Privacy Policy

unoblox is a service operated by Ogma Consulting Pvt Ltd, Private Limited Company (CIN U72900DL2019PTC355560), with its registered office at LGF, 1800 Gyani Bazaar, South Ex-1, KM Pur, New Delhi, Delhi 110003, India. This Policy applies to personal data we handle as a Data Fiduciary (controller) — for example, account and billing data.

When you use the Service to process personal data contained in your Input (for example, data about your own customers), you are the Data Fiduciary and unoblox acts as a Data Processor on your behalf. That processing is governed by our agreement with you and, for enterprise customers, the Data Processing Addendum. This Policy does not reduce the rights of the individuals whose data you submit; you remain responsible for having a lawful basis to submit it.

We do not intentionally seek special-category or sensitive personal data for our own purposes. Please do not include unnecessary sensitive personal data in your Input.

• To provide, operate, secure, and improve the Service.
• To route your requests to the model Provider you or the router selects, and to return Output.
• To meter usage, manage Credits and budgets, process payments, and issue GST-compliant invoices.
• To authenticate users, prevent fraud and abuse, enforce our Acceptable Use Policy, and maintain security and audit logs.
• To communicate with you about the Service, including verification, receipts, alerts, and service or policy notices. Account, security and payment emails are mandatory and always sent. Team and billing-settings notifications can be switched off in your notification preferences, other optional emails (usage alerts, cost digests) carry an unsubscribe link, and status-page email subscriptions are opt-in: we ask you to confirm the address first, and every email has a one-click unsubscribe. Addresses that unsubscribe or bounce are suppressed.
• To comply with law and enforce our agreements.

We do not sell personal data, and we do not use your Input or Output to train unoblox’s own models.

Under the DPDP Act we process personal data on the basis of your consent or for legitimate uses permitted by the Act. Where we rely on consent, we give notice of the purpose and you may withdraw consent at any time (which does not affect processing already carried out). Where processing is necessary to provide a service you have requested, to comply with law, or for another legitimate use recognised by the Act, we may rely on that basis. For account, billing, security, and fraud-prevention purposes, processing is generally necessary to provide the Service you have signed up for.

1. Metadata by default. Our billing and audit records capture metadata (token counts, cost, model/provider, timestamps) — not the content of prompts or completions.
2. Routing to Providers. To fulfil a request, your Input is transmitted to the selected Provider, which processes it and returns Output. That Provider handles the content under its own terms and retention policies, which vary by Provider.
3. Zero-data-retention (ZDR). Where you enable the ZDR option for a request, route, or workspace, unoblox does not retain the prompt or completion content beyond what is needed to serve that request in memory. ZDR governs unoblox’s retention; a Provider’s own retention is governed by that Provider, so choose ZDR-compatible Providers where this matters to you.
4. Guardrails. We may apply moderation and allow/block controls to requests to enforce policy and law; this may involve automated screening of Input or Output.

We use strictly necessary cookies for authentication and security, and a limited set of functional and analytics technologies. Details and your choices are in our Cookie Policy.

We measure how unoblox is used so we can improve it and understand which of our marketing efforts work. This measurement is on by default for every visitor, wherever you are, and you can turn it off at any time (see “How to opt out” below).

See also our Cookie Policy. Last updated for this section: 30 September 2026.

We share personal data only as needed to run the Service: with the Providers that serve your requests; with the sub-processors below; with professional advisers, auditors, and authorities where required by law; and in connection with a corporate transaction (subject to this Policy). We require sub-processors to protect personal data and to use it only for the services they provide to us.

The set of AI Providers changes as the catalogue evolves; the current list is visible on the models and providers pages.

The unoblox platform, its databases, and account, billing, and usage records are hosted in India with our data-centre provider, Yotta. Payments are processed in India by Razorpay. We are structured to keep unoblox’s core personal-data processing within India.

Some processing necessarily occurs outside India: when you route a request to a Provider whose inference endpoint is located abroad, your Input and the resulting Output are processed by that Provider in its location; and transactional email may be delivered through an infrastructure that operates across regions. Such transfers are made in accordance with section 16 of the DPDP Act — which permits transfer of personal data outside India except to territories restricted by the Central Government — and under contractual safeguards with the recipient. You choose which Providers your requests are routed to and can restrict routing using allow/block controls and ZDR.

• Account & billing: kept for the life of your account and, for tax and legal records, for the period required by Indian law after closure (retention period: as required by law).
• Usage metadata: retained to provide analytics, billing, and audit for a rolling period of 2 years, after which it is deleted from our metering analytics store. Request-attempt and rejection records used for reliability analytics are kept for the same 2 years.
• Input/Output content: not retained where ZDR applies, and otherwise passes through to serve your request without being persisted by the gateway itself, except that if you opt in to response caching, the completion for an identical deterministic request is kept for 24 hours so it can be replayed. Specific features that store content by design keep it only for an explicit window: uploaded files, and generated invoices, reports, and logos, follow an administrator-configured retention setting (kept until an authorized deletion, or auto-expired after a configured number of days); Batch API artifacts follow a window of 1–30 days that you choose when you create the batch.
• Security & audit logs: retained for 90 days (retail accounts) or 180 days (enterprise accounts) to protect the Service and meet legal obligations.

When a retention period ends, we delete or de-identify personal data, unless a longer period is required by law or to resolve disputes and enforce agreements.

We maintain reasonable security safeguards appropriate to the risk, including:

• Encryption at rest of sensitive data using authenticated encryption (AES-GCM), and encryption in transit using TLS.
• Credential protection: API keys are stored hashed; BYOK and provider credentials are encrypted at rest.
• Access controls: role-based access, least-privilege, and authentication for administrative access; audit logging of sensitive actions. Two-factor authentication is available and optional for customer accounts.
• Network egress hardening: server-side requests are validated and pinned to prevent server-side request forgery (SSRF).
• Tenant isolation across organisations and workspaces. Dedicated Private-AI deployments are discussed and arranged on request — see Private AI — and are not a self-service, in-product control today.

Subject to the DPDP Act and applicable law, as a Data Principal you may:

• Access a summary of the personal data we process about you and the processing activities.
• Correct, complete, or update your personal data, and request erasure of personal data no longer necessary for the purpose it was collected, unless retention is required by law.
• Withdraw consent where we rely on it, and nominate another individual to exercise your rights in the event of death or incapacity.
• Grievance redressal — raise a complaint with our Grievance Officer (section 13) and, thereafter, with the Data Protection Board of India.

To exercise these rights, reach our Grievance Officer via our contact form. We may need to verify your identity. Where you are a Data Processor customer’s end-user, please contact that customer (the Data Fiduciary); we will assist them as required by the DPA.

In accordance with the DPDP Act and the Information Technology Act, 2000 and its rules, we have designated a Grievance Officer to address questions and complaints about personal data and content.

• Grievance Officer: Pawan Sharma
• Contact: via our contact form (choose the “Grievance” category)
• Address: LGF, 1800 Gyani Bazaar, South Ex-1, KM Pur, New Delhi, Delhi 110003, India

We will acknowledge and resolve grievances within the timelines prescribed by applicable law.

The Service is intended for use by adults and by organisations. We do not knowingly process the personal data of children except in accordance with the DPDP Act, which requires verifiable consent of a parent or lawful guardian and prohibits tracking, behavioural monitoring, or targeted advertising directed at children. Do not use the Service to process children’s data without meeting these requirements.

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice where appropriate. Your continued use of the Service after the effective date constitutes acceptance.

For privacy questions or to exercise your rights, contact our Grievance Officer via our contact form. For general legal notices, use the contact form (choose Legal).

If you take part in the unoblox partner programme, we collect and use a small amount of extra personal data about you. This section explains what, why, for how long, and how you can have a mistake put right.