Privacy Policy

• We only use your uploaded policy documents to analyze them for you — never to sell you anything without telling you, and never shared with insurers for marketing purposes.
• We don't send your name, email, or phone number to the AI systems that read your policy — only the policy text itself.
• You can download a copy of everything we have on you, or delete your account entirely, any time from your account settings.
• We never display "we earn a commission" language because when we do work with insurers in the future, that relationship won't change what we tell you about your own policy's risks.

When you sign up: your email address, full name, and (optionally) phone number. Your password is never stored in readable form — we store a one-way cryptographic hash of it, which means even we can't see your actual password.

When you upload a policy document: the file itself (stored privately — never publicly accessible), and everything our AI extracts from it: clauses, exclusions, waiting periods, sub-limits, and so on. We also record a fingerprint (hash) of the file so we can recognize if you upload the same document twice.

When you chat with BHAI: your questions and BHAI's answers, so you can scroll back through a conversation and so we can improve the assistant over time.

Automatically: basic technical information like your IP address and browser type, mainly for security and to keep the service running reliably.

We don't ask for or store your insurance policy number's linkage to any government ID, your bank account details, or payment information (the service is free during this launch phase — see our Pricing page).

• To analyze your policy: extracting the text of your uploaded document and sending it to an AI system to identify clauses, risks, and generate your risk score and summary.
• To power BHAI: answering your questions about your specific uploaded policy, using only that policy's content as context.
• To keep your account secure: sending you an email if we notice a sign-in from a new device, and letting you log out of all your sessions at once.
• To notify you: telling you when your policy analysis is ready, or if your password was reset.
• To improve the product: understanding, in aggregate and anonymously, which insurers and policy types are uploaded most.

• We never send your name, email, or phone number to the AI systems (Gemini, OpenAI, Claude) that analyze your policy or power BHAI — only extracted policy text and your chat questions.
• We never sell your personal data to anyone.
• We never display "we earn money from this" language to hide how the product works.
• We never make claim decisions or guarantee any insurance outcome.

AI providers (Google Gemini, OpenAI, Anthropic Claude) — extracted policy text and chat questions only, never your name/email/phone.

Email provider (Resend) — your email address, to send account-related emails.

Cloud storage provider — stores your uploaded policy PDF privately, accessible only via time-limited secure links.

We do not share your data with insurers for marketing purposes, and we do not sell data to advertisers.

Our Insurer Conduct and Policy Friendliness scores are built only from aggregate, already-public regulatory statistics published by IRDAI and the Council for Insurance Ombudsmen (CIO) — no personal or complaint-level data about any individual is ingested. These scores are AI-interpreted from that public data for information only; they are not advice, not a statement of fact about any insurer, and may be out of date. See our methodology for how they are computed.

We keep your data until you remove it. Your account, uploaded policy documents, and their analysis stay with us for as long as your account is active — we don't auto-expire or delete them on a timer.

When you delete a single policy, we delete the actual uploaded file from our storage, not just hide it from your dashboard.

When you delete your account, we immediately remove your name, email, and phone number and disable the account, then permanently delete everything else — your policies, the uploaded files themselves, chat history, and analysis — after a 30-day window. This short delay exists only so an accidental deletion can still be reversed if you contact support in time.

A minimal, non-identifying record that consent was given or withdrawn (and when) is kept as a legal audit requirement even after erasure — it contains no name, email, or phone number. Certain security and cost logs are retained for a limited period (up to 90 days) and never contain your policy contents.

As a Data Principal under India's Digital Personal Data Protection Act, 2023, you can — at any time, from your account settings or by emailing our Grievance Officer (below):

• Access and download a copy of the personal data we hold about you.
• Correct or update your profile information.
• Erase your data — deleting your account anonymizes your identity immediately and permanently deletes the rest (including the uploaded files) after a 30-day grace period.
• Grievance redressal — raise a complaint with our Grievance Officer and receive a response within 30 days.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity (contact us to record a nomination).

Withdrawing consent is as easy as giving it. Toggle marketing emails off in your account settings at any time. You can withdraw consent for AI-powered analysis too — but because analysing your policy is the core function of the service, withdrawing it means we can no longer provide that analysis, so the practical step is to delete the relevant policy or your account. Withdrawing consent does not affect the lawfulness of processing already carried out while consent was in place.

Your account data and uploaded documents are stored in the Mumbai (India) region. To generate the analysis and power BHAI, the extracted text of your policy (never your name, email, or phone) is sent to AI providers (Google Gemini, OpenAI, Anthropic Claude) whose processing may occur outside India — no major AI provider currently offers an India-only processing region. These providers act on our instructions as processors and do not use your data to train their own models. We will honour any transfer restrictions the Government of India notifies under the DPDP Act.

Encrypted connections (HTTPS) everywhere, passwords hashed (never stored in plain text), private storage with short-lived access links, and role-based access controls. No system is perfectly secure — please use a strong, unique password.

PolicyJaano is intended for adults making their own insurance decisions and is not directed at children. We do not knowingly collect data from anyone under 18.

If we make material changes to this policy, we'll notify you by email and/or a notice on the site before the changes take effect.

In line with the DPDP Act 2023, you can reach our Grievance Officer with any question or complaint about how your personal data is handled. We aim to respond within 30 days.

[GRIEVANCE OFFICER NAME — to be appointed before launch]
grievance@policyjaano.com

General questions about this policy or your data: support@policyjaano.com

Data Fiduciary: [REGISTERED LEGAL ENTITY NAME], [REGISTERED ADDRESS, CITY, STATE, PIN — India].