Privacy Policy — DRAFT
Draft for lawyer review (due Thu 22 Oct). Written to meet India’s DPDP Act 2023 + Rules 2025, GDPR and Chrome Web Store Limited Use. Placeholders in [brackets].
Last updated: 10 Oct 2026 · Data fiduciary / controller: Abhijit Suryawanshi, sole proprietor, A-301, Amar Samruddhi Apartment, Pune-Solapur Road, Hadapsar, Pune - 411027, India.
The short version
- Your snippets, tabs, notes and emails processed by Promax stay on your computer, encrypted. We cannot read them.
- We keep only what we need to run your account: email, plan, devices, consent choices and usage counts.
- We never sell your data, never use it for ads, and never train AI on it.
What we collect and why
| Data | Why | Kept |
|---|---|---|
| Email address, sign-in method | Create and secure your account (contract) | Until you delete your account |
| Plan, subscription status (from Paddle) | Unlock paid features (contract) | Account life + 8 years for tax records where required |
| Devices (browser, OS, country, last seen) | Security alerts and device limits (legitimate interest / contract) | Account life |
| Consent choices (marketing, telemetry, AI cloud) | Prove and respect your choices (legal obligation) | Account life + 1 year |
| Cloud AI action counts | Enforce plan limits (contract) | 13 months |
| Security logs (no content) | Protect accounts, meet CERT-In and DPDP rules (legal obligation) | 1 year |
| Opt-in crash reports and anonymous usage counts | Fix bugs, improve features (consent) | 90 days |
| Support emails | Answer you (contract / legitimate interest) | 2 years |
| Team/Business shared data | Shared with your team, end-to-end encrypted | Until deleted by the team |
What stays on your device
Snippets, clipboard history, form recovery, tab sessions, notes, AI prompts and answers, email analysis, API keys you add. All encrypted with AES-256-GCM. “Delete all my data” removes it instantly.
AI
- On-device AI (Chrome’s built-in model): nothing leaves your computer.
- Your own AI (your key or account): your browser talks to that provider directly; we never see the key or content.
- Our cloud AI (opt-in): your request passes through our server to Google (Gemini API) or, if Google is unavailable, OpenAI, and back. We store no content, only a count. Providers are contractually barred from training on it and keep it for the shortest period they offer.
Who we share with
Only the service providers listed on our Sub-processors page, under contracts that limit use to providing our service. We disclose data to authorities only when the law requires it.
International transfers
Account data is stored in India (Mumbai). Some providers process data in other countries (see sub-processors) under standard contractual clauses or equivalent safeguards.
Your rights
You can access, correct, export, erase your data and withdraw consent at any time from Account settings, or by writing to [email protected]. We reply within 30 days. Withdrawing consent is as easy as giving it. You may also nominate someone to exercise your rights if you die or become incapacitated (DPDP). EU/UK users may complain to their data protection authority; Indian users may approach the Data Protection Board of India after using our grievance process.
Grievance officer
Abhijit Suryawanshi, [email protected], A-301, Amar Samruddhi Apartment, Pune-Solapur Road, Hadapsar, Pune - 411027, India. We acknowledge within 48 hours and resolve within 30 days.
Security and breaches
Encryption on device and in transit, row-level security on our database, hardware-key protected admin accounts, independent security review. If a breach affects you we will tell you without delay and report it to CERT-In (within 6 hours where required) and the Data Protection Board.
Children
Promax is for people 18 and older. If we learn we hold data of someone under 18, we delete it.
Chrome Web Store Limited Use
Our use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Changes
We will email you before material changes take effect.