Privacy policy

Charter AI is a SaaS product for Indian Chartered Accountants (“CAs”, “you”), provided by Eden Labs Private Limited (“Eden Labs”, “we”), the data fiduciary under the DPDP Act, 2023 for the account data covered by this policy. This policy covers your account data and the data you upload about your own clients while using the product. For your clients’ data, you remain the data controller — Charter AI acts only as a processor on your instruction.

• Account data: name, email, firm details and sign-in metadata.
• Client data: the client records, notice documents, trademark matter details and facts you upload or type in to draft a reply or filing.
• Research queries: the legal questions you ask and the cited sources returned.
• Bookkeeping and GST data: bank statements, sales and purchase invoices, ledger and voucher data, and GSTIN-linked return data (GSTR-2A/2B) you upload or connect for your clients. These features are still in development — this policy covers them from the day they are available to you, so you know the terms before you upload anything.
• Payment and usage data: plan status, trial usage and payment records for billing.

Solely to draft notice replies and legal research, to reconcile bookkeeping and GST data, on your instruction, to run your account (billing, support), and to keep the product working (error diagnostics, abuse prevention).

Drafting, research and bookkeeping are powered by an AI model. We send it only what a given draft, research question or reconciliation needs, never a full client file by default, and we never use your or your clients’ data — including bookkeeping and GST data — to train any model or to generate content for anyone else. This data is used only to produce output for your own firm. Client data is never sold and never made public.

Retention periods, as implemented in the product:

Uploaded documents and drafts

Kept for the life of your account.

Research queries

Kept for the life of your account.

LLM call logs

90 days, and stored without prompt content — call metadata only (model, tokens, latency, status).

Payment records

8 years, as required under Indian tax law.

Payment webhook events

8 years, as required under Indian tax law — stored with customer PII (email, contact, card/bank/UPI details, notes) stripped before storage.

Deleted accounts

All tenant rows and files in storage are removed within 30 days of deletion; backups containing them roll off within 35 days.

Charter AI uses only session cookies needed to keep you signed in. There is no advertising or tracking cookie on this product.

Under the DPDP Act, 2023, you can:

• Access and correct your account details in Settings → Profile.
• Export everything Charter AI holds about your account from Settings → Profile → Export my data.
• Withdraw consent. The service cannot run without it, so withdrawing ends the service — do this from Settings → Profile → “Withdraw consent and delete account”.
• Erase your account and its data from Settings → Danger zone. See the retention table above for how long deletion takes to complete. To stop repeated free trials, we keep a salted hash of a deleted account’s email (not the email itself) with the date the trial started.
• Raise a grievance with Grievance Officer, Charter AI by writing to privacy@charterai.in. We aim to respond within 7 days (the exact statutory period under the DPDP Rules is pending counsel confirmation).
• Complain to the regulator if a grievance is not resolved to your satisfaction — you may complain to the Data Protection Board of India (counsel to confirm the notified procedure).