Privacy policy
This policy covers personal data we handle through this website and through our agency work building and running AI agents for clients. Each app we publish in a Platform app store has its own privacy policy, listed at /legal/apps/.
Draft, not yet reviewed by a lawyer. These documents were prepared as a structured starting point. Every highlighted value still needs to be supplied, and the whole set needs review by qualified counsel in India before it is relied on.
Who we are
AI Speedforce is the trading name of {{TODO: registered legal entity name, e.g. AI Speedforce Technologies Private Limited}}, a {{TODO: private limited company / LLP / sole proprietorship}} in India.
- Registration number: {{TODO: CIN or LLPIN}}
- Registered address: {{TODO: full registered address, Delhi, India}}
- GSTIN: {{TODO: GSTIN, if registered}}
- General contact: hello@aispeedforce.com
We build and run Agents: software that is given a goal and a set of tools, and that decides which tools to call and in what order to reach it. Agents run inside the systems our clients already use, such as Shopify, Wix, WordPress, Ecwid, HighLevel and BigCommerce.
This policy covers two things:
- This website, aispeedforce.com, including the contact form.
- Our agency services, meaning the work we do for a Client and the data an Agent reaches while doing it.
It does not cover the apps we publish in Platform app stores. Each of those has its own policy at /legal/apps/, because each app touches a different set of records under a different set of permissions.
Roles and regimes
Different laws use different words for the same two roles. Under the EU and UK GDPR they are controller and processor. Under India's Digital Personal Data Protection Act 2023 they are Data Fiduciary and Data Processor, and an individual is a Data Principal. Under the CCPA and CPRA they are business and service provider, and an individual is a consumer. Where this document says controller and processor, the equivalent role under the law that applies to you is meant.
For End Customer Data that an Agent reads or writes on your systems, you are the controller and we are the processor. You decide what the Agent does, which systems it reaches, and what it is allowed to write. We act on your documented instructions, which are the scope and configuration we agree with you in writing.
For Service Data, we are the controller.
The processor terms that go with this split live in the data processing addendum.
What we collect
Website visitors
As of 23 August 2026, this site records server access logs only. The LiteSpeed web server logs your IP address, the time of the request, the URL requested, the response status and your user agent string.
Also true as of 23 August 2026, and stated plainly because most privacy policies pad this part:
- The site runs no analytics. No Google Analytics, no product analytics, no heatmaps.
- The site sets no cookies of its own.
- The site loads no third-party scripts.
- Fonts are self-hosted, so viewing a page makes no request to a third-party font service.
If that changes, we will update this section and the cookie policy on the same day, and add a row to the version history below.
Contact form submissions
The contact form posts to a script on this same server and is delivered by the server's mail function. There is no third-party form processor in the path. We receive whatever you type into the form, which normally means your name, an email address, and a description of what you want built.
Please do not paste customer records, credentials or API keys into the contact form. If you need to send us a sample of real data, ask us first and we will agree a route for it.
Client account and billing data
When you engage us, we hold Service Data about the engagement: the names and work contact details of the people we deal with, the scope and configuration we agree in writing, correspondence, invoices and payment records, and the records we need to keep for tax and accounting in India.
Where card or bank details are involved, they are handled by {{TODO: payment processor(s) used for client invoicing, if any, and confirm we never store card numbers ourselves}}.
Client Data and End Customer Data
Client Data is data belonging to or controlled by the Client that an Agent reads or writes. End Customer Data is personal data about an End Customer, an individual who deals with the Client, for example a shopper or a lead. An End Customer is not our customer.
What an Agent reaches depends entirely on the scope you set and the credential you give it. Depending on the engagement it can include order and transaction records, customer names, email addresses, phone numbers and shipping addresses, support tickets and message threads, form submissions and lead records, and product or catalog data.
We ask for the narrowest scope a task needs. We do not take a copy of your whole database because it is convenient. The systems in scope and the operations an Agent may call are written down before we build.
Run traces
This section matters more than any other on this page, so read it carefully.
A Run trace is the record of an Agent run: the Agent's plan, every Tool call it made, the inputs it passed, the outputs it received, timings and cost.
A run trace can contain personal data. If an Agent reads a customer's order to answer a question about it, that customer's name, address and order history are in the tool output, and the tool output is in the trace. If an Agent drafts a reply to a support ticket, the ticket text and the draft are in the trace. There is no version of useful tracing that avoids this. We are telling you rather than burying it.
We keep traces for three reasons, and no others:
- Debugging. When an Agent does something wrong, the trace is the only way to see which step went wrong and why.
- Evals. A real failure becomes an Eval case so the same failure is caught before the next release. Eval cases are built from real examples, so an eval dataset can also contain personal data.
- Accountability. The trace is the answer to "what did the agent actually do to my data".
Where a trace holds End Customer Data, we hold it as your processor, on the same terms as the rest of the engagement. Access is limited to the people working on your Agents. Traces are stored with our hosting provider, {{TODO: hosting provider for agent runtimes}}, and where an observability vendor is used it is {{TODO: error tracking / observability vendor, if any}}. Both appear on the sub-processors page once confirmed.
How long we keep run traces: {{TODO: how long run traces and logs are kept. This one matters, traces can contain end-customer data}}.
If you want traces redacted, shortened or turned off for a given Agent, tell us and we will implement it. Turning tracing off means we lose the ability to explain what that Agent did, so we will say plainly when we think it should stay on.
How the model providers behind an Agent handle prompts and outputs is covered separately in AI and your data.
Purpose and lawful basis
This table is written from the EU and UK GDPR vocabulary because it is the most specific. The equivalent role under your own law is set out in roles and regimes above.
| Category | Why we use it | Lawful basis | Our role |
|---|---|---|---|
| Server access logs | Keep the site available, investigate errors, and detect abuse of the server. | Legitimate interests in running and securing our own website. | Controller |
| Contact form submissions | Read and answer your enquiry, and discuss a possible engagement. | Steps taken at your request before entering a contract, and our legitimate interest in answering people who write to us. | Controller |
| Client account data | Deliver the engagement, manage access, and correspond about the work. | Performance of our contract with the Client. | Controller |
| Billing records | Invoice, take payment, and meet tax and accounting duties in India. | Performance of contract, and legal obligation. | Controller |
| Client Data and End Customer Data | Run the Agents you configure, against the systems and operations you approve. | Set by you as the controller. We do not choose a basis for this data and we do not use it for our own purposes. | Processor |
| Run traces and eval datasets | Debug Agent runs, build eval cases, and evidence what an Agent did. | Follows the data in the run. Where a trace holds End Customer Data, your basis as controller applies and we process on your instructions. | Processor |
Under India's DPDP Act 2023 the basis for processing personal data is consent or a legitimate use permitted by the Act. {{TODO: confirm with counsel which legitimate use is relied on for each category above, and what consent notice is needed}}.
We do not use Client Data, End Customer Data or run traces to train our own models, and we do not sell personal data. What the model providers behind an Agent do with prompts and outputs is a separate question, answered in AI and your data.
How long we keep it
Every period below is still to be set. We would rather show you an empty box than a number we made up.
| Category | Retention |
|---|---|
| Server access logs | {{VERIFY: confirm how long the host retains LiteSpeed access logs for this account, and whether we rotate them ourselves}} |
| Website contact form enquiries | {{TODO: how long contact-form submissions are kept}} |
| Client project data | {{TODO: retention during and after an engagement}} |
| Agent run traces | {{TODO: how long run traces and logs are kept. This one matters, traces can contain end-customer data}} |
| Eval datasets built from your examples | {{TODO: retention for eval cases built from client examples}} |
| Backups | {{TODO: backup retention and rotation}} |
| Deletion or return after an engagement ends | {{TODO: COMMERCIAL TERM. Days after termination within which client data is deleted or returned}} |
| Billing and tax records | {{TODO: statutory retention period for accounting records in India, to be confirmed with our accountant}} |
Data in a backup is deleted on the backup's own rotation, not on the day the live record is deleted. That is a normal limit of backups and we will not claim otherwise.
Your rights
Depending on where you live, you may have rights to access a copy of your personal data, to correct it, to have it deleted, to object to or restrict how it is used, to receive it in a portable form, and to complain to a regulator. Under India's DPDP Act 2023 a Data Principal also has the right to nominate another person to exercise their rights, and the right to a grievance redressal process.
If you are an End Customer of one of our clients
The business you dealt with is the controller of your data. Contact them first. If you contact us directly, we will pass your request to that business and support them in answering it. We are not able to decide on your request ourselves, because it is not our data to decide about.
Under the EU and UK GDPR
Access, rectification, erasure, restriction, objection, portability, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. You can complain to your national supervisory authority, or to the Information Commissioner's Office in the UK.
Our response time: {{TODO: GDPR Art 12(3) default is one month. Confirm the commitment you want to publish}}.
Under India's DPDP Act 2023
As a Data Principal you have the right to access a summary of your personal data and how it is processed, the right to correction and erasure, the right to nominate another individual to exercise your rights if you die or become incapacitated, and the right to grievance redressal. Grievances go to our Grievance Officer, named under contact and complaints. If you are not satisfied with our answer, you may take the grievance to the Data Protection Board of India.
Our response time: {{TODO: DPDP Act response period, to be set in your published grievance policy}}. Grievance acknowledgement window: {{TODO: acknowledgement window for a grievance}}.
Under the CCPA and CPRA
If you are a California consumer you have the right to know what personal information we collect and why, the right to delete it, the right to correct it, the right to opt out of the sale or sharing of personal information, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising any of these.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. This site runs no advertising or analytics technology that would make that possible.
Our response time: {{TODO: CCPA/CPRA default is 45 days, extendable. Confirm}}.
How to make a request
Write to {{TODO: privacy@aispeedforce.com, confirm the mailbox exists}}. Until that mailbox is confirmed, use hello@aispeedforce.com, which is monitored. Tell us what you want and enough detail to find your data. We may ask you to confirm your identity before we act, so we do not hand your data to someone else.
International transfers
We are based in India. If your data is processed outside your own country, that transfer needs a lawful basis under the law that applies to you. For the EU and UK that usually means Standard Contractual Clauses or the UK Addendum. Our transfer mechanism is {{TODO: confirm which mechanism is in place, and with which sub-processors}}.
Agents call model providers and Platforms over the internet, so prompts, tool inputs and tool outputs can leave the country your data is stored in. Where each sub-processor holds data is listed on the sub-processors page, with a {{VERIFY}} marker against any region we have not confirmed in writing.
Security
Our security measures are set out in full on the security page, so there is one description to keep current instead of five.
In short: traffic to this site and to Platforms and model providers runs over HTTPS/TLS. Access follows least privilege, and an Agent holds only the scopes its task needs, with credentials held per Client. We hold no security certification. We do not claim ISO 27001, SOC 2 or any other certification, because we have none to show you.
Our notification window to a Client after a personal data breach is {{TODO: COMMERCIAL TERM. Typically 24 to 72 hours. You must set this}}. To report a vulnerability, write to {{TODO: security@aispeedforce.com, for vulnerability reports}}.
Sub-processors
A Sub-processor is a third party we use that may process Client Data or End Customer Data on our behalf. The current list, with what each one processes and where, is at /legal/subprocessors/. That page is the single source, so it cannot drift from this one.
This website itself is served by Hostinger, whose access logs hold the IP address and user agent described above. The model providers, agent runtime hosting, transactional email and observability vendors are still being confirmed and appear as {{TODO}} entries on that page until they are.
We do not assert what any third party's current policy is. Where a claim about a provider has not been checked against that provider's live documentation, it is marked {{VERIFY}}.
Cookies and tracking
As of 23 August 2026 this site sets no cookies, runs no analytics and loads no third-party scripts. There is no consent banner because there is nothing to consent to. The full statement is on the cookie policy.
Children
This website and our services are aimed at businesses, not children. We do not knowingly collect personal data from a child. India's DPDP Act 2023 sets specific duties around children's data, including verifiable parental consent. {{TODO: confirm with counsel whether any Agent we operate could foreseeably process a child's data through a Client's systems, and what handling that requires}}. If you believe a child's data has reached us, write to us and we will delete it.
Related documents
- Data processing addendum, the processor terms behind the roles clause above.
- Sub-processors, who else touches the data.
- AI and your data, what happens to prompts and outputs at the model provider.
- Security, the controls behind this policy.
- Cookie policy, what this site stores in your browser.
- App privacy policies, one per app we publish in a Platform app store.
- Terms and disclaimer.
Changes to this policy
We may update this document. When we do, we change the "Last updated" date and add a row to the version history at the foot of the page. Section anchors are stable and we do not rename them, so a link to a section keeps working.
Contact and complaints
Start with us. If we cannot resolve it, every route below stays open to you.
- Privacy questions and rights requests: {{TODO: privacy@aispeedforce.com, confirm the mailbox exists}}. Working fallback: hello@aispeedforce.com.
- Legal notices: {{TODO: legal@aispeedforce.com, confirm the mailbox exists}}.
- Security reports: {{TODO: security@aispeedforce.com, for vulnerability reports}}.
- Data protection officer: {{TODO: EU/UK GDPR Art 37 DPO, only if one is appointed. If not appointed, say so plainly rather than naming a placeholder}}.
- Grievance Officer (India, DPDP Act 2023): {{TODO: name and email of the Grievance Officer. India's DPDP Act 2023 requires a Data Fiduciary to publish a contact who answers Data Principal questions}}.
- EU representative (GDPR Art 27): {{TODO: GDPR Art 27 representative in the EU, required if you have EU data subjects and no EU establishment}}.
- UK representative: {{TODO: UK GDPR representative, same condition for UK data subjects}}.
- Postal address: {{TODO: full registered address, Delhi, India}}.
You can also complain to a regulator without coming to us first: the Data Protection Board of India, your EU national supervisory authority, the Information Commissioner's Office in the UK, or the California Privacy Protection Agency.
Version history
| Version | Date | Change |
|---|---|---|
| 0.1-draft | {{TODO: effective_date}} | First published draft. Not yet reviewed by counsel. |