Privacy Policy

This policy describes how Seventh Revolution Private Limited ("99Models AI", "we", "us") collects, uses, shares and protects personal data when you use 99models.ai and the services offered through it. It is published under rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and is written to the standards of the Digital Personal Data Protection Act, 2023 as its provisions come into force. It forms part of our Terms of Service.

We collect the following personal data when you create an account, use the Service or communicate with us:

• Account data: your mobile number and/or email address, the one-time passwords used to verify them, and your account settings.
• Content you submit: prompts and messages, files and images you upload, audio you record for transcription, and the conversations and outputs stored in your account.
• Transaction data: recharge amounts, platform fee and GST break-up, payment status and the transaction references returned by our payment aggregator. We never receive or store your card number, UPI PIN or banking credentials.
• Usage and billing metadata: which models you use, tokens and units consumed, credit balance and deduction history.
• Device and log data: IP address, browser and device information, timestamps and request logs generated when you use the Service.
• Product analytics events and session replays: named in-product events (for example sign-up steps or recharge steps) and recordings of how the interface is used, associated with your user identifier. Credentials such as passwords, one-time passwords, contact numbers and payment screens are masked and never recorded.
• Support communications: emails you send us and our replies. Our transactional emails record delivery and open events.

Providing personal data is optional, but the Service cannot be provided without the account and transaction data above. You may decline to provide it, and you may withdraw consent at any time (section 9), in which case we may be unable to continue providing the Service.

We use personal data for the following purposes:

• To provide and maintain the Service - creating and securing your account, authenticating you by one-time password, sending your prompts and files to the AI models you select and returning their outputs, storing your conversations and files, and providing optional web search.
• To administer billing - metering usage, maintaining your credit balance, processing recharges, issuing invoices and complying with tax law.
• To keep the Service safe - preventing fraud and abuse, enforcing our Terms, moderating unlawful content and securing our systems.
• To improve the Service - diagnosing errors and understanding, through product analytics, how features are used (for example, sign-up and recharge funnels).
• To communicate with you - responding to support requests and grievances and notifying you about the Service.
• To comply with law - meeting retention, reporting and lawful disclosure obligations.

We do not sell personal data, we do not serve third-party advertising, and we do not use your prompts, files or outputs to train artificial-intelligence models.

To answer a request, the content of that request (your prompt, relevant conversation context and any attached files) is transmitted to the third-party developer or hosting provider of the model you selected - such as OpenAI, Anthropic, Google, Meta, Mistral or DeepSeek models served directly or through providers and aggregators such as OpenRouter, Together AI, DeepInfra, fal.ai and Sarvam AI. If you enable web search, your search query is sent to search providers such as You.com, Perplexity, Tavily, Exa or Brave. These providers process the data only to return a response, and under our agreements with them are not permitted to use it to train their models.

We also disclose personal data to the following categories of recipients:

• Vendors and service providers: providers of cloud hosting (Amazon Web Services, Mumbai region), error tracking (Sentry), product analytics (PostHog), transactional email (Postmark) and SMS delivery over registered telecom routes. These parties access, process or store personal data only in the course of performing services for us.
• Payment processors: RBI-regulated payment aggregators (currently Razorpay), which process your payments and receive the data needed to do so.
• Our personnel: a limited number of authorised personnel may access conversations and files where needed to provide support you request, to review abuse or safety reports, or to meet legal obligations. Please do not submit confidential information that you would not want a reviewer to see.
• Legal requirements: we may disclose personal data to comply with applicable law, regulation, legal process or lawfully authorised government requests (including within the timelines of the IT Rules), or to protect the rights, property or safety of our users, ourselves or the public.
• Business transfers: if we are involved in a merger, acquisition, financing, reorganisation or sale of assets, personal data may be disclosed to the parties involved during diligence and transferred as part of the transaction, subject to this policy.

We use a strictly necessary, secure session cookie to keep you signed in, and local storage for interface preferences. Product analytics uses a first-party identifier. We do not use third-party advertising cookies. You can clear cookies in your browser; the Service will sign you out.

Your conversations, uploaded files, account data and billing records are stored in India, in Amazon Web Services' Mumbai (ap-south-1) region, and the security and system logs for our infrastructure are maintained within India in accordance with the CERT-In directions of 28 April 2022.

Two categories of data leave India. First, when you use the Service, the content of your request (prompt, relevant conversation context and attached files) is transmitted to the third-party model and search providers described in section 4, whose data centres are located in the United States, the European Union or India; they process it to generate your response. We do not route your requests or data to model providers or data centres located in China. Second, our analytics, error-tracking and email vendors (section 4) may store the data they process for us on servers in the United States or the European Union.

Payment data is collected and stored by our RBI-regulated payment aggregator on systems located in India, in accordance with the Reserve Bank of India's directions on storage of payment system data; we do not store payment instrument data at all.

We transfer personal data outside India only where necessary to provide the Service you have requested or with your consent, to recipients bound by agreements requiring a standard of protection comparable to this policy, as rule 7 of the SPDI Rules requires - and subject to any restriction on transfers to specific countries that the Central Government may notify under section 16 of the Digital Personal Data Protection Act, 2023.

• Conversations, files and outputs: until you delete them or your account, subject to the statutory periods below.
• Account registration data: 180 days after you cancel or withdraw your registration, as required by rule 3(1)(h) of the IT Rules, then deleted.
• Content removed for violating the law or our Terms, and associated records: 180 days, or longer where a court or authorised agency lawfully requires.
• Transaction and invoicing records: as long as tax and accounting law requires.
• Security and request logs: up to one year.

We follow reasonable security practices and procedures under rule 8 of the SPDI Rules, aligned with recognised standards: encryption of data in transit, encrypted storage, access controls and least-privilege access, network isolation, logging and monitoring, and backups. No method of transmission over the Internet or of electronic storage is completely secure, and we cannot guarantee absolute security; section 11 describes what we do if a breach occurs.

• Access and correction: you can view and update your account details in the product, and ask us for a summary of the personal data we hold about you.
• Deletion: you can delete individual conversations and files from the product. Account deletion is not yet available in-product - to delete your account, email support@99models.ai from your registered email address or mobile number and we will process it. Deletion is subject to the statutory retention periods in section 7.
• Withdrawing consent: you may withdraw consent to processing at any time by writing to us; withdrawal is as simple as giving consent, does not affect processing already done, and may mean we can no longer provide the Service.
• Grievances: you can raise any privacy concern with our Grievance Officer (section 13).
• Additional rights under the Digital Personal Data Protection Act, 2023 - including nomination and escalation to the Data Protection Board of India - become exercisable as its provisions come into force, and this policy will be updated accordingly.

The Service is for users aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, write to us and we will close it and delete the associated data, subject to statutory retention.

If a personal data breach occurs, we will act promptly to contain and remediate it, report cyber security incidents to the Indian Computer Emergency Response Team (CERT-In) within the mandated timelines, and inform affected users without undue delay with a description of the breach, its likely consequences and the measures taken. Once the breach-intimation provisions of the Digital Personal Data Protection Act, 2023 are in force, we will additionally notify the Data Protection Board of India within the prescribed period.

We update this policy when the product or the law changes. The "Last updated" date above will change, and we will inform users of material changes through the Service. The current version always applies.

Privacy questions, rights requests and complaints go to our Grievance Officer, Jitendra Patil, at grievance@99models.ai or by post to the registered office below. Grievances are handled within the statutory timelines set out on our Grievance Redressal page.