Privacy Policy

Last updated: October 6, 2026

1. Introduction & Scope

Sahinov Pvt Ltd (“Sahinov Pvt Ltd”, “we”, “us”, or “our”), a company incorporated in India, operates BittuAI, a platform that helps businesses and creators manage social media, create and automate content with AI, and access customized branding and marketing services (the “Service”). This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights available to individuals whose personal data we process.

This Policy applies to visitors of our website, prospective customers, registered users of the Service, and individuals whose personal data is submitted to us by our customers in the course of using the Service. It does not apply to third-party websites or services that we link to but do not control.

2. Personal Data We Collect

We collect the following categories of personal data:

• Account & identity data — name, work email address, phone number (optional), and password (stored as a salted hash, never in plain text), collected when you register for or are invited to an account.
• Business & billing data — workspace name, billing address, and subscription/plan selection, collected to administer your account and issue invoices.
• Usage & telemetry data — pages visited, features used, device and browser type, IP address, and approximate location derived from IP, collected automatically to operate, secure, and improve the Service.
• Uploaded content — video footage, images, audio, scripts, and other creative assets you or your workspace upload to the Service for production.
• Payment metadata — plan, amount, currency, transaction ID, payment status, and the last four digits and card network of a payment instrument, as returned to us by our payment processor. We never collect, transmit, or store full card numbers, CVV codes, or other raw card data — that data goes directly to our PCI-DSS-compliant payment processor. See our Data Security Policy for detail.

3. Purpose of Processing

We process personal data to:

• Create and administer your account and authenticate access to the Service;
• Provide, operate, maintain, and improve the Service, including video production workflows;
• Process payments, issue invoices, and manage subscriptions;
• Communicate with you about your account, transactions, security notices, and (where you have consented) product updates;
• Detect, investigate, and prevent fraud, abuse, and security incidents; and
• Comply with applicable law, regulation, and lawful requests from public authorities.

4. Legal Basis / Consent

Where the Digital Personal Data Protection Act, 2023 (“DPDP Act”) or other applicable data protection law requires a legal basis, we rely on: your consent (for example, when you sign up or opt in to marketing communications); the necessity of processing to perform our contract with you (for example, providing the Service you subscribed to); and our legitimate interests or legal obligations (for example, fraud prevention, security, tax, and accounting records). You may withdraw consent at any time for processing that relies on it, without affecting processing already carried out or processing that rests on another legal basis, by writing to subhash@sahinov.in.

5. Data Principal Rights

If you are a “Data Principal” under the DPDP Act, you have the right, subject to verification of identity and any applicable exceptions under the Act, to:

• Access a summary of the personal data we hold about you and how it has been processed;
• Correction and updating of inaccurate or incomplete personal data;
• Erasure of personal data that is no longer necessary for the purpose it was collected for, subject to our legal retention obligations (see Section 8);
• Grievance redressal — the right to have a grievance concerning our processing of your personal data addressed by our Grievance Officer (Section 6) within a reasonable time; and
• Nomination of another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, contact us at subhash@sahinov.in. We may need to verify your identity before acting on a request.

6. Grievance Officer

In accordance with the DPDP Act, 2023, we have appointed a Grievance Officer to address questions and complaints regarding this Policy and our processing of personal data:

• Name: Subhash
• Role: Point of contact for privacy grievances under the DPDP Act, 2023, on behalf of Sahinov Pvt Ltd
• Email: subhash@sahinov.in

We aim to acknowledge and resolve grievances within the timelines required by applicable law.

7. Cross-Border Data Transfer

BittuAI is built on Supabase, a third-party infrastructure provider, for database, authentication, and storage services. Our production database, authentication, and storage infrastructure is hosted in the ap-south-1 (Mumbai, India) region — personal data processed through the Service is not, as a matter of current infrastructure configuration, routinely stored outside India. If this changes, or if a specific feature (for example, a sub-processor listed in Section 9) requires processing outside India, any such transfer is made subject to contractual and technical safeguards consistent with the DPDP Act, and this Policy will be updated accordingly. Questions about hosting or data-residency specifics can be sent to subhash@sahinov.in.

8. Data Retention & Deletion

We retain personal data for as long as your account is active and as necessary to provide the Service, comply with our legal obligations (including tax and accounting record-keeping requirements under Indian law), resolve disputes, and enforce our agreements. When personal data is no longer needed for these purposes, we delete it or anonymize it. Uploaded content and account data are deleted from active systems within a reasonable period after account closure, other than data we are required to retain by law or that persists in encrypted backups until those backups naturally cycle out.

Data obtained through the YouTube API Services follows a stricter rule: video titles, comment text, and creator/author names are refreshed or deleted within 30 days of retrieval, consistent with YouTube’s API Services Developer Policies. Publicly available statistics (views, likes, comment counts) and metrics we derive from them (for example, engagement trends) may be retained for up to 36 months so that Analytics can show meaningful history, but only while your authorization stays active: we re-confirm it automatically at least every 10 days (and always within 30), and delete a channel's YouTube data if we cannot. They are always clearly labeled as generated by BittuAI rather than sourced live from YouTube. If you disconnect your YouTube channel, or we can no longer verify your authorization, we delete the YouTube-derived data for that channel (within 7 days at the latest). You can also request deletion of any YouTube-derived data at any time by writing to subhash@sahinov.in; we complete it as soon as possible and within 7 calendar days. We do not send YouTube-derived data (such as comment text or video titles) to third-party AI providers.

9. Data Sharing / Sub-processors

We share personal data only with service providers who process it on our behalf, and only to the extent necessary to provide the Service:

• Cashfree — payment processing and billing. Cashfree receives payment instrument details directly from you; we receive only payment metadata (Section 2).
• Supabase — database, authentication, and file storage infrastructure underlying the Service.
• AI/ML processing providers — the Service’s AI-assisted editing features (see our Terms of Use, Section 2) use Anthropic’s Claude models to plan and execute edits — for example sequencing, captioning, and effects decisions — based on Customer Content such as footage, scripts, and instructions you provide. Anthropic processes that content solely to perform the requested editing function. Narration and voice-cloning currently run on self-hosted, open-source speech models within our own infrastructure, so that audio is not shared with any third-party AI provider. Our AI-assisted writing, campaign and insight features (for example drafting captions, planning campaigns, and sentiment or lead analysis of your connected-channel comments) send the text involved to Google (Gemini), OpenAI and xAI through our own AI gateway, solely to return the requested result. Data obtained through the YouTube API Services (such as YouTube comment text or video titles) is never sent to these providers. If we add another named AI/ML sub-processor, we will update this section before doing so. Questions about a specific processor can be sent to subhash@sahinov.in.

We do not sell personal data. We may disclose personal data if required to do so by law, regulation, or a valid legal process, or to protect the rights, property, or safety of Sahinov Pvt Ltd, our users, or the public.

10. Google User Data

Where you connect a Google Account to the Service — for example, to manage a Google Business Profile, read or publish YouTube content, or view Search Console or Analytics data — we access the following categories of data from that Google Account, only for the purposes described:

• Google Business Profile — to read and update your connected Business Profile’s information on your behalf.
• YouTube — to read your channel and video data, read YouTube Analytics, manage comments, and publish videos you create through the Service.
• Google Search Console — to read your site’s Search Console performance data.
• Google Analytics — to read your Analytics data for reporting inside the Service.
• Google Drive — limited to files and folders the Service itself creates or that you explicitly open through it; we cannot see or access any other file in your Drive.

Sahinov Pvt Ltd’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use this data only to provide and improve the features you have connected it for, as described above.
• We do not use this data for advertising, and we do not sell it.
• We do not allow humans to read this data except with your affirmative consent, for security purposes (for example, investigating abuse), to comply with applicable law, or in aggregated/anonymized form.

You can disconnect any Google account from the Service at any time from the relevant integration’s settings within the Service, and can also revoke access directly from your Google Account permissions page. Disconnecting stops future access; previously synced data is handled per Section 8 (Data Retention & Deletion).

11. Meta Platform Data

When you connect a Facebook Page, an Instagram professional account, a Threads profile or Messenger to the Service, we receive data from Meta Platforms, Inc. (“Meta”) with your authorization and under Meta’s Platform Terms (“Meta Platform Data”). We connect through Facebook Login, Instagram Login and Threads login, so we never see your Facebook, Instagram or Threads password.

The Meta Platform Data we receive is limited to what the features you use need:

• Account information: IDs, name, username, profile picture and follower counts of the accounts you connect, and the list of Facebook Pages you manage so you can choose one.
• Content: posts and media on the connected account, comments on them (including the public name or username of the commenter), and the posts we publish for you.
• Messages: messages sent to the connected Facebook Page or Instagram account (sender name or ID, text, attachments) and the replies you send.
• Insights: performance metrics such as reach, impressions, engagement and follower counts.

We use Meta Platform Data only to provide and improve the features that are visible to you in the Service: publishing and scheduling, a shared inbox and comment replies, mention and comment monitoring, and analytics. We do not use it for advertising or ad targeting, we do not sell or license it, we do not use it to build profiles for others, and we do not use it to train generalized AI or machine-learning models.

We share Meta Platform Data only with the service providers listed in Section 9, only as needed to run the Service. Messages and comments you receive may be sent to those AI providers to produce the sentiment labels, lead suggestions and reply drafts shown to you in the Service; they process it only to return the result. Our staff access Meta Platform Data only to give support you ask for, for security, or to comply with law.

Disconnecting and deletion. You can disconnect any account at any time from Settings → Social Accounts, or remove BittuAI from your Facebook, Instagram or Threads settings. Disconnecting stops our access immediately and deletes the stored access tokens. To have the Meta Platform Data we hold deleted, follow the steps on our Data Deletion Instructions page; we complete deletion within 30 days of your request.

12. Security Measures

We apply technical and organizational measures designed to protect personal data, including encryption in transit and at rest, database-level row security enforcing workspace-scoped access, and role-based access controls. No system is completely secure, and we cannot guarantee absolute security. Full detail on our security posture, including what is and is not yet in place, is published in our Data Security Policy.

13. Cookies & Tracking

We use strictly necessary cookies to keep you signed in and to remember basic preferences. On our public website we also use our own first-party analytics (the same Website Tracking feature we offer customers): it stores a random visitor identifier in your browser’s local storage and records the pages you view, the referring site and campaign tags, and form submissions, so we can understand how visitors find and use the site. It does not use third-party analytics or advertising cookies, and this data is not shared with advertisers. You can clear it at any time by clearing your browser’s site data. Where required by law, we will present a consent mechanism before setting non-essential cookies or identifiers.

14. Children’s Data

BittuAI is intended for businesses, professional creators, and their authorized personnel. It is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If you believe a minor has provided us personal data, contact us at subhash@sahinov.in and we will take appropriate steps to remove it.

15. Policy Changes

We may update this Policy from time to time to reflect changes in our practices or applicable law. We will update the “Last updated” date above and, for material changes, provide additional notice such as an email or an in-product notice.

16. Contact

Questions about this Privacy Policy or our data practices can be sent to subhash@sahinov.in.