Privacy Policy

Account data: your name, work email, organization, desk role, and — where you sign off research notes — your SEBI Research Analyst registration number.

Credentials: passwords are hashed with bcrypt and never stored or transmitted in plaintext. Sessions use signed, httpOnly tokens.

Workspace data: documents you upload, extracted tables and page content, generated reports, and the audit trail of state changes and sign-offs.

Billing data: our payment processor, Dodo Payments, acts as merchant of record and holds your payment identity, invoices, and subscription state. We store only provider customer, checkout session, subscription, and payment identifiers plus your plan and renewal date — never full card numbers.

Uploaded documents are parsed, segmented, and summarised by third-party language models to build research notes. Those providers receive the document content required to produce the output.

Audit logs record who changed or approved what, and when. These records are retained for compliance and dispute resolution.

We do not sell your data, and we do not use your workspace content to train models.

Every document, report, session, and subscription is scoped to a single organization. Access is authorised from a verified session on each request rather than from client-supplied identifiers.

Billing and quota entitlements apply at the organization level, so all seats in a firm share one subscription and one quota.

Workspace data is retained while your organization has an active account. Deleting a report or an organization removes its associated workspace records.

Billing records are retained for the period required by applicable tax and accounting law.

Session tokens expire after a limited period and can be revoked by signing out or by an administrator removing the user.

Passwords are bcrypt-hashed. Sessions are signed tokens delivered via httpOnly, SameSite cookies. Integration API keys you store are encrypted at rest with AES-256-GCM.

Webhook endpoints authenticate callers with HMAC signatures compared in constant time, and payment state is only mutated from verified provider events.

No system is perfectly secure. Please report suspected vulnerabilities to your account contact rather than probing production directly.

You may access, correct, or export your profile and workspace data at any time from the settings pages.

You may request deletion of your organization. Some records — including audit and billing entries — must be retained where law requires it.

For access or deletion requests, contact your organization administrator or the EquiGen account team.