Privacy Policy

1. Scope

This policy applies when you browse saathi.neermedia.com, create or use a Saathi account, complete a profile, purchase or renew a plan, activate a license, contact support, or use the public live-demo chatbot.

The WordPress plugin runs primarily on the website where it is installed. A customer operating that website has its own privacy responsibilities to its visitors. A separate website, AI provider, payment provider or sign-in provider has its own privacy terms.

2. Who controls the data

Saathi account and website data

NEER Media determines why and how account, billing, licensing, support and website-security data is processed. For this data, NEER Media acts as the data fiduciary or controller, as those terms are used under applicable privacy law.

Chats on a customer's WordPress website

The customer operating the WordPress website decides whether to enable Saathi, what content it indexes, what AI provider it connects, whether memory is enabled, and how long chats are kept. That customer is normally the controller or data fiduciary for its visitors' chatbot data. The plugin stores conversations, memory and indexed content in that customer's own WordPress database and sends prompts to the AI provider selected by that customer.

3. Personal data we collect

Please do not put passwords, one-time codes, payment credentials, government identifiers, health information or other sensitive personal data into a chatbot message or support request unless it is strictly necessary and you have a lawful basis to do so.

4. How and why we use data

• Provide accounts, authentication, profile onboarding, dashboards, downloads, plans and customer support.
• Create, validate and protect license keys and permitted domain activations.
• Create payment orders, verify payment signatures, issue receipts, reconcile transactions and handle eligible refunds.
• Send service communications such as sign-in codes, receipts, renewal reminders, security notices and support replies.
• Operate the live AI demo and remember only its window size in your browser.
• Prevent fraud, rate-limit abuse, investigate incidents, enforce our terms and maintain service reliability.
• Comply with tax, accounting, consumer-protection, privacy and other legal duties.
• Improve usability and product quality using support feedback and aggregated operational information.

Depending on your location, processing may rely on performance of a contract, steps requested before a contract, consent, compliance with law, or our legitimate interests in security, support and service improvement. Where consent is the basis, it may be withdrawn without affecting earlier lawful processing.

We do not sell personal data, rent contact lists, or use personal data for third-party behavioral advertising.

5. AI and plugin data flow

Public demo

The demo sends your prompt and limited recent chat context to the AI service configured by NEER Media, currently through OpenRouter. The provider returns a generated response. Provider availability and model selection can change, and the provider's own terms also apply to its processing.

Installed WordPress plugin

Saathi is a bring-your-own-provider plugin. The website owner selects and configures the provider. Prompts may contain the visitor's message, relevant published website excerpts, persona instructions, limited chat history and memory when enabled. That material is transmitted from the customer's WordPress server to the selected provider.

API keys are stored in the customer's WordPress installation and are encrypted using the plugin's supported server-side encryption where the hosting environment provides the required cryptographic functions. Keys are masked in the admin interface and are not intentionally exposed to chatbot visitors.

Local models

If a customer chooses a genuinely local model endpoint, AI prompts can remain within that customer's chosen infrastructure. The customer is responsible for securing and configuring that endpoint.

6. When data is shared

We disclose only what is reasonably needed for the relevant service:

• Hostinger: website hosting, database infrastructure, CDN and transactional email delivery.
• Razorpay: checkout, payment processing, fraud controls and refunds. Checkout may receive your name, email, mobile number, order amount and order identifier.
• Google: authentication when you choose Sign in with Google, and font delivery when Google Fonts is loaded.
• OpenRouter and the selected model provider: public demo messages and recent context needed to generate a reply.
• Professional advisers and authorities: where reasonably necessary for legal claims, audits, fraud prevention, safety or a binding legal request.
• Business transfer: as part of a merger, financing, reorganisation or sale, subject to appropriate confidentiality and notice where required.

AI providers chosen by a WordPress site owner are that owner's service providers, not automatically NEER Media's providers.

7. Cookies and browser storage

We do not currently use advertising cookies on the Saathi website. Blocking essential session storage may prevent login or parts of the Service from working.

8. Retention and deletion

• Account and profile: while the account is active, then for a reasonable closure period or longer where required for disputes, fraud prevention or law.
• Payments, receipts and tax records: for the period required by applicable tax, accounting and financial laws.
• License and activation records: for the life of the license and a reasonable period afterwards to prevent abuse and resolve ownership or billing issues.
• Authentication and audit records: for a risk-based security period. One-time codes expire after 10 minutes even if a limited security record remains.
• Support and grievance records: until the matter is resolved and for a reasonable follow-up or legal period.
• Public demo messages: held in the open browser session and request context; message text is not written to the Saathi platform database. AI providers may retain request data under their own terms.
• Installed plugin data: under the WordPress owner's control. Conversations can be deleted, memory can be cleared, and WordPress privacy export/erasure tools are integrated for registered users.

Deletion requests do not require us to erase data that must be retained for law, payment reconciliation, security, fraud prevention or legal claims. Where full deletion is not permitted, use is restricted to the required purpose.

9. International processing

Hosting, email, payment, authentication and AI providers may process data in India or other countries. Those countries may have different privacy rules. We use provider terms, access controls and other reasonable safeguards appropriate to the service and comply with transfer restrictions that apply to us. A WordPress owner controls the location and terms of its own host and chosen AI provider.

10. Security and incident handling

Measures used for the hosted Service include HTTPS, secure and HTTP-only session cookies, CSRF protection, prepared database queries, server-side authorization, hashed one-time codes and license keys, restricted admin access, payment-signature verification, rate limiting, audit events and configuration isolation.

No service can guarantee absolute security. Account holders should protect their email account, WordPress admin, hosting account and AI keys, keep WordPress and plugins updated, use HTTPS, and notify us promptly of suspected misuse. Where law requires, we will notify affected individuals and the relevant authority of a qualifying personal-data breach.

11. Your choices and rights

Subject to applicable law and verification, you may request:

• a summary of personal data we process and the processing activities;
• access to, correction, completion or updating of inaccurate personal data;
• erasure of data no longer needed for a lawful purpose;
• withdrawal of consent and objection or restriction where the relevant law provides it;
• a portable copy where applicable;
• information about relevant processors or recipients; and
• grievance redressal and, where applicable, nomination of another person to exercise rights in the event of death or incapacity.

Submit a request through Contact > Privacy request using your account email. We may ask for information needed to verify identity and authority. We aim to acknowledge privacy or consumer grievances within 48 hours and resolve them within 30 days, or sooner where applicable law requires.

If your request concerns a chatbot on another business's WordPress website, contact that website owner first because the owner controls the plugin database. You may also complain to the Data Protection Board of India or another competent supervisory authority when that remedy is available under applicable law.

12. Children

Saathi accounts and paid plans are intended for businesses and adults able to enter a binding contract. We do not knowingly create accounts for children under 18. A WordPress owner deploying Saathi on a service directed to children is responsible for age-appropriate design, verifiable parental consent where required, and disabling profiling, tracking or advertising practices prohibited for children.

13. Policy changes

We may update this policy when the Service, providers or law changes. The effective date and version will be updated here. Material changes will be highlighted on the website, dashboard or by email where appropriate. A new purpose that requires consent will not rely only on a general policy update.

14. Privacy and grievance contact

Use the contact details below for privacy questions, rights requests, consumer grievances or security reports. Include your account email, the relevant website domain and enough detail to locate the record. Do not send passwords, OTPs or full payment credentials.