Privacy policy
Last updated 23 October 2026
Determesh is a product of Hardcode Consulting Private Limited, a company registered in India. In this policy, we and us mean that company.
Two roles are in play, and the Digital Personal Data Protection Act, 2023 gives them names. For the people who sign in to a company's control panel, and for enquiries sent to us, we are the data fiduciary: we decide why the data is held and what happens to it. For the data a company puts into Determesh, and the conversations of that company's own users, the company is the fiduciary and we are its processor, acting on its instructions.
Two companion pages go further: subprocessors names every other company that can touch personal data, and the terms are what a company agrees to when it uses Determesh.
This website
No analytics, no tracking pixels, no advertising tags. The fonts are served from this site, so loading a page sends nobody else your address.
Two cookies of our own, and neither holds anything about you:
- dm_region: the region you chose, so the page shows its prices and sign-in.
- dm_signed_in: set by a region's control panel while you are signed in there, so the buttons here read "Control panel".
They are set on determesh.com and its subdomains, so this site and the control panels agree. There is no consent banner because these only make the site work; they are not used to learn anything about you.
The contact form carries a bot check from Cloudflare. It runs inside a frame served by Cloudflare and keeps one value there so a check already passed is not asked again; it sits under their domain, and we cannot read it. The site is delivered by a hosting provider whose access logs include IP addresses. We do not build profiles from them.
Enquiries you send us
The contact form sends your email address, your message and, if you asked about one, the region. On the way it passes the bot check and our own form gateway, and it arrives in our mailbox. You get a confirmation that it reached us. We use it to answer you and for nothing else: no mailing list, and nobody else gets it for their own purposes.
Accounts in the control panel
When a company signs up, we hold the company's name and, for each person who signs in, their email address, a password stored only as a hash, their authenticator setup for the second step of signing in, and a key that ties a session to their browser. Signing in, and what is done in the panel, is recorded in the company's audit log with the time and the network address. Billing holds the company's plan, its usage and the payments it makes.
What Determesh holds for a company
A company decides what goes in. Expect it to include:
- Its users: how each one reaches Determesh (a Telegram account, an email address, or the company's own ID for its app), the attributes the company sets for them, and any verifications.
- Conversations: the messages and replies, the steps taken to answer them, and files handed over.
- A short note per user on how they like to be answered, such as the language or the length. It is meant for style, not for facts about the person.
- Documents the company uploads, and their text, so they can be searched.
- The company's own systems: the addresses, methods and credentials of the APIs, code and databases it connects. Credentials are stored encrypted.
- An audit log of who reached what, the calls made and the emails sent.
Where it is stored, and what leaves
Each region is a separate setup, and regions never share data. A company's data is stored in the region it signed up in; for the India region, on servers in India.
To answer, some of it has to go elsewhere:
- Our AI model provider, outside India, receives the parts of a conversation the AI needs to work out an answer: the message, the conversation so far or a summary of it, the passages found in the company's documents, what the company's systems returned, and the user's note. It is not where anything is kept by us.
- Telegram, where a company connects a bot: messages on that channel pass through Telegram.
- Email: replies on the email channel go out through the company's own mailbox; emails Determesh sends for a company go through our email provider.
- The company's own systems receive what is needed to call them, such as the user's question and identifiers the company's rules pass on.
Each provider is named on the subprocessors page. These transfers are permitted under the Digital Personal Data Protection Act, 2023, which restricts transfers only to countries the Government of India has notified. If you are in the EEA or the UK, tell us before you put personal data into Determesh, so that we can agree how such transfers are covered.
Who can see it
Inside a company, what each person in the panel sees is set by the company: its owner and the people it adds. What each of its users can reach through the assistant is decided by the access rules the company writes, checked by code rather than by the AI.
On our side, our administrators can see a company's conversations and the steps taken to answer them, to run and support the service. We do not sell, rent or share personal data for anyone else's marketing. We disclose data to authorities only where the law requires it, and we tell the affected company unless we are legally barred from doing so.
Security
Everything is served over TLS. Signing in to the panel takes a password and an authenticator code, and a session is tied to the browser it started in. Calls to the API are signed with the company's key and cannot be replayed. Credentials for a company's systems are encrypted at rest. What a user may reach is decided by access rules in code, never by the AI, and each decision is recorded.
We hold no security certifications at present.
How long we keep it
- Conversations and logs: for as long as the company's retention setting, five years unless the company sets a shorter one. A company can delete a user's conversations, a single conversation, or all of them, at any time.
- A user's note: removed once that user has no conversations left.
- Documents: until the company removes them.
- A deleted company: deleting a company waits 30 days and can be cancelled in that time; after that its data is removed. We keep only what our accounts need and the law requires: the company's name, its billing account and ledger, the record of what it was charged for (counts of actions and AI usage, without any content) and its payments with their documents. The login email is not kept. A company whose balance stays below its limit for six months is deleted in the same way, after a monthly email.
- Enquiries: until you ask us to delete them, or they are no longer of use to us.
Your rights
Under the Digital Personal Data Protection Act, 2023, you can ask for access to the personal data we hold about you, ask for a correction, ask for it to be erased, withdraw consent you have given, and nominate someone to act for you if you die or become incapacitated. If you are in the EEA or the UK, the equivalent rights under the GDPR apply.
Write to hi@determesh.com. We respond within the period the applicable law allows.
If you talk to a company's assistant built on Determesh, your request is usually one for that company to answer, since it decides what is held about you. Write to us anyway and we will point you to the right place and tell them.
You have the right to complain to the Data Protection Board of India, or to your local supervisory authority if you are in the EEA or the UK. We would rather you told us first, but it is your right either way.
Children
Determesh is business software and is not intended for anyone under 18. We do not knowingly collect data about children. If you believe we have, tell us and we will remove it.
Changes
If this policy changes materially, the date at the top changes and we tell the companies it affects. We will not narrow your rights quietly.
Contact
Hardcode Consulting Private LimitedKamdhenu Building, 3rd Floor
3/4, 75C Park Street
Kolkata, West Bengal 700016
India
CIN U58200OD2024PTC047252
GSTIN 19AAHCH6087L1ZV