Privacy policy
Your reflections remain yours.
This policy explains what MannMitra AI collects, why it is needed, where it is processed, and the choices available to you.
1. Who operates MannMitra AI
MannMitra AI is the trading name of a service operated by Gajendra Pratap Singh, located at R 7 - E 607, Life Republic Township, Marunji, Punavale, Pune, Maharashtra 411057, India.
Privacy, support, and grievance contact: support@mannmitra.ai.
2. Scope and eligibility
MannMitra AI is an India-first AI life-coaching and emotional-wellness service for adults aged 18 and above. It is not therapy, medical care, diagnosis, medication advice, or an emergency service.
3. Data we collect
- Account data: email address, password hash, name, and optional phone number.
- Onboarding data: adult confirmation, consent version, preferred language, city, goals, relationship or work context, preferred tone, and baseline mood, stress, and sleep scores.
- Content you choose to provide: chats, journal entries, mood check-ins, relationship or stress prompts, habits, and feedback.
- Safety data: risk category, risk level, action taken, and session reference. The dedicated safety record redacts triggering text; the original text can remain in private chat history.
- Service data: feature-usage counters, first-party product events, subscription status, and payment metadata only if payments are enabled later.
- Technical data: ordinary request metadata needed for security and reliability. Raw journal or chat content is not intended to be written to production logs.
Push notifications, live payments, community posting, and therapist booking are disabled for the beta.
4. Why we use data
We use data to provide and personalize requested features, maintain conversation history, enforce plan limits, generate requested insights, operate safety guardrails, secure accounts, diagnose service failures, prevent abuse, honour privacy requests, and understand aggregate product usage.
We do not use MannMitra AI to diagnose a health condition, make automated decisions with legal effects, or sell personal data.
5. AI processing
When you request an AI response, the relevant prompt and limited personalization context are sent from the backend to OpenAI. API credentials stay on the backend, and the integration requests that response application state not be stored. OpenAI may retain API abuse-monitoring logs containing prompts and responses for up to 30 days by default, unless law requires longer retention. API content is not used to train OpenAI models by default.
6. Service providers and international processing
Data is shared only as needed with contracted providers, when required by law, or when you direct us to do so.
- Render: application and PostgreSQL hosting in Singapore.
- OpenAI: AI response generation, which may involve processing outside India.
No third-party advertising SDKs are enabled in the beta.
7. Retention
Active-account content is retained while your account is open. An authenticated in-app deletion removes your account and linked application records from the active database.
- Verified email deletion requests will be completed within seven calendar days.
- Render recovery copies, where enabled, age out within the provider recovery window, no longer than seven days.
- Application security and audit events are retained for up to 30 days, unless longer retention is reasonably required to investigate abuse, protect users, or comply with law.
- OpenAI abuse-monitoring data may be retained for up to 30 days unless law requires longer retention.
- Payment records are not collected during the free beta.
8. Your choices and rights
You can view core profile data, export account data, and permanently delete your account from Settings → Privacy controls. You can also request access, correction, erasure, withdrawal of consent, or grievance handling at support@mannmitra.ai.
Open the account-deletion instructions.
9. Children
The service is not intended for anyone under 18. If we learn that an under-18 user created an account, contact us so it can be deleted.
10. Security
Measures include TLS in transit, salted password hashing, signed access tokens, Android secure storage, request validation, rate limiting, role-restricted administration, redacted safety-event text, and server-side credentials. No system can guarantee absolute security.
11. Changes and consent
Material changes will be presented through an updated notice and consent flow where required. The beta consent version is soft-launch-v1.