Privacy Policy
Version draft-1
This policy explains what personal data Sedrex Private Limited (CIN: U62010MR2026PTC479094), operator of the Sedrex AI application, handles, why it is handled, and the rights you hold under India's Digital Personal Data Protection Act, 2023 (DPDPA) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules).
What we collect
We collect the following categories of personal data: (a) identity and contact — your name and email address; (b) account data — chats, uploaded files and settings you create; (c) billing data — payment method details and transaction history you provide; (d) technical data — device type and a truncated network address used to prevent abuse and maintain security. We will give you an itemised notice of any additional category we need to collect before or at the time we request your consent (Rule 3, DPDP Rules).
Why we use it
We process your data to provide and operate the service, to respond to your requests, to process payments and prevent fraud, to keep Sedrex secure, and — only when you enable the Help improve Sedrex setting — to improve the service. That setting is off by default. We do not process personal data for purposes beyond what is described here without first seeking fresh, specific consent.
Who else sees it
Your messages are forwarded to the AI model providers needed to answer them. Our infrastructure partners process data on our behalf under written agreements that require them to maintain equivalent safeguards. The complete list is on the Sub-processors page. Some providers may be located outside India; any such transfer is subject to the Central Government's restrictions under Rule 15 of the DPDP Rules. If you use the microphone to dictate, your browser turns your speech into text. Your browser may send your voice to its maker's speech service to do this, such as Google in Chrome or Apple in Safari, under that company's terms. Sedrex receives only the resulting text, and never your audio.
How long we keep it
Incognito chats are deleted after 24 hours. Chats you delete are permanently removed within 30 days. Raw usage events are retained for operational purposes, then reduced to aggregates. Backups expire on a rolling cycle. Processing activity logs are retained for a minimum of one year as required by Rule 8(3) of the DPDP Rules. If you withdraw consent or your account is deleted, we will notify you at least 48 hours before erasing your personal data (Rule 8(2), DPDP Rules), unless a shorter period applies to prevent harm.
Your rights
Under the DPDPA and DPDP Rules you have the right to: (a) access a summary of your personal data and know who it has been shared with (§11); (b) correct incomplete or inaccurate data and erase data no longer necessary for the purpose (§12); (c) withdraw consent at any time — withdrawal will not affect past processing but will stop future processing, and we make withdrawal as easy as giving consent (§6); (d) nominate another person to exercise your rights in the event of your death or incapacity (§14); (e) make a complaint to the grievance officer within 30 days of a decision, and then approach the Data Protection Board of India if not satisfied. Exercise rights (a) through (d) in Settings, or write to the grievance officer listed below.
Children
Sedrex is not directed at children under 18 years of age (§2(f), DPDPA). We do not knowingly collect personal data from a child without verifiable consent from a parent or guardian. We do not profile children or serve targeted advertising to children. If we discover that a child's data was provided without such consent, we will erase it promptly.
Security
We apply security safeguards appropriate to the nature of the data, including encryption in transit and at rest, role-based access controls, access logging and monitoring, and regular backups (Rule 6, DPDP Rules). We retain access logs for at least one year. If a personal data breach occurs, we will promptly notify affected users and report to the Data Protection Board of India within 72 hours of becoming aware, with full details of the breach and our remediation steps (§8(6) DPDPA; Rule 7, DPDP Rules).
Changes and complaints
We will notify you before a material change to this policy takes effect. Questions and complaints may be directed to the grievance officer listed below; we will acknowledge receipt and respond within 90 days (Rule 14(3), DPDP Rules). If you are not satisfied with the outcome, you may approach the Data Protection Board of India established under the DPDPA.
Grievance officer
FULL NAME OF THE OFFICER. Write to [email protected]; we respond within 15 days as required by Rule 14(3) of the Digital Personal Data Protection Rules, 2025.