Privacy Policy

1.Who we are

Great Developers Info Tech Pvt Ltd, C 110, Sector 65, Noida 201301, Uttar Pradesh, India, operates SupaCortex. For personal data about visitors to this website and about the people who administer or use a SupaCortex workspace, we are the data controller.

For the content our customers put into their own workspaces - documents, past support conversations, and the questions their customers and staff ask - our customer is the controller and we act as a processor on their instructions.

2.What we collect

We collect only what we need to run the service and the business behind it.

• Account data: name, work email, role, and a password hash or the SSO identity you sign in with.
• Billing data: billing name and address, tax identifiers, and payment references. Card and bank details are handled by our billing and payment providers and never reach our servers.
• Usage data: features used, AI credits spent, and error diagnostics, tied to your workspace so we can support you.
• Customer content: documents and files you upload or connect, pages fetched by feeds, past support conversations you choose to mine, questions asked through the widget, team chat, help desk or API, and the answers and drafts generated.
• Enquiry data: what you send us through the contact and demo forms.
• Website analytics: aggregate visit data, collected only after you accept cookies.

3.Why we process it, and on what basis

Under the GDPR, India's Digital Personal Data Protection Act and comparable laws, our bases are as follows.

• To provide the service you subscribed to - performance of a contract.
• To bill you and meet tax and accounting obligations - legal obligation.
• To secure the service, prevent abuse and debug faults - legitimate interests.
• To send product and marketing email - consent, which you can withdraw at any time via the unsubscribe link.
• To place non-essential cookies - consent, given through the cookie banner.

4.AI processing and your content

To answer questions, SupaCortex splits your documents into passages, turns them into numerical representations (embeddings) and stores them in a database that belongs to your workspace alone. When someone asks a question, the most relevant passages and the question are given to a language model to write the answer.

The language and embedding models are open models that run on infrastructure we operate. Your content is not sent to a third-party AI provider's API.

We do not use your content, questions or answers to train, fine-tune or improve any AI model, and your content is never used to answer another customer.

When past support conversations are mined into question-and-answer candidates, emails, phone numbers, identifiers and names are replaced with placeholders before the model sees them, and nothing mined becomes searchable until a person in your organisation approves it.

5.How long we keep it

We keep personal data only as long as we need it. Within a workspace, customers can change several of these periods.

• Account data: for the life of the workspace, then as below.
• Documents and their indexes: until you delete them or the workspace is deleted.
• Website and in-app widget conversations: deleted after 180 days without activity.
• Team chat conversations: kept as the user's history until they delete them; deleted conversations are removed after 30 days.
• Help desk conversation text sent for a reply draft: emptied 30 days after the draft is finished.
• Logs of calls to your connected systems: 90 days.
• Workspace content after cancellation: 30 days so an export can be requested, then deleted from primary storage and purged from backups within a further 30 days.
• Billing records: eight years, as required by Indian tax law.
• Support and enquiry correspondence: 24 months.

6.Who we share it with

We do not sell personal data. We share it only with sub-processors who help us run the service, each under a written agreement that restricts their use of it. Categories include infrastructure hosting, transactional email delivery, billing and payment processing, and error monitoring. AI inference is not one of them: it runs on infrastructure we operate.

When you connect a source such as Google Drive, SharePoint, Confluence, an S3 bucket or a help desk, we read from that service on your instruction, using the access you grant. Those services are your providers, not our sub-processors.

The current sub-processor list is available on request and is attached to our Data Processing Agreement. We give notice before adding a new sub-processor so you can object.

7.Where your data is held

Your workspace's hosting location is stated in your order or on request. Each workspace has its own databases. We will not move your content to another location without notice.

Where personal data is transferred out of the EEA or the UK, we rely on Standard Contractual Clauses with appropriate supplementary measures.

8.Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent.

To exercise a right, email info@greatdevelopers.com. We respond within 30 days. If we cannot act on a request we will explain why. If you are unhappy with our response you may complain to your local supervisory authority.

If you asked a question through one of our customers' websites, apps or help desks, please raise the request with that company - they are the controller of that conversation and we will assist them in responding.

9.Cookies

Essential cookies keep you signed in and remember your consent choice; these are always set. Analytics cookies are set only after you accept them in the banner, and you can change your mind by clearing cookies for this site.

We do not use advertising cookies or third-party trackers on this website. The chat widget our customers embed uses only what it needs to keep a conversation going.

10.Security

Data is encrypted in transit with TLS. Credentials you give us - API keys, OAuth tokens and connector secrets - are encrypted at rest and never shown again after they are saved. Access to production systems is limited to named engineers. Our security page describes the controls in more detail.

If a personal data breach affects you, we will notify you and, where required, the relevant supervisory authority, within the timeframes the law requires.

11.Children

SupaCortex is a business product and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe we have, contact us and we will delete it.

12.Changes and contact

We will post any change to this policy on this page and update the effective date. Where a change is material we will email workspace administrators at least 30 days in advance.

Privacy questions and requests: info@greatdevelopers.com. Grievance officer contact details for users in India are available on request and will be published here before launch.