The short version
- Your password never leaves your device.
- Everything is encrypted before it is sent. Our servers hold ciphertext only.
- Your code is read where it lives. It is not uploaded to us.
- What we can see: your email, who is in your workspace and their roles, counts and timestamps, your billing, and the details you give when you book a call.
- We do not sell your data, show you ads, or track you across other sites.
1. Who is responsible for your data
SPHOTON PRIVATE LIMITED (CIN U62011GJ2026PTC181677), a company incorporated in India and based in Ahmedabad, Gujarat, India ("Sphoton", "we", "us"), decides how and why the personal data described in this policy is used. Under India's Digital Personal Data Protection Act, 2023 we are its data fiduciary; under the EU and UK GDPR we are its controller.
This policy covers the website sphoton.io, the beta-call booking on it, the Sphoton desktop app and the Sphoton service behind it.
Grievance Officer and contact for anything in this policy: Tanmaysinh Gharia, Founder, [email protected].
2. What we collect
| Data | Why | Readable by us |
|---|---|---|
| Booking details: name, work email, company, team size, the call time and your time zone | Arranging your call, sending the confirmation, invite and reminder, and holding your beta offer | Yes |
| Your network address when you book | Limiting abuse of the booking form | No, kept only as a one-way hash |
| Email address | Your account and messages about it | Yes |
| Workspace members and roles | Sharing access with your team | Yes |
| Counts and timestamps | Running and syncing the service | Yes |
| Billing details | Charging for your plan | Yes. Card details are held by our payment provider and never reach us |
| Your record (map, rules, decisions) | Storing and syncing it | No, ciphertext only |
| Your code | Not collected | Never sent |
| Your AI provider key and the requests made with it | Not collected | Never sent. They go from your device straight to your provider |
We collect this data from you directly: when you fill in the booking form, create an account, or use the app. If a colleague invites you to a workspace, we receive your email address from them.
3. How your record is protected
3.1 Keys
Keys are derived from your password on your machine (Argon2id). We store nothing that yields them.
3.2 Encryption
AES-256-GCM, on your device. Our servers hold ciphertext only.
3.3 Team access
The workspace key is wrapped to each member's own public key (RSA-4096).
3.4 In transit
Everything between your browser or app and our servers travels over TLS.
4. Why we use it, and on what basis
| Purpose | Basis |
|---|---|
| Arranging, confirming and reminding you of a call you booked | Your consent, given when you submit the booking form, and the steps you asked us to take before an agreement |
| Providing your account, workspace and sync | Our agreement with you (the Terms of use) |
| Service messages: verification, invitations, security and billing notices | Our agreement with you |
| Keeping the service and the booking form safe from abuse | Our legitimate interest in security, and a legitimate use permitted by law |
| Accounting, tax and other legal duties | Compliance with the law |
Where we rely on your consent, you can withdraw it at any time by writing to us. Withdrawing does not affect what was done before, but we may then be unable to hold your call or keep your account open.
We do not use your data for advertising, sell it, or use it to build profiles of you.
5. Who we share data with
We use a small number of service providers. Each may use the data only to provide its service to us, under a written agreement that requires it to protect the data.
| Provider | What it does for us | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts the website, stores bookings, protects the site from attacks | Global network; bookings stored in the Asia-Pacific region |
| Amazon Web Services (Amazon SES) | Delivers our emails: confirmations, invites, reminders and account messages | Sydney, Australia |
| Zoom Video Communications, Inc. | Hosts the video meeting for your call. The meeting is named after your company | United States |
| Zoho Corporation | Our business mailbox, where your emails to us arrive | India |
| Google LLC (Google Fonts) | Serves the website's fonts; your browser's address reaches Google when they load | Global |
Before we start taking payments or hosting workspaces with a further provider, we will add it here and tell affected users by email.
Your AI provider is not our provider: you choose it and contract with it, and it receives requests from your device under your own key.
Apart from these providers, we share personal data only when the law requires it, to protect the rights, safety or property of Sphoton, our users or others, or as part of a merger or sale of our business, in which case we will tell you first.
6. How long we keep it
| Data | Kept for |
|---|---|
| Booking details and the hashed network address | 12 months after the call date, then deleted |
| Records of the emails we sent you, held by our email provider | Up to 90 days |
| Account data: email, workspace members, roles, counts and timestamps | While your account is open, then deleted within 30 days of closure |
| Your encrypted record | While your account is open, then deleted within 30 days of closure |
| Backups | Overwritten within a further 30 days |
| Invoices and payment records | As long as Indian tax and company law requires, generally 8 years |
If you ask us to delete data earlier, we will, unless the law requires us to keep it.
7. International transfers
Sphoton is based in India. Some of our providers process data outside India, as listed in section 5, mainly in Australia and the United States and across Cloudflare's network.
We protect data sent abroad with written agreements that require our providers to keep it secure and confidential (including the European Commission's standard contractual clauses where the GDPR applies), with encryption in transit, and, for your record, with the encryption described in section 3, which means no provider can read it. We do not transfer personal data to any country to which the Government of India restricts transfers.
8. Your rights
You can ask us to:
- Access the personal data we hold about you, and how we use it;
- Correct or complete data that is wrong or out of date;
- Delete your data;
- Withdraw your consent where we rely on it;
- Receive a copy of the data you gave us in a common, machine-readable format;
- Object to our use of your data based on legitimate interests;
- Nominate someone to exercise these rights for you if you die or become unable to act.
Write to [email protected]. We may ask you to confirm your identity first. We answer within 30 days and do not charge for it.
If you are not satisfied with our answer, you can complain to the Data Protection Board of India, or, if you are in the European Union or the United Kingdom, to your local data protection authority.
9. Cookies and browser storage
The website sets no cookies and uses no analytics, advertising or tracking tools.
It keeps three small preferences in your own browser's storage: whether the films play with sound, which voice you chose, and which cut of the films you prefer. They never leave your browser, and you can clear them at any time in your browser settings.
Cloudflare processes technical data, such as your network address, to deliver the site and protect it from attacks. The desktop app keeps your session on your device, in your operating system's secure storage.
10. Children
Sphoton is a service for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to us and we will delete it.
11. Security
Beyond the encryption in section 3, we limit access to personal data to the people who need it, use providers with recognised security practices, and keep our systems up to date. If a breach affects your personal data, we will tell you and the authorities as the law requires.
12. Changes to this policy
When we change this policy, we update the effective date at the top of this page. If a change matters for how we use your data, we will tell you by email at least 30 days before it takes effect.