Privacy Policy

Aplicious (“we”, “us”, “the platform”) is a product operated by CoMo Workshops (“CoMo Workshops”, “the operator”). This Privacy Policy explains what data we collect when you use the Aplicious platform — including Aplicious Capabilities (API access), Aplicious Connect (business-system integration infrastructure), and related services — how we use it, and the choices you have. By creating an account or using any part of the platform, you agree to the practices described here.

We collect the minimum data required to operate the platform reliably and securely. The categories of data we hold depend on which services you use:

All users

• Account email and profile — used for authentication and service notifications.
• API keys — generated on your behalf when you sign up or create a key in your dashboard. Keys are stored as hashed values; we do not store plaintext keys after initial display.
• Usage logs — endpoint called, timestamp, IP address, and response time for every API request made with your key. These are used for quota enforcement and your dashboard usage view.
• Billing records — subscription tier, payment events, and invoices. Card details are held exclusively by Razorpay; we do not store them.

Aplicious Connect users (additional)

• OAuth credentials and tokens — when you authorise a connection to a third-party business system (e.g. Zoho Books), we store the resulting OAuth tokens in encrypted form (AES-256-GCM) in our credential vault. These tokens are used solely to fulfil API requests on your behalf and are never used for any other purpose.
• Connected business-system data — data returned from a connected provider (e.g. invoice records, customer lists) is processed in-memory to fulfil your API request and is not persistently stored by Aplicious beyond operational caches. We do not mine, analyse, or share this data.
• Connection metadata — provider name, connection status, and operational health logs (last successful request, error counts) used to maintain and display the health of your connections.

BYOLLM / AI features (additional)

• LLM provider keys (BYOLLM) — if you use AI Chat or AI Narratives and supply your own LLM provider API key, that key is stored encrypted (AES-256-GCM) and is used only to make requests to your chosen provider on your behalf.
• AI Chat and Narrative configuration — the chat/narrative configurations you create (namespace, provider, parameters) are stored in your account. Conversation history and narrative outputs are associated with your account identifier.
• Structured data context sent to LLMs — when you make an AI request, Aplicious constructs a structured data payload from verified platform data and sends it to your configured LLM provider. This transmission is governed by your LLM provider's own privacy policy. Aplicious does not control how your LLM provider processes or retains this data.

Your data is used strictly to operate, maintain, and improve the platform:

• Enforcing rate limits and monthly quotas tied to your plan tier.
• Billing — calculating usage-based charges and generating invoices.
• Abuse prevention — detecting credential sharing, scraping, and anomalous traffic patterns.
• Usage analytics — shown back to you in your own dashboard. We do not sell or share your usage data with third parties for marketing purposes.
• Service communications — transactional emails (quota warnings, billing events, account security notices). You may opt out of non-essential product update emails from your dashboard notification settings.

Usage logs (endpoint, timestamp, IP address, response time) and account data (email, billing history, API keys) are retained for as long as your account is active.

OAuth credentials and LLM provider keys stored in our encrypted vault are retained only for as long as the associated connection or AI provider configuration exists. Deleting a connection or AI provider from your dashboard permanently removes the associated encrypted credentials.

All personal data is deleted upon a verified account deletion request as described in Section 6.

We rely on a small number of trusted infrastructure providers to operate Aplicious. Each processes data strictly on our behalf:

• Supabase — primary database (accounts, API keys, usage records, connection metadata, AI configurations) and authentication including signup and password-reset emails.
• Upstash — Redis-backed rate limiting, request counters, and short-lived operational caches.
• Razorpay — payment processing. Razorpay is PCI-DSS compliant; Aplicious never stores your card details.
• Vercel — application hosting and edge delivery. Request logs may be retained by Vercel in accordance with their privacy policy.
• Resend — transactional email for contact, support, and service notifications.

Third-party business-system providers (Connect)— when you authorise a connection to a third-party provider (e.g. Zoho Books), Aplicious communicates with that provider's API using your credentials. Your use of those systems remains subject to your agreement with those providers.

Your LLM provider (BYOLLM) — AI requests are forwarded to the LLM provider you configure (e.g. OpenAI, Anthropic). That provider processes the data under their own terms and privacy policy; Aplicious does not control or take responsibility for their data handling.

You have the right to access, correct, or delete your personal data at any time. You may also request a copy of the data we hold about you, or withdraw consent where processing is consent-based.

To exercise any of these rights, contact us at support@predintel.zohodesk.in and we will respond within a reasonable timeframe, consistent with applicable law. Account deletion can also be initiated directly from your dashboard settings.

We implement the following security measures to protect your data:

• API keys are stored as hashed values; plaintext keys are displayed only once at creation.
• OAuth credentials and LLM provider keys are stored using AES-256-GCM encryption at rest.
• All data in transit is encrypted via TLS.
• Access to production infrastructure is restricted to authorised operators.

No security system is infallible. If you discover a security vulnerability, please report it responsibly to support@predintel.zohodesk.in.

Aplicious uses session-only cookies strictly to keep you signed in to your dashboard. We do not use tracking pixels, third-party advertising cookies, or cross-site analytics cookies.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) for users in the European Economic Area, and India's Digital Personal Data Protection Act (DPDP), 2023, for users in India. This includes lawful basis for processing, data minimisation, and honouring access and deletion requests as described above. Where we transfer data outside your jurisdiction, we rely on applicable legal mechanisms to ensure an adequate level of protection.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. Material changes will be communicated via email or a notice on the dashboard before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.

Questions about this policy or your data can be directed to support@predintel.zohodesk.in.