This policy explains how Definable AI Private Limited (Definable, we, us) collects, uses and shares personal data when you visit definable.ai, use the Definable app or its Chrome extension, or contact us. Under India's Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for this data, and under the GDPR its controller.
1. Agents that companies build on Definable
Companies use Definable to build agents that talk to their own customers and staff: on WhatsApp, Slack or Telegram, in an agent's own app, through the Chrome extension or through their systems. If you talk to one of those agents, the company that runs it decides how your data is used and is responsible for it, under its own privacy notice. We process that data only on its behalf, under our Data Processing Addendum.
To see, correct or delete what such an agent holds about you, contact that company. If you write to us instead, we'll pass your request on to them and help them answer it.
The rest of this policy covers data we handle for our own purposes: our website, the accounts of people who use Definable, and our dealings with customers.
2. What we collect
Data you give us
- Account details. Your name and email address when you sign up, and your time zone. You sign in with Google, GitHub or a link we email you, through our sign-in provider Stytch; we never receive your Google or GitHub password.
- Workspace content. What you put into Definable: agents and their instructions, messages, files, knowledge bases, skills, schedules, evaluation cases, ratings and approval decisions. We hold this for the workspace it belongs to, as described in our Terms of Service.
- Connections. When you connect an app, an AI provider key or a channel, the details needed to use it. App sign-ins are held by our integration provider Composio. Provider keys and channel credentials are encrypted before we store them.
- Workspace members. The email addresses of people you invite.
- Billing details. The payer's name and email address, your plan, and your purchase and usage history. Card and bank details go straight to our payment providers, Stripe and Razorpay; we never see or store them.
- Messages to us. What you write when you email us, book a demo or ask for support.
Data we collect automatically
- Logs. When you use the app, our servers record technical details of each request, such as your IP address, browser, the page or feature used, the time, and any error. Passwords, keys, tokens and cookies are removed before anything is logged.
- Usage data. Which features are used and how they perform, such as run timings, model usage and credit use, to run, bill and improve the service.
Data from others
- Sign-in providers. Your name and email address from Google, GitHub or Stytch when you sign in.
- Payment providers. Whether a payment succeeded, and the details needed to manage your subscription.
We don't buy personal data, and we don't collect sensitive categories of data on purpose. Please don't put them into Definable unless your agreement with us allows it.
3. How we use it
| Purpose | Legal basis |
|---|---|
| Create your account, run your workspace and agents, and provide support | Your consent and our contract with you |
| Bill you and keep accounting and tax records | Our contract with you, and legal obligations |
| Keep Definable secure, prevent fraud and abuse, and fix problems | Legitimate uses the law allows, and our legitimate interest in a safe service |
| Improve Definable from usage data that doesn't identify you | Our legitimate interest in a better product |
| Send you service messages, such as sign-in links, invitations, receipts and changes to these terms | Our contract with you |
| Tell you about new features | Your consent, which you can withdraw at any time |
| Meet legal obligations and answer lawful requests | Legal obligations |
Where we rely on your consent, you can withdraw it at any time by writing to us. That doesn't affect what we did before, but we may no longer be able to provide the service.
4. AI and your data
- No training. We don't use your content to train or fine-tune AI models, ours or anyone else's.
- Model providers. To answer, an agent sends its conversation, and what it has read for the task, to the AI model provider that runs its model. A workspace can use its own key with Anthropic, OpenAI, Google, DeepSeek, Moonshot AI or OpenRouter, under its agreement with that provider. Builder, the Definable agent and agents billed in credits run on our own accounts with Anthropic and OpenAI, whose commercial terms don't let them train on that data.
- Routing. When an agent has a fast and a main model, our routing provider TypeSafe AI reads the newest message and the start of the last answer to pick which model takes it.
- Apps and the web. When an agent uses a connected app, searches the web or fetches a page, the request goes to that app, to Composio, or to our web provider TinyFish.
- No ads. We don't use your data for advertising and don't sell it.
5. Who we share it with
- Service providers that help us run Definable, under contracts that limit their use of the data to the service they provide: hosting (Hetzner, Amazon Web Services), sign-in (Stytch), app connections (Composio), web search (TinyFish), AI models (Anthropic, OpenAI, TypeSafe AI) and payments (Stripe, Razorpay). The current list is in Annex 4 of our Data Processing Addendum.
- Services your workspace chooses. The AI model providers, apps and channels (such as Slack, WhatsApp and Telegram) your workspace connects receive what its agents send them, under their own terms and privacy policies.
- Your workspace. The owners and admins of a workspace can see its content, including what you write in it, and can remove you from it.
- Authorities. When the law requires it, or to protect the rights, property or safety of Definable, our users or others.
- A new owner. If Definable is merged, acquired or sells its assets, personal data may pass to the new owner, which will remain bound by this policy.
We do not sell personal data, or share it for advertising across sites and apps.
6. Where your data is stored
We run Definable on servers in Germany and store files in the United States. Our service providers process data in the countries listed in our Data Processing Addendum, mainly the United States, and payments made in India are processed there. If your workspace chooses a model provider based elsewhere, such as DeepSeek or Moonshot AI in China, its agents' conversations go to that country.
When we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we use the safeguards those laws approve, such as the European Commission's Standard Contractual Clauses. We don't transfer personal data to countries the Government of India restricts.
7. How long we keep it
| Data | Kept |
|---|---|
| Account details | While you have an account, then erased within 30 days of your request |
| Workspace content | Until the workspace deletes it, or until 30 days after the workspace closes |
| Server logs | 7 days |
| An agent's code sandbox | 30 days after it was last used |
| Sign-in codes and links | 10 minutes for codes; sign-in sessions last up to 30 days |
| Invitations | 7 days, unless accepted |
| Billing and tax records | As long as tax and company law requires, up to 8 years in India |
We may keep data longer when the law requires it or to resolve a dispute, and only for that purpose.
8. Cookies and browser storage
Our website, definable.ai, sets no cookies and loads no analytics, advertising or tracking scripts. Its fonts and images come from our own site.
The Definable app uses only what it needs to work:
- a session cookie from Stytch that keeps you signed in;
- your browser's local storage, for preferences such as the theme and layouts, and for the sign-in of an agent's app;
- fonts loaded from Google Fonts, which receives your IP address when they load;
- Razorpay's checkout, loaded from Razorpay only when you pay through it.
Stytch's sign-in software also reports a basic event to Stytch when it starts. The app has no analytics or advertising cookies, so there is nothing to opt out of. Blocking cookies will stop you from staying signed in.
9. Security
Definable is certified under ISO/IEC 27001 and ISO/IEC 42001, meets India's DPDP Act and is preparing for a SOC 2 audit. We encrypt data in transit, encrypt provider keys and credentials before storing them, keep only hashes of keys and session tokens, separate each workspace's data in the database, and run agents' code in sandboxes of their own. You can require a person's approval before an agent takes the actions you choose. The Data Processing Addendum lists our security measures in full.
No system is perfectly secure. If a breach affects your personal data, we'll tell you and the authorities as the law requires.
10. Your rights
Depending on where you live, you can:
- see the personal data we hold about you and how we use it, and get a copy;
- correct or complete it if it's wrong or incomplete;
- erase it, or have us stop using it, when we no longer need it or you withdraw your consent;
- object to or restrict our use of it, or take it to another provider (portability);
- withdraw your consent at any time;
- nominate someone to exercise your rights if you die or can't act yourself, as India's DPDP Act allows;
- opt out of the sale or sharing of your data, as US state laws allow, though we do neither;
- complain to us, and then to an authority such as the Data Protection Board of India or your local data protection authority.
To use a right, email [email protected] from the address on your account, or tell us how to check it is you. We answer within 30 days, and don't charge or treat you differently for asking. Workspace content belongs to the workspace, so for that we may first need its owner's confirmation.
11. Children
Definable is for adults at work. It isn't meant for anyone under 18, and we don't knowingly collect children's personal data. If you believe a child has given us personal data, write to us and we'll delete it.
12. Changes to this policy
We'll post any change here and update the date at the top. If a change materially affects how we use your personal data, we'll tell you by email or in the app before it takes effect, and ask for your consent where the law requires it.
13. Contact and Grievance Officer
For any question, request or complaint about your personal data, write to our Grievance Officer:
Anandesh Sharma, Grievance Officer
Definable AI Private Limited
Building 145, Sector 44, Gurugram, Haryana 122009, India
[email protected] · +91 99969 44943
We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you're not satisfied with our answer, you can complain to the Data Protection Board of India or your local data protection authority.