Privacy Policy — TerraSec Property Intelligence Platform

Effective date: 29 May 2026. Governed by India's Digital Personal Data Protection Act 2023 (DPDP Act).

Plain-Language Summary

We collect only what we need to protect your property. Your documents go to OpenAI (USA) for AI analysis — we do not store the raw files, and we have a signed Data Processing Agreement with OpenAI so they cannot train on your data. We never sell your data. You can delete your account and all data at any time.

Who We Are

TerraSec is a property monitoring service operated as a software platform. For questions about this policy, contact us at privacy@terrasec.ai. Under India's DPDP Act 2023, we are the Data Fiduciary for the personal data described in this policy.

What Data We Collect

• Account data — your name and email address when you register.
• Property data — survey numbers, GPS coordinates, plot boundaries, property addresses, and owner names that you enter.
• Uploaded documents — Encumbrance Certificates (EC), sale deeds, mutation certificates, or any other documents you choose to upload for AI analysis. These are not stored on our servers — they are transmitted directly to OpenAI for OCR and analysis, and only the analysis result is saved.
• Device and usage data — browser type, session timestamps, and API call logs used for rate limiting and security monitoring.
• Payment data — Razorpay order IDs and payment status. We do not store your card details; Razorpay handles all payment processing under its own PCI-DSS compliance.

Third-Party Data Processing — OpenAI

When you upload a document or request AI analysis, the document text is sent to OpenAI, LLC (USA) via their API. This is an international data transfer outside India. We have signed OpenAI's Data Processing Agreement (DPA) under their API usage terms: OpenAI does not train on data submitted via the API; data is processed only to fulfil the API request; OpenAI acts as a Data Processor and we remain the Data Fiduciary for your data.

By accepting the consent checkbox before each AI analysis, you explicitly acknowledge this cross-border transfer to the USA as required under DPDP Act 2023, Section 16.

How Long We Keep Your Data

• Account and property data — retained while your account is active, and for 30 days after account deletion to allow recovery.
• AI analysis results — retained indefinitely until you delete the record or request account deletion.
• API rate logs — automatically deleted after 90 days.
• Payment records — retained for 7 years as required by Indian accounting regulations.

Your Rights Under DPDP Act 2023

• Right to access — request a summary of the personal data we hold about you.
• Right to correction — update your profile or property data at any time from the dashboard.
• Right to erasure — request deletion of all your personal data using the Delete My Account button in your account settings. We process requests within 30 days.
• Right to grievance redressal — contact our Grievance Officer at privacy@terrasec.ai. We acknowledge within 48 hours and resolve within 30 days.

Security Measures

• All data is encrypted in transit (HTTPS/TLS).
• Database rows are protected by Row Level Security — each user can only access their own data.
• All API calls require a valid authentication token.
• Per-user rate limits prevent bulk data extraction.
• No raw document files are stored on our infrastructure.

Contact & Grievance Officer

Grievance Officer, TerraSec. Near Digimetrics Exam Centre, East Bangalore. Email: privacy@terrasec.ai. Response time: 48 hours (acknowledgement), 30 days (resolution). If your grievance is not resolved, you may approach the Data Protection Board of India once it is constituted under the DPDP Act 2023.