Privacy Policy

Five points sum up this policy. The sections after them give the full detail.

• What we collect. We store your email, a hashed password and the profile details you give during setup. We store your projects, the prompts you track and the AI answers we capture for them. We also keep billing records, visit analytics, product events and server logs. A free AI audit adds the website and email you give us. If an owner or admin connects a project to Google Search Console or Google Analytics, we also store figures read from it. We never see or store your card, UPI or bank details.
• Why we use it. We use it to run the service and the free AI audit, keep your account secure, take payment and issue GST invoices. We also use it to send service email, help you finish setup, detect abuse and meet legal or tax obligations. We do not sell your personal data, and we do not use your prompts or results to advertise to you. Figures read from a connected Search Console or Google Analytics property are used to show your workspace its own figures, and are never sold or used for advertising.
• Who processes it. Microsoft Azure hosts the service and its database in Azure Central India. Your prompt text, brand names and competitor names go to AI search providers so we can capture their answers. Razorpay takes payments and Cal.com books demo calls. Our own Google Analytics runs on our marketing pages only if you accept it. Figures read from a connected Search Console or Google Analytics property are stored with Microsoft Azure, our host, and go to no other provider and no AI model. Some of these providers process data outside India. The full list is in the sub-processors section below.
• How long we keep it. Account and workspace data stays while your account is open. Figures from a connected Search Console or Google Analytics property have their own limits, set out below. Invoices and tax records stay as long as Indian tax law requires, currently eight financial years. Visit analytics are deleted after 180 days and product events after 400 days. Free AI audit reports are deleted after 90 days. The website and email from an audit stay in our leads list until you ask us to delete them.
• How to ask for deletion. There is no self-serve delete button yet. Email team@depra.ai from your account address. We aim to complete deletion within 30 days and will confirm by email. Invoices and tax records stay, because Indian tax law requires it. For free AI audit details, write from the email you used. Disconnecting Search Console or Google Analytics from a project deletes its figures from our database at once.

Depra AI (“we”, “us”) operates depra.ai, a service that tracks how AI answer engines describe brands. We are based in India and act as the Data Fiduciary for the personal data described below, as that term is used in India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).

Depra AI is a product of Wizthinkers Private Limited, a company incorporated in India on 25 November 2022 (CIN U74999UP2022PTC174011), with its registered office in Aligarh, Uttar Pradesh.

For any privacy question or request, contact team@depra.ai.

Account data. When you sign up we store your email address, a securely hashed password (we never store the password itself) and whether your email has been verified. If you sign in with Google, we receive your email address, name and profile basics from Google, never your Google password.

Profile data. During setup, the About you screen asks for your name and, if you own the workspace, your company or agency name. It also asks for your phone number. That is optional, and the screen says why we ask: so the Depra AI team can call you if your setup stalls. Leave it blank and we store no number. At the end of setup we ask two short questions, and you can skip either: what you want from Depra AI, and how you heard about us. The Invite your team screen then asks for your job level (such as founder, manager or individual contributor). If you own an agency workspace, it also asks for your agency’s website and how many clients you track. These are optional too. If you answered an earlier version of our signup questions, we keep the role and job function you picked there. We also record which setup and Start here steps you have finished, whether you opened Book a demo and whether a booking followed, and the email addresses of teammates you invite, so we can send them their invite.

Product events. Inside the app we record the steps you take, such as starting the first free scan, opening its results, opening Book a demo and reaching checkout. Each event holds its name, the time, your workspace, your user and project where there is one, and a few plain facts about the step, such as which button or plan it was. It may also carry the two random visit ids described under cookies below, so a visit and what followed line up. An event never holds your phone number, email, name, job level, what you want from Depra AI or how you heard about us. We use events to see where setup works and where people get stuck. They are stored on our own servers. No analytics or advertising company receives them, and we never sell them.

Workspace data. Your organisation name, your GSTIN if you enter one for invoicing, optional white-label branding (logo URL, accent colour, footer text), and the projects you create: brand names, competitor names, website domains, target countries and the prompts you choose to track.

Results data. The answers AI engines return for your prompts, the sources those answers cite, and the brand mentions we extract from them. This is data about publicly generated AI output, but we store it against your account.

Connected Google data. If an owner or admin connects a project to Google Search Console or Google Analytics, we store figures read from it about that project’s website, the property chosen, who connected it, and an encrypted key that lets us read it. The section on connecting Google below says what we read, who sees it and how long we keep it.

Billing data. Your plan, subscription period, invoice records and GSTIN. We never see or store your card, UPI or bank details. Those go directly to Razorpay, our payment processor.

Technical data. Server logs containing IP address, request paths and timestamps, kept for security and debugging.

Free AI audit. When you run the free AI audit on depra.ai you give us a website and an email address. No account is made. Our web reader, DepraBot, reads that site’s homepage, robots.txt and llms.txt. From the homepage we draft a brand name, a category, up to 5 competitor names and 5 buyer questions. We ask the questions to four AI engines and build a report. If we cannot read the homepage, we ask you for the brand name and one line about it. We store the website, the email, what we read and drafted, anything you typed, the answers, the brands and sources in them, and the report. We also save the page you were on, the page that sent you, any campaign tags in the address and the two random visit ids described under cookies below, so a visit and the audit that followed line up. Your IP address is used in memory to limit how many audits one network can start. It is not saved with the audit. We send at most one email for an audit, to the address you gave, with a private link to the report. Anyone who has that link can open the report. If someone else audits the same website within 7 days, we may show them that report and not run a new one. A report never shows your email, and one built from a brand name you typed is never reused for another person. The website and the email also go into our leads list. Only the Depra AI team sees that list, inside our own admin tool, and the team may write to you about your audit. Before we show a full report we may ask for a phone number. If you give one, we keep it with your email in our leads list, and the Depra AI team may call or message you on it about your audit. If you sign up for Depra AI with the same email address, we link the report to your workspace so you can open it in the app until your setup is opened. A free AI audit you run inside the app is stored the same way with your workspace, sends no email and is not added to the leads list. The app may also ask for a phone number before it shows the full report. That number is saved on your account as your profile phone number.

• To run the service you signed up for: scheduling runs, computing your metrics, generating reports.
• To show the members of a workspace the Search Console and Google Analytics figures of a project that an owner or admin has connected, next to its AI visibility.
• To authenticate you and keep your account secure.
• To help you finish setup: if you gave us a phone number, the Depra AI team may call it when your setup stalls. We never use it for ads.
• To take payment, issue GST invoices, and manage your subscription.
• To send service email: verification codes, password resets, renewal reminders, security notices and invites to teammates you add.
• To run a free AI audit you asked for, show you its report and email you the link. If you gave a phone number for it, the Depra AI team may call or message you on it about your audit.
• To detect abuse, debug failures, and meet legal or tax obligations.

We do not sell your personal data, and we do not use your prompts or results to advertise to you.

Who sees your profile. Your phone number, job level, what you want from Depra AI and how you heard about us are shown only to the Depra AI team, inside our own admin tool. They are never sent to our analytics, never added to a web address and never included in an email. One exception is yours to make: we pass your phone number to Razorpay only if you tick the box on our Billing page that offers to fill it in, and only for that checkout. That box starts unticked.

Running the service means sending some data to specialist providers. Notably, your prompt text, brand names and competitor names are transmitted to AI search providers in order to capture what those engines say. A free AI audit sends its 5 questions to those providers. The homepage text we read for it, the brand name and the answers go to Azure OpenAI, or to OpenAI as a fallback, to draft the questions and read the answers. Our current sub-processors:

• Microsoft Azure: hosting, database and transactional email. Application and database servers are in Azure Central India.
• DataForSEO: captures answers from ChatGPT, Gemini and Google AI Overviews. Receives your prompt text.
• Perplexity: Perplexity answer capture. Receives your prompt text.
• Azure OpenAI (South India region): reads captured answers to identify brand mentions and sentiment. Receives answer text and your brand/competitor names.
• OpenAI: used as a fallback for answer capture and mention extraction when our primary providers are unavailable. In that case it receives your prompt text, the captured answer, and your brand and competitor names.
• Google has four distinct uses as a sub-processor: Google Sign-In if you choose it; Gemini as a fallback answer-capture provider (receives your prompt text); Google’s public favicon service, which our dashboard and the product demo on our home page use to display website icons; and our own Google Analytics with Google Tag Manager on our public marketing pages, only if you accept them. The favicon service means Google receives the domain names shown on your dashboard (your tracked domain and the domains cited in your results) along with your IP address and browser details. On our home page it receives the brand and website domains shown in the demo, with your IP address and browser details. Our own Google Analytics and Tag Manager are described under cookies below. They are not used inside the logged-in application. Separately, if a project is connected to Google Search Console or Google Analytics, our servers read that project’s figures from Google, as the next section describes.
• Brandfetch: supplies company logos on our public marketing pages. Receives the IP address and browser details of visitors to those pages. It is not used inside the logged-in application.
• Razorpay: payment processing. Receives your billing details directly; they are a PCI-DSS compliant processor. Their checkout script loads on our billing page. To save you typing, we may fill in your name and email in their checkout. We send your phone number only if you tick the box on our Billing page that offers it, and only for that checkout.
• Cal.com: books demo calls. Receives what you type into its booking form, plus a random reference and which button you used. For bookings made on our demo page, we read the booking’s time and status and the email you booked with from Cal.com.

At a glance, here is what each provider does and what it receives. The table also covers the third-party requests your browser makes, described under cookies below.

Some of these providers process data outside India. The DPDP Act permits such transfers except to countries the Government restricts; we will update this policy if that list affects us. We will also update this section before adding a new sub-processor.

This section is about a Google Search Console property or a Google Analytics 4 property that an owner or admin of your workspace connects to a Depra AI project. It is not about our own Google Analytics on our marketing pages, which is described under cookies below. We read nothing from either product for a project until someone connects it, and connecting may not be open to your workspace yet.

Connecting. Only an owner or admin of the workspace can connect a project, with their own Google account, on Google’s own consent page, where Google’s privacy policy applies. This is a separate permission from Google Sign-In. We ask Google for one read-only scope: webmasters.readonly for Search Console, or analytics.readonly for Google Analytics. We never write to either product. We do not ask Google for that account’s email address, name or profile, and we store no Google account email, name or id. Only the person who started a connection can finish it, on the same project, so a link passed to someone else cannot attach their Google account to it.

What we read from Search Console. We read the list of properties the Google account can see, to find the one that matches the project’s website. Only the person who connected sees the matching ones, and we store only the property chosen, with that account’s permission level on it. From that property we read web search figures only: clicks, impressions and average position. We read them in four forms: daily totals; daily totals for each of the project’s markets (up to 10 countries); the top 200 pages of each day; and, once a week, the top search queries of a 28-day window (the top 1,000, plus up to 1,000 queries of five or more words). If the property covers a wider domain than the project’s website, we read figures for that website only. The first read goes back 486 days for daily totals and market totals, about as far as Google keeps this data, 90 days for pages and four weekly windows for queries. Before we store anything, we drop countries outside the project’s markets, queries in any script other than Latin, queries over 500 bytes and page addresses over 1,000 bytes.

What we read from Google Analytics. We read the names of the accounts and properties the Google account can see, and the website address of the web data streams of up to 25 of those properties, to find the property that measures the project’s website. Only the person who connected sees that list, and we do not store it. Before a property is chosen, we run one short report on it, sessions by website host over the last 28 days, and keep only the result of that check. For the property chosen we store its id, name, time zone and service level. From it we read four figures for each day: sessions, engaged sessions, key events and events. We read them for all visits to the project’s website, in total and by default channel group, and for visits from AI assistants such as ChatGPT, Perplexity, Gemini and Copilot, by source and medium and by landing page. We keep at most the top 25 channel groups, 50 AI sources and 100 AI landing pages of each day. We keep a landing page only as its path, with anything after a ? or # cut off. If the property also measures other websites, we read only the project’s website and its subdomains. The first read goes back 760 days, and 400 days for landing pages.

No visitor-level data. Every figure we store is a total for one day, or for one 28-day window in the case of Search Console queries. We read no user-level data from either product: no user ids, client ids, IP addresses or device ids. From Google Analytics we read no country, city, device, browser, age, gender, revenue or ecommerce figures.

How often we read. We read each connected property once a day on a schedule. We also read right after a project is connected or a property is chosen, when any member of the workspace asks for a fresh read (at most four times an hour for each project), and to retry or finish a read that stopped early. The daily read skips a workspace that has paused tracking or whose trial or plan has ended. A fresh read is refused once the trial or plan has ended. We read nothing while the connector is switched off for your workspace.

Who sees the figures. Every member of the workspace who can open the project can see its stored figures, whatever their role. A member who was given only some projects sees only those. Members can also see which property is connected and which Depra AI user connected it, with that user’s name and the email address of their Depra AI account. Only the person who connected, while they are an owner or admin, can see the properties we list from their Google account, or choose another one. A fresh read asked for by any member uses the access of the person who connected. The Depra AI team’s admin tool has no view of these figures. People at Depra AI do not read them, except when you ask us to (for example in a support request), when we must investigate a security problem or abuse, or when the law requires it.

How we use the figures. We use them to show the members of the project’s workspace that project’s own Search Console and Google Analytics figures in Depra AI, next to its AI visibility. Beyond that, people at Depra AI read them only in the three cases above, and a product event keeps a few counts from each connection, as described below. We never sell them, and never use them for advertising or for credit or lending decisions. We never share them outside the workspace unless the law requires it, and we never pool them with other customers’ figures. They are stored in our own database, which Microsoft Azure hosts in Azure Central India, and no other provider receives them. We do not send them to any AI model, and we never use them to train one. Before we use them in any other way, we will update this policy and ask for your consent.

The key Google gives us. For each connection Google gives us a refresh token, a long-lived key that lets us read the figures. It is the only Google credential we store for a connection. We encrypt it with AES-256-GCM, bound to its project, under a separate key that is never stored in the database. We send it only to Google, and no answer from our API, queue job or log line holds it. The short-lived access tokens made from it stay in memory for one read and are never stored.

How long we keep the figures. While a property stays connected, we keep Search Console daily totals and market totals for 760 days, pages for the 90 most recent days we have read, and the latest four weekly query windows. We keep Google Analytics daily totals, channel groups and AI sources for 760 days, and AI landing pages for 400 days. Older figures are deleted at the end of every complete read, and once a day for an active connection that has not been read for 36 hours. While we are not reading a connection, for example because the workspace has paused tracking or its trial or plan has ended, its key and figures stay, within these limits, until the connection is removed. The record of each read holds what started it, when it ran, which member asked for it if one did, counts and fixed error codes, and is deleted after 30 days. A product event notes each connection made or removed. Like other product events, it holds your workspace, user and project and a few plain facts, such as whether it was a reconnect, how many matching properties we found or how many figures a disconnect deleted. It never holds a property, a page or a query. We use these events only to see how well connecting works, and keep them for up to 400 days, also after a disconnect.

Removing a connection. Any owner or admin of the workspace can disconnect a project from Search Console or Google Analytics, even after the workspace’s trial or plan has ended. That deletes the connection, its stored key, every stored figure and every read record from our database at once. Choosing a different property deletes every figure of the old one at once, and deleting a project or a workspace deletes its connections and figures with it. Copies already in our database backups are not changed by these deletes, and stay until those backups are deleted: Microsoft Azure keeps its automatic backups of our database for 7 days, and we keep the five most recent copies we take before an update of our service. If an owner or admin cannot disconnect, they can email team@depra.ai from their account address. We aim to remove the connection and its figures within 30 days and will confirm by email.

Removing Depra AI from your Google Account. A disconnect deletes the key and the figures we store, but Depra AI stays listed in the Google Account until it is removed there. We never remove it on our own, including when a project or workspace is deleted. The person who connected, while they are an owner or admin, can ask us to remove it as part of a disconnect. They can also remove it at any time on the linked apps page of their Google Account. This may also end that Google account’s other Search Console and Google Analytics connections to Depra AI, on every project. Removing it there ends our access but does not by itself delete what we stored: that follows When access ends below.

When access ends. If Google tells us our access has ended, or the person who connected is no longer a member of the workspace, we delete the stored key as soon as we find out. We learn that Google ended our access only the next time we use it, so while we are not reading a connection, its key and figures stay, within the limits above, until it is removed. Once we find out, the figures stay readable for 30 days and are then deleted with the connection, unless someone connects again first. If the person who connected stays in the workspace but is no longer an owner or admin, we keep reading with their access until they leave the workspace, remove Depra AI from their Google Account or the connection is removed. If the property can no longer be read, or no longer matches the project’s website, we stop reading it, and unless that is put right, the connection and its figures are deleted 30 days later. A connection that never gets a property is deleted after 7 days, with its key.

Limited Use. Depra AI’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Account and workspace data is kept while your account is open. Figures from a connected Search Console or Google Analytics property have their own limits, set out in the section on connecting Google above. Tracking results are kept so your historical trends remain meaningful. Invoices and tax records are retained for as long as Indian tax law requires (currently eight financial years). Password-reset and email verification tokens expire within an hour and are deleted automatically. Visit analytics are deleted after 180 days. Visitor-level data in our own Google Analytics is held by Google and expires after the retention period set on our Analytics property, which Google limits to 14 months. The two random analytics ids live only in your browser: clearing site data for depra.ai and app.depra.ai removes them, and your next visit counts as a new visitor. Product events are deleted after 400 days, or sooner with your workspace. Demo booking records are kept while your account is open. A booking we cannot match to any account is kept until you ask us to delete it.

Free AI audit reports. The report and the answers behind it are deleted after 90 days, and the private link stops working then. A report that was shown again from an earlier audit of the same website is deleted with that audit. The website and the email you gave stay in our leads list until you ask us to delete them. So does a phone number you gave to see a report. So do the page you were on, the page that sent you, any campaign tags and the two random visit ids. To ask, write to the address at the top of this policy from the email you used. A phone number you gave for an audit inside the app is kept with your account.

Closing your account. There is no self-serve delete button yet. Email team@depra.ai from your account address and we will action it manually. We aim to complete deletion within 30 days of the request and will confirm by email when it is done. Invoices and tax records are retained as described above even after deletion, because Indian tax law requires it.

Under the DPDP Act you may ask us to:

• tell you what personal data of yours we hold and who we have shared it with;
• correct or complete anything inaccurate;
• erase your personal data when it is no longer needed for the purpose you gave it for;
• nominate someone to exercise these rights if you die or become incapacitated;
• withdraw consent, though this may mean we can no longer provide the service.

These requests are handled by a person, not a self-serve tool: email team@depra.ai from the address on your account and we will respond within 30 days. You can already correct your organisation name, GSTIN and branding yourself in project settings, and export your answer data as CSV at any time.

To withdraw consent for a connected Search Console or Google Analytics property, an owner or admin can disconnect it, which deletes its figures, or you can ask us to. The person who connected can also remove Depra AI from their Google Account. The section on connecting Google above says how.

If you are not satisfied with how we handle a grievance, you may escalate to the Data Protection Board of India.

Traffic is encrypted in transit with TLS. Passwords are stored using bcrypt hashing. Password-reset and verification tokens are stored only as SHA-256 hashes, so even we cannot read them. The Google refresh token of a connected Search Console or Google Analytics property cannot be hashed, because we send it back to Google to read your figures, so we encrypt it with AES-256-GCM instead. Microsoft Azure encrypts our database, and its automatic backups, at rest. Access to production systems is restricted to authorised personnel. No system is perfectly secure, but if a breach affects your personal data we will notify you and the Data Protection Board as the DPDP Act requires.

We keep you signed in using a token stored in your browser’s local storage, not a cookie.

We run first-party, cookie-free analytics on depra.ai and app.depra.ai. Your browser stores two random ids (one per browser, one per tab). We record the pages you open, the buttons you click to log in or sign up, and how long you stayed. We store no IP address, no user agent and no query strings. Data is deleted after 180 days. If your browser sends Global Privacy Control we record nothing. When you log in, that visit is linked to your account so we can see how people reach the product. No Meta pixel, no session recording.

The free AI audit keeps three notes in your browser’s local storage on depra.ai: that you closed the audit window, kept for 7 days so it does not open by itself again; that you have run an audit; and a pointer to your last audit (its link, the website and the time), so the form can offer to open it again. Clearing site data for depra.ai removes them. When you run an audit, the two random ids above are saved with it, next to the email you gave. The report page never loads Google Analytics or Tag Manager, whatever you chose in the banner, and our own analytics record that page without the private part of its link.

On our public marketing pages at depra.ai we also ask whether we may use Google Analytics 4, loaded together with Google Tag Manager, so we can see which pages and which searches bring visitors. A banner asks you once, and Accept and Decline carry equal weight. Until you choose Accept, and if you choose Decline, nothing is requested from Google Analytics or Tag Manager and they set no cookies. Not choosing counts as no.

If you accept, Google Analytics sets first-party cookies whose names start with _ga, which last up to two years, and it sends Google your IP address, your browser and device details and the pages you open. It is the one place we use cookies. Its advertising features are switched off: no ad storage, no ad personalisation and no Google signals. We keep your choice in your browser’s local storage for 180 days and then ask again. You can change it at any time with Cookie settings at the foot of any page: choosing Decline there stops Google Analytics, removes its cookies and reloads the page without it. If your browser sends Global Privacy Control we treat that as Decline and do not ask. Neither tool loads inside the app at app.depra.ai. A Google Analytics property you connect to a project is different: our servers read its figures from Google, with no tag in your browser, as the section on connecting Google above describes.

Product events from your browser follow the same rule: under Global Privacy Control your browser sends none. A few facts are recorded by our servers as they happen, such as a first free scan starting, a trial starting, a Book a demo click or a booking arriving from Cal.com. Those are records of the service itself, so we keep them either way.

For completeness, five third-party requests do happen from your browser: website icons on your dashboard, and in the product demo on our home page, load from Google’s favicon service; company logos on our marketing pages load from Brandfetch; Razorpay’s checkout script loads on the billing page; Cal.com’s booking script may load from app.cal.com when you point at, tab to or click a button that books a call with us, or open a screen that shows one up front, such as your first free scan results; and Google Analytics with Tag Manager loads on our marketing pages only after you accept it, as described above. The first four are functional, and we use none of them for analytics. Each provider can see your IP address and the page that made the request. The Product Hunt badge on our home page and the logos of the sites that list Depra AI, such as G2 and SaaSHub, are part of our own site, so showing them sends nothing to those sites. Clicking one opens that site in a new tab, and its own privacy policy applies there.

Book a demo opens Cal.com’s booking page in a window over our page. We add two things to it: a random reference number and which Book a demo button you used. We never add your name, email, phone number, project or website. The reference lets us match the booking to your account; on its own it tells Cal.com nothing about you. If the window has not loaded yet or cannot load, the button opens Cal.com’s page in a new tab with nothing added. Other buttons that book a call with us, such as Talk to us on the pricing and billing pages, open a booking page too and never add more than this. On our pricing page the reference is made in your browser and never reaches us before you book, so we match those bookings by the email you book with. Whatever you type into Cal.com goes to Cal.com under its own privacy policy. When a booking made on our demo page is created or changes, we read its details from Cal.com: the booking’s time and status and the email you booked with. We use that email only to match the booking to your account when the reference did not, and we keep it only when it matches no account.

Depra AI is a business tool and is not directed at children. We do not knowingly collect personal data of anyone under 18.

If we change this policy materially we will update the date above and, where the change affects how we use your data, email account holders. Continuing to use Depra AI after a change means you accept the updated policy. For figures from a connected Search Console or Google Analytics property, continuing is not enough: we will ask for your consent before any new use, as the section on connecting Google above says.