Privacy Policy

Last updated: 26 June 2026 · Effective: 26 June 2026

1. Who we are

4AIs ("we", "us") is an independent project operated by Sanjay Keerthana, based in India, acting in an individual capacity as a Data Fiduciary under the Indian Digital Personal Data Protection Act, 2023 ("DPDP Act"), as a Data Controller under the EU General Data Protection Regulation ("GDPR"), and as a Business under the California Consumer Privacy Act ("CCPA") and equivalent US state laws.

Contact: legal@4ais.in
Grievance Officer (DPDP §10): grievance@4ais.in

2. What data we collect

2a. On your device (never leaves the phone unless stated)

• Settings and preferences — model choice, gateway port, auto-start, overlay position, lifetime token counters. Stored in the app's private storage.
• API key — your NVIDIA or other provider key, if you choose to bring one. Stored in Android Keystore-backed EncryptedSharedPreferences.
• Chat messages — kept in app memory during a session. Not written to disk, not backed up, not uploaded.
• App-knowledge notes — short hints the agent writes about apps it has used (e.g. "Force Stop is under Settings → Apps"). Plain JSON in the app's private storage. Clearable from Settings.
• Screen content — read in real time by the Android Accessibility Service while the agent is actively working on a request. Never stored, never sent except to the AI provider for the current step.

2b. Sent to third parties (only when needed for the requested feature)

• To the AI provider you chose (NVIDIA NIM, or AWS Bedrock via our proxy) — your prompt, observed screen text for the current step, and tool outputs. Required for the agent to answer at all. The provider's own privacy policy applies for that data.
• To Supabase (our backend, EU + US regions) — if you sign in with Google, we store an email + display name + avatar URL on your profile, plus a per-device identifier and aggregate counters (number of messages, number of tool calls) used for rate limiting and quota.
• To our Pro Quota service — a hashed device identifier so we can enforce free-tier limits. No content of your chats is sent here.

2c. We do not collect

• We do not run advertising SDKs, third-party analytics, or crash-reporting that sees your chat content.
• We do not collect biometric data, precise location, contacts, photos, microphone, or camera.
• We do not sell or rent personal data to anyone, ever.

3. Why we collect it (purpose limitation)

• Operate the agent — chat messages and screen content must reach the AI provider for the agent to respond.
• Account + quota — Supabase profile + counters keep you signed in and prevent abuse of free quota.
• Security and safety — local audit log of agent actions so you can review what the agent did on your device. Never leaves the phone.
• Legal — to comply with applicable law and respond to lawful requests.

4. Lawful basis (GDPR Art. 6) / Consent (DPDP §6)

Our primary lawful basis is your explicit consent, collected at first launch via the in-app setup wizard. You may withdraw consent at any time from Settings → Privacy. Withdrawing consent stops further processing but does not affect the lawfulness of processing before withdrawal.

5. Where the data goes

• On-device data stays on your Android device.
• Supabase: EU region (Frankfurt) for EU users, US for others.
• NVIDIA NIM: USA.
• AWS Bedrock (via our proxy): USA.

Where data crosses borders, we rely on the receiving party's published terms and, for EU users, the European Commission's Standard Contractual Clauses where applicable.

6. How long we keep it

• Chat content: until your session ends. Not persisted.
• Settings: until you reset the app or uninstall.
• Supabase profile + usage counters: until you delete your account.
• App-knowledge notes: until you tap "Clear" in Settings.

7. Your rights

Under DPDP, GDPR, CCPA and similar laws you have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Erase your data ("right to be forgotten"). Use Settings → Privacy → Delete cloud account.
• Port your data to another service. Use Settings → Privacy → Export my data.
• Withdraw consent at any time. Use Settings → Privacy.
• Object to processing or restrict it.
• Complain to a supervisory authority — for India, the Data Protection Board of India; for EU users, your national DPA; for California, the California Privacy Protection Agency.
• Not be sold: We do not sell or share personal information as defined under CCPA. There is nothing to opt out of, but you may still email legal@4ais.in for written confirmation.

To exercise any right, email grievance@4ais.in. We respond within 30 days (DPDP / GDPR).

8. Security

• API keys and auth tokens are stored in Android Keystore-backed encrypted storage with AES-256 GCM.
• The on-device automation bridge (port 3001) requires per-launch bearer authentication and an allowlist of permitted shell commands.
• Cloud backup and device-to-device transfer of secrets are disabled at the OS level.
• Sensitive actions (payments, sending messages, install/uninstall, account deletion) always require explicit per-action confirmation, even when auto-approve is enabled.

9. Children

4AIs is for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us data, email grievance@4ais.in and we will delete it. Under DPDP, processing of children's data is subject to parental consent — we avoid this category entirely by limiting the service to adults.

10. Data breach notification

If we discover a personal-data breach, we will notify the Data Protection Board of India and affected users without undue delay and in any case within 72 hours of becoming aware, in line with DPDP §8(6) and GDPR Art. 33.

11. Changes to this policy

We will post material changes here with a new "Last updated" date and, where the changes affect your rights, ask you to re-consent the next time you launch the app.

12. Contact

General: legal@4ais.in
Grievance Officer (DPDP §10): grievance@4ais.in
Security: security@4ais.in