StructBy AI Privacy Policy (India)
Effective date: 4 September 2026 Last updated: 4 October 2026
This Privacy Policy explains how StructBy AI collects, uses, discloses, and protects personal data when you use the StructBy AI software-as-a-service platform at structbyai.com and related services (the Service) from India, consistent with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it. It forms part of the Terms of Service (India). This Policy also serves as the notice under section 5 of the DPDP Act.
1. Who we are
The Data Fiduciary is Structbyai Pty Ltd (ABN 98 700 283 254, ACN 700 283 254), a company incorporated in New South Wales, Australia, trading as StructBy AI ("we", "us", "our").
We process personal data outside India in connection with offering the Service to individuals in India, and the DPDP Act applies to that processing under section 3(b) of the Act. We are not a Significant Data Fiduciary.
| Principal place of business | New South Wales 2745, Australia |
| contact@structbyai.com | |
| Grievance Officer | Abhishek Singh, Director, contact@structbyai.com |
2. Personal data we process
- Account data: name, email, company, role, and country/state.
- Company and tax identifiers you choose to provide (for example GSTIN, PAN, CIN) for use on your generated documents and invoices.
- Project content: project names, site locations, parameters, free-text descriptions, uploaded drawings and documents, and generated reports.
- AI prompts and outputs: the text you submit to AI features and the resulting documents.
- Usage data: queries, generated documents, and product interactions.
- We record which features you use and the steps you take in them (for example, that you ran a site check or exported a result), never the addresses, drawings or questions themselves, to understand how the product is used and to improve it. When you first arrive we note the campaign tag, the referring website and the type of page you landed on; this is kept in your browser for that visit and saved to your account if you sign up.
- Technical data: IP address, device and browser information, and session data for security.
- Audit records: the engineer-responsibility acknowledgement, the parameters supplied for each generated document, the knowledge-base excerpts relied upon, and the user who generated or approved each document.
Passwords and social sign-in credentials are held by our identity provider, Clerk, not by us. If paid plans are offered, card details are held by our payment provider; we receive only the card brand, last four digits, and expiry.
We do not seek to collect any special categories of data. You must not enter personal data of third parties into the Service unless you have a lawful basis to do so.
3. Notice, consent, and lawful basis
3.1 We process personal data on the basis of your consent, given when you create an account and accept this Policy, and for the legitimate uses permitted by section 7 of the DPDP Act, including processing necessary to provide the Service you have requested and to comply with law.
3.2 This Policy is the notice that accompanies your consent. It sets out the personal data we process (section 2), the purposes (section 4), how you may exercise your rights and withdraw consent (section 5), and how you may complain to the Data Protection Board of India (section 10).
3.3 Consent is limited to what is necessary for the stated purposes. You may withdraw consent at any time by closing your account in Settings or by emailing contact@structbyai.com. Withdrawal does not affect processing carried out lawfully before withdrawal, and will prevent the Service from functioning, because every feature requires an account.
4. Purposes
We process personal data to:
- provide, secure, and support the Service;
- generate the documents and answers you request;
- maintain the audit trail described in the Terms of Service (India);
- bill for paid plans, when offered, and meet tax and accounting obligations;
- detect, investigate, and prevent misuse or security incidents; and
- send service and security notices.
We do not sell personal data, do not use your project content to train third-party foundation models, and do not undertake behavioural advertising.
5. Your rights as a Data Principal
Subject to the DPDP Act, you may:
- access a summary of the personal data we process about you, the processing activities undertaken, and the Data Processors with whom it has been shared;
- seek correction, completion, updating, or erasure of your personal data;
- withdraw consent, with the effect described in clause 3.3;
- nominate another individual to exercise your rights in the event of your death or incapacity; and
- complain to us through the grievance process in section 10 and, if unresolved, to the Data Protection Board of India.
To exercise these rights, contact contact@structbyai.com. We may need to verify your identity before acting. We will respond within 30 days. Erasure is subject to section 7, which sets out what closing your account erases, what it keeps, and for how long.
6. Sharing, processors, and transfers outside India
6.1 We share personal data with the following Data Processors, each under contract restricting their use of the data to our instructions. This table is our current list; we update it before a new processor begins processing personal data.
| Processor | Purpose | Data location |
|---|---|---|
| Railway Corp | Application and database hosting | Singapore |
| Vercel, Inc. | Website hosting and site analytics | United States (global content-delivery network) |
| Clerk, Inc. | Identity and authentication | United States |
| Anthropic, PBC | AI inference (Claude models) | United States |
| OpenAI OpCo, LLC | Text embeddings for knowledge-base search, when enabled | United States |
| Google LLC (Google Maps Platform) | Address autocomplete: the address text you type in address fields | United States (global) |
| Stripe | Subscription billing, if paid plans are offered in India | Global |
| Resend | Sending product-update and account emails, including the account-closure notice: your email address and the first name on your account | United States |
6.2 We are located in Australia and our processors are located outside India, in the countries shown above. Transfers are made consistent with section 16 of the DPDP Act and any restrictions notified by the Central Government.
6.3 We may disclose personal data where required by law or to a competent authority, and to a court, tribunal, regulator, professional body, or insurer where lawfully required in connection with a document you generated. We will resist requests that are not lawfully made.
7. Security and retention
7.1 We apply reasonable security safeguards to prevent personal data breaches, including TLS for data in transit, encryption at rest provided by our hosting providers, authentication through Clerk with server-side verification of every request, per-user rate limiting, access controls, and logging.
7.2 We retain personal data only as long as necessary for the purposes in section 4 or as required by law. If you choose to rate an AI-generated output, we keep the rating, any comment you add, the inputs you supplied for that output, the output itself, and the technical context recorded with it (the AI model and app version used, your country, region and plan tier at the time, and display settings such as units, screen width and language), so we can review and improve the quality of the product; these are deleted with your account. When you run a site assessment we save it — the address, the inputs you gave, the result and when it was run — so you can open it again. You can delete a saved assessment; it is then hidden from you and erased with your account. Your CodeLens questions, answers and threads are saved to your account; you can delete any thread at any time. Deleted threads are hidden immediately and removed with your account. Clauses 7.2.1 to 7.2.3 describe exactly what happens when you close your account.
7.2.1 Closing your account. You can close your account from Settings. We do not act on it at once: the account is scheduled for erasure fourteen (14) days later and is blocked in the meantime, and you can cancel at any time in that window. We email you when the request is made.
7.2.2 What we erase. At the end of that period we erase your name, email address, company details, usage history, CodeLens questions, drawing analyses and saved site assessments, and we remove your user id from the records we keep, including the audit trail. Your account record becomes a de-identified record that no longer names you.
7.2.3 What we keep, and why. Your documents, your projects, the version snapshots taken as each document changed, and their audit record are kept exactly as they were written for seven (7) years from erasure, under that de-identified account, and are then deleted. Nothing inspects or redacts the contents of a document or a project, so anything you entered into one — a person's name, a registration number, a site address, a client's details — is kept as part of it for that period. The reason is the reason in clause 7.3: a document that has been generated, relied on, or issued is evidence of what was produced, including evidence that may protect you. Retained records are restricted to that purpose — they are not used to provide the Service to anyone and are not disclosed except as section 6 allows. If you need the content of a particular document erased rather than kept, contact contact@structbyai.com and say so, and we will tell you what we can and cannot do and why.
7.3 Audit records are retained for seven (7) years from the date of the related document, or longer where required by law, and are retained after the document itself is deleted, because the record of what the Service was asked and what it returned must survive deletion of the document.
8. Personal data breaches
8.1 We maintain procedures to detect and respond to personal data breaches.
8.2 In the event of a personal data breach affecting your personal data, we will notify the Data Protection Board of India and each affected Data Principal in the form and within the time prescribed by the DPDP Act and the rules made under it.
9. Children
9.1 The Service is intended for professional use by adults and is not directed at children (persons under 18).
9.2 We do not knowingly process the personal data of a child. Where the DPDP Act applies to a child's data, we will not process it without verifiable consent of a parent or lawful guardian, and will not undertake tracking, behavioural monitoring, or targeted advertising directed at children.
9.3 If you believe a child's personal data has been provided to us, contact contact@structbyai.com and we will delete it.
10. Grievance redressal
10.1 For any grievance regarding the processing of your personal data, contact our Grievance Officer, Abhishek Singh, at contact@structbyai.com.
10.2 We will acknowledge your grievance within 48 hours and respond within 30 days, which is within the period prescribed under the DPDP Act.
10.3 If your grievance is not resolved to your satisfaction, you may complain to the Data Protection Board of India.
11. Changes
We may update this Policy. The current version is always at structbyai.com/privacy?country=IN. Material changes will be notified in-product or by email at least 30 days before they take effect.
12. Contact
All enquiries, including privacy matters and security reports, go to contact@structbyai.com.