Privacy Policy

Depra AI (“we”, “us”) operates depra.ai, a service that tracks how AI answer engines describe brands. We are based in India and act as the Data Fiduciary for the personal data described below, as that term is used in India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).

Depra AI is a product of Wizthinkers Private Limited, a company incorporated in India on 25 November 2022 (CIN U74999UP2022PTC174011), with its registered office in Aligarh, Uttar Pradesh.

For any privacy question or request, contact team@depra.ai.

Account data. When you sign up we store your email address, a securely hashed password (we never store the password itself) and whether your email has been verified. If you sign in with Google, we receive your email address, name and profile basics from Google, never your Google password.

Profile data. During setup, the About you screen asks for your name and, if you own the workspace, your company or agency name. It also asks for your phone number. That is optional, and the screen says why we ask: so the Depra AI team can call you if your setup stalls. Leave it blank and we store no number. At the end of setup we ask two short questions, and you can skip either: what you want from Depra AI, and how you heard about us. The Invite your team screen then asks for your job level (such as founder, manager or individual contributor). If you own an agency workspace, it also asks for your agency’s website and how many clients you track. These are optional too. If you answered an earlier version of our signup questions, we keep the role and job function you picked there. We also record which setup and Start here steps you have finished, whether you opened Book a demo and whether a booking followed, and the email addresses of teammates you invite, so we can send them their invite.

Product events. Inside the app we record the steps you take, such as starting the first free scan, opening its results, opening Book a demo and reaching checkout. Each event holds its name, the time, your workspace, your user and project where there is one, and a few plain facts about the step, such as which button or plan it was. It may also carry the two random visit ids described under cookies below, so a visit and what followed line up. An event never holds your phone number, email, name, job level, what you want from Depra AI or how you heard about us. We use events to see where setup works and where people get stuck. They are stored on our own servers. No analytics or advertising company receives them, and we never sell them.

Workspace data. Your organisation name, your GSTIN if you enter one for invoicing, optional white-label branding (logo URL, accent colour, footer text), and the projects you create: brand names, competitor names, website domains, target countries and the prompts you choose to track.

Results data. The answers AI engines return for your prompts, the sources those answers cite, and the brand mentions we extract from them. This is data about publicly generated AI output, but we store it against your account.

Billing data. Your plan, subscription period, invoice records and GSTIN. We never see or store your card, UPI or bank details. Those go directly to Razorpay, our payment processor.

Technical data. Server logs containing IP address, request paths and timestamps, kept for security and debugging.

Free AI audit. When you run the free AI audit on depra.ai you give us a website and an email address. No account is made. Our web reader, DepraBot, reads that site’s homepage, robots.txt and llms.txt. From the homepage we draft a brand name, a category, up to 5 competitor names and 5 buyer questions. We ask the questions to four AI engines and build a report. If we cannot read the homepage, we ask you for the brand name and one line about it. We store the website, the email, what we read and drafted, anything you typed, the answers, the brands and sources in them, and the report. We also save the page you were on, the page that sent you, any campaign tags in the address and the two random visit ids described under cookies below, so a visit and the audit that followed line up. Your IP address is used in memory to limit how many audits one network can start. It is not saved with the audit. We send at most one email for an audit, to the address you gave, with a private link to the report. Anyone who has that link can open the report. If someone else audits the same website within 7 days, we may show them that report and not run a new one. A report never shows your email, and one built from a brand name you typed is never reused for another person. The website and the email also go into our leads list. Only the Depra AI team sees that list, inside our own admin tool, and the team may write to you about your audit. Before we show a full report we may ask for a phone number. If you give one, we keep it with your email in our leads list, and the Depra AI team may call or message you on it about your audit. If you sign up for Depra AI with the same email address, we link the report to your workspace so you can open it in the app until your setup is opened. A free AI audit you run inside the app is stored the same way with your workspace, sends no email and is not added to the leads list. The app may also ask for a phone number before it shows the full report. That number is saved on your account as your profile phone number.

• To run the service you signed up for: scheduling runs, computing your metrics, generating reports.
• To authenticate you and keep your account secure.
• To help you finish setup: if you gave us a phone number, the Depra AI team may call it when your setup stalls. We never use it for ads.
• To take payment, issue GST invoices, and manage your subscription.
• To send service email: verification codes, password resets, renewal reminders, security notices and invites to teammates you add.
• To run a free AI audit you asked for, show you its report and email you the link. If you gave a phone number for it, the Depra AI team may call or message you on it about your audit.
• To detect abuse, debug failures, and meet legal or tax obligations.

We do not sell your personal data, and we do not use your prompts or results to advertise to you.

Who sees your profile. Your phone number, job level, what you want from Depra AI and how you heard about us are shown only to the Depra AI team, inside our own admin tool. They are never sent to our analytics, never added to a web address and never included in an email. One exception is yours to make: we pass your phone number to Razorpay only if you tick the box on our Billing page that offers to fill it in, and only for that checkout. That box starts unticked.

Running the service means sending some data to specialist providers. Notably, your prompt text, brand names and competitor names are transmitted to AI search providers in order to capture what those engines say. A free AI audit sends its 5 questions to those providers. The homepage text we read for it, the brand name and the answers go to Azure OpenAI, or to OpenAI as a fallback, to draft the questions and read the answers. Our current sub-processors:

• Microsoft Azure: hosting, database and transactional email. Application and database servers are in Azure Central India.
• DataForSEO: captures answers from ChatGPT, Gemini and Google AI Overviews. Receives your prompt text.
• Perplexity: Perplexity answer capture. Receives your prompt text.
• Azure OpenAI (South India region): reads captured answers to identify brand mentions and sentiment. Receives answer text and your brand/competitor names.
• OpenAI: used as a fallback for answer capture and mention extraction when our primary providers are unavailable. In that case it receives your prompt text, the captured answer, and your brand and competitor names.
• Google has four distinct uses: Google Sign-In if you choose it; Gemini as a fallback answer-capture provider (receives your prompt text); Google’s public favicon service, which our dashboard and the product demo on our home page use to display website icons; and Google Analytics with Google Tag Manager on our public marketing pages, only if you accept them. The favicon service means Google receives the domain names shown on your dashboard (your tracked domain and the domains cited in your results) along with your IP address and browser details. On our home page it receives the example brand domains shown in the demo, with your IP address and browser details. Google Analytics and Tag Manager are described under cookies below. They are not used inside the logged-in application.
• Brandfetch: supplies company logos on our public marketing pages. Receives the IP address and browser details of visitors to those pages. It is not used inside the logged-in application.
• Razorpay: payment processing. Receives your billing details directly; they are a PCI-DSS compliant processor. Their checkout script loads on our billing page. To save you typing, we may fill in your name and email in their checkout. We send your phone number only if you tick the box on our Billing page that offers it, and only for that checkout.
• Cal.com: books demo calls. Receives what you type into its booking form, plus a random reference and which button you used. For bookings made on our demo page, we read the booking’s time and status and the email you booked with from Cal.com.

Some of these providers process data outside India. The DPDP Act permits such transfers except to countries the Government restricts; we will update this policy if that list affects us. We will also update this section before adding a new sub-processor.

Account and workspace data is kept while your account is open. Tracking results are kept so your historical trends remain meaningful. Invoices and tax records are retained for as long as Indian tax law requires (currently eight financial years). Password-reset and email verification tokens expire within an hour and are deleted automatically. Visit analytics are deleted after 180 days. Visitor-level data in Google Analytics is held by Google and expires after the retention period set on our Analytics property, which Google limits to 14 months. The two random analytics ids live only in your browser: clearing site data for depra.ai and app.depra.ai removes them, and your next visit counts as a new visitor. Product events are deleted after 400 days, or sooner with your workspace. Demo booking records are kept while your account is open. A booking we cannot match to any account is kept until you ask us to delete it.

Free AI audit reports. The report and the answers behind it are deleted after 90 days, and the private link stops working then. A report that was shown again from an earlier audit of the same website is deleted with that audit. The website and the email you gave stay in our leads list until you ask us to delete them. So does a phone number you gave to see a report. So do the page you were on, the page that sent you, any campaign tags and the two random visit ids. To ask, write to the address at the top of this policy from the email you used. A phone number you gave for an audit inside the app is kept with your account.

Closing your account. There is no self-serve delete button yet. Email team@depra.ai from your account address and we will action it manually. We aim to complete deletion within 30 days of the request and will confirm by email when it is done. Invoices and tax records are retained as described above even after deletion, because Indian tax law requires it.

Under the DPDP Act you may ask us to:

• tell you what personal data of yours we hold and who we have shared it with;
• correct or complete anything inaccurate;
• erase your personal data when it is no longer needed for the purpose you gave it for;
• nominate someone to exercise these rights if you die or become incapacitated;
• withdraw consent, though this may mean we can no longer provide the service.

These requests are handled by a person, not a self-serve tool: email team@depra.ai from the address on your account and we will respond within 30 days. You can already correct your organisation name, GSTIN and branding yourself in project settings, and export your answer data as CSV at any time.

If you are not satisfied with how we handle a grievance, you may escalate to the Data Protection Board of India.

Traffic is encrypted in transit with TLS. Passwords are stored using bcrypt hashing. Password-reset and verification tokens are stored only as SHA-256 hashes, so even we cannot read them. Access to production systems is restricted to authorised personnel. No system is perfectly secure, but if a breach affects your personal data we will notify you and the Data Protection Board as the DPDP Act requires.

We keep you signed in using a token stored in your browser’s local storage, not a cookie.

We run first-party, cookie-free analytics on depra.ai and app.depra.ai. Your browser stores two random ids (one per browser, one per tab). We record the pages you open, the buttons you click to log in or sign up, and how long you stayed. We store no IP address, no user agent and no query strings. Data is deleted after 180 days. If your browser sends Global Privacy Control we record nothing. When you log in, that visit is linked to your account so we can see how people reach the product. No Meta pixel, no session recording.

The free AI audit keeps three notes in your browser’s local storage on depra.ai: that you closed the audit window, kept for 7 days so it does not open by itself again; that you have run an audit; and a pointer to your last audit (its link, the website and the time), so the form can offer to open it again. Clearing site data for depra.ai removes them. When you run an audit, the two random ids above are saved with it, next to the email you gave. The report page never loads Google Analytics or Tag Manager, whatever you chose in the banner, and our own analytics record that page without the private part of its link.

On our public marketing pages at depra.ai we also ask whether we may use Google Analytics 4, loaded together with Google Tag Manager, so we can see which pages and which searches bring visitors. A banner asks you once, and Accept and Decline carry equal weight. Until you choose Accept, and if you choose Decline, nothing is requested from Google Analytics or Tag Manager and they set no cookies. Not choosing counts as no.

If you accept, Google Analytics sets first-party cookies whose names start with _ga, which last up to two years, and it sends Google your IP address, your browser and device details and the pages you open. It is the one place we use cookies. Its advertising features are switched off: no ad storage, no ad personalisation and no Google signals. We keep your choice in your browser’s local storage for 180 days and then ask again. You can change it at any time with Cookie settings at the foot of any page: choosing Decline there stops Google Analytics, removes its cookies and reloads the page without it. If your browser sends Global Privacy Control we treat that as Decline and do not ask. Neither tool loads inside the app at app.depra.ai.

Product events from your browser follow the same rule: under Global Privacy Control your browser sends none. A few facts are recorded by our servers as they happen, such as a first free scan starting, a trial starting, a Book a demo click or a booking arriving from Cal.com. Those are records of the service itself, so we keep them either way.

For completeness, five third-party requests do happen from your browser: website icons on your dashboard, and in the product demo on our home page, load from Google’s favicon service, company logos on our marketing pages load from Brandfetch, Razorpay’s checkout script loads on the billing page, Cal.com’s booking script may load from app.cal.com when you point at, tab to or click a button that books a call with us, or open a screen that shows one up front, such as your first free scan results, and Google Analytics with Tag Manager loads on our marketing pages only after you accept it, as described above. The first four are functional, not analytical. Each provider can see your IP address and the page that made the request.

Book a demo opens Cal.com’s booking page in a window over our page. We add two things to it: a random reference number and which Book a demo button you used. We never add your name, email, phone number, project or website. The reference lets us match the booking to your account; on its own it tells Cal.com nothing about you. If the window has not loaded yet or cannot load, the button opens Cal.com’s page in a new tab with nothing added. Other buttons that book a call with us, such as Talk to us on the pricing and billing pages, open a booking page too and never add more than this. On our pricing page the reference is made in your browser and never reaches us before you book, so we match those bookings by the email you book with. Whatever you type into Cal.com goes to Cal.com under its own privacy policy. When a booking made on our demo page is created or changes, we read its details from Cal.com: the booking’s time and status and the email you booked with. We use that email only to match the booking to your account when the reference did not, and we keep it only when it matches no account.

Depra AI is a business tool and is not directed at children. We do not knowingly collect personal data of anyone under 18.

If we change this policy materially we will update the date above and, where the change affects how we use your data, email account holders. Continuing to use Depra AI after a change means you accept the updated policy.