This policy explains what personal data dhavanshah.com and my consulting practice collect, why, and the choices and rights you have. The site and the practice are run by Dhavan Shah, a sole proprietor based in Mumbai, India (I, me). You can reach me at [email protected].
In short
- The site sets no analytics, advertising or tracking cookies.
- I collect what you send me: the consulting form, email, and the questions you ask the assistant.
- Chats with the assistant are kept for about 30 days, then deleted automatically.
- I do not sell personal data, and I do not use it to train AI models.
1. Scope
This policy covers dhavanshah.com, the assistant on its home page (served from api.dhavanshah.com), the consulting form, email with me, and the contact, billing and project records of my consulting clients. I decide how this data is used, so I am its data fiduciary or controller.
Systems, code and data that a client gives me access to during an engagement are covered by the agreement for that engagement, not by this policy. This policy does not cover kazenai.com or KazenAI’s hosted product.
2. What I collect
| When | Personal data |
|---|---|
| You visit the site | Cloudflare, which hosts and protects the site, processes your IP address, browser user agent, the page requested and the time. Your browser also loads the site’s fonts from Google Fonts, which receives your IP address and browser details. When the home page opens, your browser sends a short request to api.dhavanshah.com to start the assistant; nothing about you is stored from it. |
| You send the consulting form | Your name, work email and company, and your answers: the problem you choose, the system you are working on, what is going wrong, how often it happens and when you want to start. Formspree receives the submission and emails it to me. |
| You email me | Your name, email address, what you write and anything you attach. |
| You use the assistant | Your questions, the assistant’s answers, a short summary of the conversation, a random session ID, the time, and technical details of each answer (response time, token counts and cost). To limit abuse, the assistant also computes a short one-way hash of your IP address and browser user agent. It does not ask for your name or email address. |
| You become a client | Contact and billing details, our agreement, invoices, tax details such as a GSTIN or tax ID, payment records and our project correspondence. |
Please do not send confidential code, credentials, customer data or sensitive personal data through the form or the assistant.
3. Why I use it
| Purpose | Basis |
|---|---|
| Replying to enquiries, and scoping and running engagements | Your request, steps you ask for before a contract, and performing our contract |
| Answering your questions in the assistant and keeping a conversation together | Your request, and my legitimate interest in running the assistant |
| Reviewing stored chats to fix wrong answers and improve the assistant | My legitimate interest in an accurate assistant |
| Keeping the site and the assistant secure, and preventing abuse | Legitimate interests and legal obligations |
| Invoicing, accounting and tax | Contract and legal obligations |
| Complying with law and protecting my rights | Legal obligations and legitimate interests |
Where I rely on your consent, you can withdraw it at any time by emailing me; this does not affect processing that happened before. I do not sell personal data, use it for advertising, or use it to train AI models.
4. Cookies and browser storage
- dhavanshah.com sets no cookies and runs no analytics or advertising tags.
-
When you send a message to the assistant, api.dhavanshah.com sets one strictly necessary cookie,
session_id. It keeps your conversation together if you reload the page. It holds a random ID, cannot be read by the page’s scripts, is sent only over HTTPS and expires after one hour. -
The home page also keeps two settings in your browser’s storage, neither containing personal data:
chatbot:minimizedremembers whether you left the assistant open or closed, andchatbot:last_warm_at, cleared when you close the tab, avoids repeated start-up requests. - Cloudflare may set its own strictly necessary security cookie if it needs to check that a request comes from a person.
5. Who I share it with
Service providers that process personal data for me:
- Cloudflare: hosting, DNS, content delivery and protection for dhavanshah.com and api.dhavanshah.com.
- Amazon Web Services: runs the assistant and stores its chats and logs, in the United States (region us-east-1).
- Hugging Face and DeepInfra: the assistant sends your question to Hugging Face, which computes search embeddings and passes the question, with the matching published material, to DeepInfra, which runs the model that writes the answer.
- Formspree: receives the consulting form and emails it to me.
- Google: Google Workspace for my email, and Google Fonts for the site’s fonts.
And, only where needed:
- my bank, to receive client payments;
- professional advisers, such as accountants and lawyers, under duties of confidentiality;
- authorities, where the law requires it or to protect the rights, safety or security of others or me; and
- a successor business, if my practice becomes a company or is merged or sold; this policy will continue to protect your data.
6. International transfers
I work from India. The assistant and most of my service providers run in the United States, and Cloudflare’s network is worldwide. Your data may therefore be processed in India, the United States and other countries where they operate, which may have different data protection laws from yours. Where the law requires it, I rely on appropriate safeguards, such as standard contractual clauses, for these transfers.
7. How long I keep it
- Assistant chats: about 30 days, then deleted automatically. Automatic deletion can take a few days longer.
- Assistant session data and the
session_idcookie: one hour. - Rate-limit counters: about an hour.
- The assistant’s operational logs: up to 30 days. They record request IDs, timings and errors, not the text of your questions or your IP address.
- Enquiries by form or email: for as long as we are in touch, and up to 24 months after our last contact. This includes the copy Formspree keeps for me.
- Client records: for the engagement, and afterwards for as long as tax, accounting and contract law require.
Cloudflare and Google keep their own request logs under their policies. I may keep data longer where the law requires it or to resolve a dispute.
8. Security
The site and the assistant are served only over HTTPS. Only I have access to the assistant’s stored chats. Its logs leave out what you type, and its own rate limits store a hashed fingerprint, not your IP address. No system is perfectly secure. If a breach affects your personal data, I will notify you and the relevant authorities as the law requires.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal data I hold about you and receive a copy;
- have it corrected, completed or updated;
- have it deleted;
- object to or restrict certain processing, or ask me to transfer it to you or another service;
- withdraw consent where I rely on it;
- nominate another person to exercise your rights if you die or become incapable (under India’s Digital Personal Data Protection Act); and
- have your complaint addressed by me and, if you are not satisfied, complain to a data protection authority: in India, the Data Protection Board of India; elsewhere, your local supervisory authority.
To exercise any of these rights, email [email protected]. I may need to verify your identity, and I will respond within 30 days. Assistant chats are stored under a random session ID, not your name, so to find yours I may need roughly when you chatted and what you asked. I will not treat you differently for exercising your rights.
10. Children
This site and my services are for businesses and are not intended for anyone under 18. I do not knowingly collect personal data from children; if you believe I have, contact me and I will delete it.
11. Changes to this policy
When I change this policy, I will post the new version on this page and update the date at the top. If a change materially affects how I use a client’s personal data, I will tell that client by email before it takes effect.
12. Contact and grievance officer
For questions, requests or complaints about this policy or your personal data, contact my grievance officer, Dhavan Shah, at [email protected]. I will acknowledge your message promptly and aim to resolve it within 30 days.