This policy explains how Shibani Web Store Pvt. Ltd. ("PiChat AI", "we") handles personal data when you use the PiChat AI website and app. It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP), the EU/UK GDPR, and the UAE Personal Data Protection Law (Federal Decree-Law 45 of 2021), plus the Information Technology Act, 2000 and its rules in India.
Data controller / data fiduciary: Shibani Web Store Pvt. Ltd., B1-90/C7/1503, B.B.T. Road, Left Side Towers, Kolkata, West Bengal 700137, India. Contact and grievance details are on the Contact page. EU/UK representative (needed if we target EU/UK users): [appoint or confirm not required].
| Category | Examples |
|---|---|
| Account data | Name, email, password (stored hashed), login method, country, account role |
| Chat data | Messages you send, files you upload, AI responses, conversation titles, model chosen |
| Usage and billing data | Credits used, models used, token counts, plan, payment status, order and payment IDs, invoice and tax details |
| Technical data | IP address, device and browser type, log data, security events |
| Support data | What you tell us when you contact us |
We do not receive your full card number or UPI PIN; payment providers handle those. Do not enter sensitive personal data (health, financial account numbers, government IDs, others' personal data) in chats unless you need to and have the right to.
| Purpose | GDPR basis / DPDP basis |
|---|---|
| Provide the Service (accounts, chats, sending your Input to the model you pick) | Contract / consent and legitimate use |
| Process payments, credits, taxes, invoices | Contract; legal obligation |
| Security, fraud and abuse prevention, service reliability | Legitimate interests; legitimate use |
| Customer support and service messages | Contract; legitimate interests |
| Product updates or marketing email (only if you opt in) | Consent |
| Legal claims and compliance | Legal obligation; legitimate interests |
When you send a message, we pass it to the model provider needed to answer (for example OpenAI, Anthropic, Google, or others through OpenRouter). They process it under their own terms. We use provider API services and [confirm for each provider: whether API data is excluded from model training and the retention period]. We do not sell your chats and we do not use them to train our own models [confirm this is true].
Only service providers we need: AI model providers, payment processors, hosting and infrastructure, email delivery, security and analytics tools. See the sub-processor list. We may also disclose data if the law requires, to protect rights and safety, or in a business transfer. We do not sell personal data and do not share it for cross-context advertising.
Your data may be processed outside your country, including in [India, UAE, US, EU: list actual hosting regions]. For transfers from the EU/UK we use safeguards such as Standard Contractual Clauses. Transfers under DPDP follow the rules notified by the Government of India.
Everyone: ask what data we hold, correct it, and delete your account and chats. Use in-app settings or contact us.
EU/UK (GDPR): access, rectification, erasure, restriction, portability, objection, withdrawing consent at any time, and complaining to your supervisory authority.
India (DPDP): access to a summary of your data, correction and erasure, grievance redressal, and nominating another person to exercise your rights if you die or become incapacitated. You can complain to the Data Protection Board after using our grievance process first.
UAE (PDPL): access, correction, erasure, restriction, portability and objection, as the law provides.
California and similar US states: know, delete, correct and opt out of sale or sharing. We do not sell or share personal data as defined by those laws [confirm].
We reply within [30 days] (or the shorter time the law requires). We may need to verify your identity.
The Service is for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has an account, contact us and we will delete it.
We use measures such as encryption in transit, hashed passwords, access controls and monitoring [confirm actual measures]. No system is perfectly secure. If a breach affects your data we will notify you and the authorities as the law requires (for example within 72 hours under GDPR, and as per DPDP and CERT-In rules in India).
See our Cookie Policy.
We will post updates here and change the date above. For material changes we will notify you in the app or by email.
Grievance Officer / Data Protection contact: Kalyan Chatterjee, support@pichatai.com, Shibani Web Store Pvt. Ltd., B1-90/C7/1503, B.B.T. Road, Left Side Towers, Kolkata, West Bengal 700137, India. Details on the Contact page.