1. Scope, and the two roles we play
This policy explains how Turtle Techsai (Nehru Nagar East, Bhilai, CG, India) handles personal data in connection with the Turtle AI Coworker platform and the turtleaicoworker.com website.
The distinction that matters throughout:
- We are a Data Fiduciary / Controller for the data of the people who sign up, log in, pay, and contact us — account holders, prospects and website visitors. This policy governs that data.
- We are a Data Processor for the content a customer puts into their workspace — tables, documents, prompts, and anything an agent reads or writes. We process it on the customer’s instructions and for no independent purpose of our own. That relationship is governed by the Data Processing Addendum, not by this policy.
If you are an employee or contact of a company that uses Turtle AI Coworker and you want to know how your data is handled inside their workspace, ask that company. They decide, not us.
2. What we collect
2.1 Data you give us
| Category | Examples | Why |
|---|---|---|
| Account | Name, work email, password hash, organisation name, role | Create and secure your account |
| Identity (SSO) | Name, email, profile picture and directory identifier from Google or Microsoft | Sign you in without a separate password |
| Billing | Billing name, address, GSTIN, invoice history | Charge you and issue a tax invoice |
| Support | Messages you send us and their contents | Answer you, and keep a record of the issue |
| Integration credentials | OAuth access and refresh tokens for services you connect | Let your agents act on those services |
We never see or store your full card number. Card details are collected and stored by our payment processor, Razorpay, which is PCI-DSS compliant. We receive only a payment reference, the last four digits, and the outcome.
2.2 Data we generate
| Category | Examples | Why |
|---|---|---|
| Usage | Features used, runs executed, tokens consumed, costs incurred | Bill accurately, enforce plan limits, improve the product |
| Audit | Run records and tool calls with sanitised inputs and outputs, timestamps, actor, and config version | Give you an auditable record; investigate incidents |
| Security | IP address, user agent, session records, login attempts | Detect abuse, enforce session limits, investigate compromise |
| Diagnostics | Error reports and performance traces | Find and fix faults |
2.3 Website and application analytics
Our marketing website uses analytics cookies only after you consent. See the Cookie Policy.
The web application uses cookies and local storage for authentication and session security, and product analytics (Mixpanel and Google Analytics) to understand which features are used. Product analytics records the pages and actions you use, your account’s name and email, and technical data such as browser and approximate location. We do not use it for advertising. To opt out of product analytics, write to legal@turtleaicoworker.com.
When you sign in, we look up the approximate city and country of your IP address so you can recognise your sessions in your security settings.
2.4 Terms acceptance
When you accept our Terms of Service and this policy, we record which version you accepted, when, and the IP address and browser you used. We keep this record for as long as your account exists and for the limitation period after it closes, as evidence of the agreement.
2.5 What we do not collect
We do not buy personal data from brokers, we do not build advertising profiles, we do not sell personal data, and we do not use special-category or sensitive personal data for any purpose of our own.
3. Why we process it, and on what basis
| Purpose | DPDP Act 2023 | GDPR Article 6 | LGPD (Brazil) Article 7 |
|---|---|---|---|
| Providing the Service you signed up for | Consent / legitimate use | Contract | Performance of a contract (art. 7, V) |
| Billing, invoicing, tax records | Legal obligation | Legal obligation | Legal or regulatory obligation (art. 7, II) |
| Security, abuse prevention, audit, terms-acceptance records | Legitimate use | Legitimate interests | Legitimate interest (art. 7, IX); exercise of rights (art. 7, VI) |
| Support and service communications | Consent / legitimate use | Contract | Performance of a contract (art. 7, V) |
| Product analytics and improvement | Consent | Consent / legitimate interests | Legitimate interest (art. 7, IX) |
| Marketing email | Consent | Consent | Consent (art. 7, I) |
You can withdraw consent at any time. Withdrawing consent for analytics or marketing does not affect your account. Withdrawing consent necessary to provide the Service means we can no longer provide it.
4. AI and your data
Your content is never used to train models. Not ours, not our providers’, not anyone’s. This is a contractual restriction on every model provider we engage, not a policy preference.
When an agent runs, the content it needs is sent to the model provider that agent is configured to use, for inference only, and the result is returned. Only providers you configure are engaged. If you supply your own provider API key, that request runs under your own agreement with that provider. The full detail is in the AI Addendum.
5. Who we share it with
We share personal data only with:
- Subprocessors that help us run the Service — hosting, storage, email, payments, model inference, monitoring. Each is listed with its purpose and location at /legal/subprocessors, and each is bound by a written agreement with confidentiality and security obligations.
- Services you connect. When you authorise an integration, data flows to that service at your instruction. That provider’s own privacy policy then applies.
- Professional advisers — accountants and lawyers — under confidentiality.
- Authorities, where we are legally compelled. We will notify you unless legally prohibited from doing so.
- A successor, in a merger, acquisition or incorporation of the business, on notice to you and subject to this policy.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
6. Where your data is processed
The platform is hosted on Microsoft Azure, East US (Northern Virginia, United States). This means personal data is transferred outside India and, for European users, outside the EEA.
For transfers of EEA or UK personal data we rely on the European Commission’s Standard Contractual Clauses, with the UK Addendum where applicable, together with technical measures including encryption in transit and at rest. Under the DPDP Act, transfers are made to countries not restricted by the Central Government. Enterprise customers with specific residency requirements should contact us before onboarding — see the DPA.
Brazil. If you use the Service from Brazil, your personal data is collected directly by us and processed in the United States and, for model inference, in the countries listed for each provider on the subprocessors page. These transfers are made under Article 33 of the LGPD and ANPD Resolution 19/2024. Customers who need the ANPD standard contractual clauses in their agreement with us can request them at legal@turtleaicoworker.com.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | For the life of the account |
| Workspace content after account deletion | 30 days, then permanently deleted |
| Integration credentials | Deleted immediately on disconnection or account deletion |
| Audit and run records | Per the retention period you configure, subject to any legal hold you apply |
| Invoices and tax records | 8 years, as required by Indian tax law |
| Backups | Up to 24 months, on a rolling cycle |
| Security logs | 12 months |
Deletion from live systems happens within 30 days of your request. Backups are immutable and expire on their own cycle; data in a backup is not restored to live systems after a deletion request, and is overwritten when the backup expires.
8. How we protect it
- TLS in transit; encryption at rest across all data stores.
- Integration OAuth tokens and custom-tool credentials are additionally encrypted at the application layer and only ever returned masked.
- Every record carries organisation and workspace scope; every query is filtered server-side through a central tenancy layer.
- Two-factor authentication, short-lived access tokens with rotating refresh tokens, a hard cap on concurrent sessions, and role-based access control.
- Audit records are sanitised before storage: passwords, tokens, API keys and card numbers are redacted.
- Access to production is limited to personnel who need it.
No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as required by the DPDP Act, and affected customers within 72 hours of becoming aware, with what we know and what we are doing. Where an incident may cause relevant risk or harm to people in Brazil, we will also notify the Autoridade Nacional de Proteção de Dados (ANPD) and the people affected within 3 business days, as ANPD Resolution 15/2024 requires.
9. Your rights
Wherever you are, you may ask us to:
- Access the personal data we hold about you, and get a copy.
- Correct data that is inaccurate, incomplete or out of date.
- Erase your data, subject to records we must keep by law.
- Export your data in a portable format.
- Withdraw consent at any time, without affecting past processing.
- Nominate another person to exercise your rights in the event of death or incapacity, as provided under the DPDP Act.
- Object to or restrict processing based on legitimate interests, and to lodge a complaint (GDPR).
Write to legal@turtleaicoworker.com. We respond within 30 days. We may ask you to verify your identity first — we are not going to hand your data to somebody who claims to be you.
Users in Brazil also have the rights in Article 18 of the LGPD: confirmation that we process your data; access; correction; anonymisation, blocking or deletion of data that is unnecessary, excessive or processed unlawfully; portability; deletion of data processed on the basis of consent; information about the public and private entities we share data with; information about the possibility of refusing consent and its consequences; withdrawal of consent; and review of decisions made solely by automated processing. You may write to us in Portuguese. We confirm receipt straight away and give a complete answer within 15 days. You may also petition the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.
If you are not satisfied, you may complain to the Data Protection Board of India, or, in the EEA or UK, to your local supervisory authority, or, in Brazil, to the ANPD.
10. Marketing
We send service and transactional email — receipts, security alerts, approval requests, incident notices — as part of providing the Service; these are not marketing and cannot be switched off while your account is active. Marketing email is sent only with consent and has an unsubscribe link in every message.
11. Children
The Service is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, write to legal@turtleaicoworker.com and we will delete it.
12. Data Protection Contact
This contact is also our encarregado (data protection officer) for the purposes of Article 41 of Brazil’s LGPD.
Data Protection Contact
Turtle Techsai
Nehru Nagar East, Bhilai, CG, India
legal@turtleaicoworker.com · +91 78418 53298
13. Changes
We will update this policy as the Service changes. Material changes are notified by email or in-product at least 30 days before they take effect. The “last updated” date at the top of this page always reflects the current version. When this policy or our Terms change materially, the application asks you to review and accept the new version before you continue.
14. Resumo em português (usuários no Brasil)
Este resumo ajuda usuários no Brasil a entender esta política. O texto completo acima, em inglês, descreve todos os detalhes.
- Quem somos: Turtle Techsai (Nehru Nagar East, Bhilai, CG, India). Somos controladores dos dados da sua conta (cadastro, login, cobrança, suporte) e operadores do conteúdo que a sua organização coloca na plataforma.
- Bases legais (art. 7º da LGPD): execução de contrato, cumprimento de obrigação legal, legítimo interesse (segurança, auditoria, análise de uso do produto) e consentimento (e-mails de marketing).
- Inteligência artificial: o seu conteúdo nunca é usado para treinar modelos de IA. Ele é enviado ao provedor de modelo configurado apenas para gerar a resposta.
- Transferência internacional: a plataforma é hospedada nos Estados Unidos (Microsoft Azure). As transferências seguem o art. 33 da LGPD e a Resolução CD/ANPD nº 19/2024. Clientes que precisem das cláusulas-padrão contratuais da ANPD podem solicitá-las.
- Seus direitos (art. 18 da LGPD): confirmação, acesso, correção, anonimização, bloqueio ou eliminação, portabilidade, informação sobre compartilhamento, revogação do consentimento e revisão de decisões automatizadas. Escreva para legal@turtleaicoworker.com (pode ser em português). Respondemos de forma completa em até 15 days. Você também pode peticionar à ANPD.
- Encarregado: legal@turtleaicoworker.com.
- Incidentes de segurança: comunicamos a ANPD e os titulares afetados em até 3 business days, quando houver risco ou dano relevante.
- Dados confidenciais ou sigilosos: não insira dados protegidos por sigilo (por exemplo, processos judiciais em segredo de justiça) sem autorização da sua instituição. Veja a seção 7 dos Termos de Serviço.
Questions about this document? Write to legal@turtleaicoworker.com.