds.
• To send service emails such as email confirmation, password resets and important account notices.
• To protect the website and App against spam, fraud, bots and misuse.
• To improve our services, using information about how features are used.
• To meet legal, tax and accounting obligations.

We do not sell your personal data. We do not use your inputs to train our own AI models.

05Who we share it with

We share personal data only with service providers who help us run gphlab.ai, and only as much as they need:

• Anthropic (Claude AI): processes your wizard answers and strategist questions to generate research and blueprints. Under Anthropic's commercial API terms, API data is not used to train their models by default.
• Cloudflare Turnstile: checks that a real person, not a bot, is using our forms and login pages.
• Our web hosting provider in India: stores our website, App, database and email on servers located in India.
• Google Fonts: delivers the fonts our pages use. Your browser connects to Google to load them.
• Payment providers: process your payment if you pay by card or through a payment gateway.

Connected services: if you connect an outside service such as Meta, WhatsApp Business or Google, data is exchanged with it only as needed for that feature and within the permissions you give, and that service's own privacy policy applies.

We may also disclose data if the law requires it, or to protect our rights, users or the public.

06Where your data is stored

• In India: your account, blueprints, contacts, enquiries and our databases are stored on servers located in India.
• Outside India: when you use the App's AI features, the text you submit is sent to Anthropic for processing in the United States, and Cloudflare's bot check runs on its global network. We send only what is needed for the feature to work.

We transfer data outside India only in line with the Digital Personal Data Protection Act, 2023 and any restrictions the Government of India notifies under it.

07Cookies

The App uses one essential cookie, gph_session, to keep you logged in. It is secure, cannot be read by scripts on the page and lasts up to 30 days. Cloudflare Turnstile may set its own cookies to tell people and bots apart. We do not currently use advertising or tracking cookies. If we add analytics or advertising tools such as Google Analytics or the Meta Pixel in future, we will update this policy first.

08How long we keep it

• Enquiries: up to 3 years after our last contact, unless you become a client.
• App accounts, blueprints and contacts: while your account is active. A contact you delete is removed straight away. When your account is closed, we keep your data for 90 days so you can ask for an export or change your mind, then delete it permanently, except records we must keep by law.
• Payment and invoice records: as long as Indian tax and accounting law requires, usually 8 years.
• Security logs: short periods, normally no longer than 90 days.

09Security

We protect your data with HTTPS encryption, hashed passwords, signed login sessions, bot protection, rate limits and access controls. No online service can be 100% secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

10Your rights

Subject to applicable law, you can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct or update inaccurate data;
• delete your data and close your account;
• withdraw your consent to processing that relies on consent;
• name another person to exercise your rights if you die or become incapacitated.

To make a request, email us or use our contact page. We may need to confirm your identity first. We aim to reply within 30 days.

11Children

Our website and App are for adults running or starting a business. They are not meant for anyone under 18, and we do not knowingly collect children's data. If you believe a child has given us personal data, contact us and we will delete it.

12Grievance officer

If you have a concern about how we handle your personal data, please contact our grievance officer:

We will acknowledge your complaint within 48 hours and aim to resolve it within 30 days. If you are not satisfied, you can approach the Data Protection Board of India.

13Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date on this page, and for important changes we will also tell account holders by email or in the App.

14Contact us