Privacy Policy.
How we safeguard your digital workspace.

At ChatBox AI (the "Platform"), developed and operated independently by Arpit Ariyan Mahanarana (an independent software developer, creator, and student based in New Delhi, India, whose official developer portfolio is hosted at technon.co.in), protecting your personal information and ensuring operational confidentiality is fundamental to our architecture. ChatBox AI is an independent software creation and AI workspace engineered by Arpit Ariyan Mahanarana rather than a corporate conglomerate. This Privacy Policy details how we collect, process, manage, and safeguard information across our multi-model chat workspace, AI website builder, deep research agents, image generators, and voice synthesis modules.

Our data management operations are structured to remain fully compliant with the Digital Personal Data Protection Act (DPDP Act) of India, alongside global standards of user confidentiality. By accessing or using the Platform, you acknowledge the terms outlined in this Privacy Policy.

We collect personal information strictly required to deliver, authenticate, and secure your access to our frontier AI workspace:

• Account Identity & Credentials: Valid email address, registered display name, and securely hashed passwords created during signup.
• Multi-Factor Authentication (MFA): Verification emails, temporary OTP records, and secret keys necessary to protect against unauthorized account takeovers.
• Interface Preferences: Local UI settings, dark/light theme choices, selected layout modes, and default AI model preferences (e.g., defaulting to Claude 3.5 Sonnet or GPT-4o).
• Diagnostic Telemetry: Device operating system, browser engine version, screen resolution, and IP address collected strictly for session stability, error logs, and fraud prevention.

Paid subscriptions (Pro and Max plans) require processing billing transactions with verified payment processors:

• Payment Gateway Tokens: Transactions are routed through our certified partners, Razorpay (for UPI, RuPay, Netbanking, and domestic cards in India) and Paddle (for international billing). We store only transaction tokens, status markers (Success, Failed, Pending), and invoice numbers.
• Tax & GST Invoicing: In compliance with Indian commercial and taxation laws, we store registered customer billing addresses, legal business names, and GSTIN numbers where explicitly entered for tax deduction.
• Subscription Lifecycles: We maintain chronological audit logs of active cycles, renewal timestamps, plan upgrades, and downgrade actions to ensure accurate subscription tiering.

To balance computational load across 56+ integrated foundation models, prevent denial-of-service disruptions, and meter fair usage:

• Token Deduction Accounting: Real-time database entries meter prompt token lengths, completion token lengths, and calculate credit deductions based on underlying model tiers.
• Rate-Limit Telemetry: Request frequencies are monitored per IP address and account ID (e.g., enforcing 10 requests/min on Free tiers vs. 60 requests/min on Pro tiers) to block malicious scrapers.
• Media Generation Counters: Separate counters track image synthesis calls and audio synthesis clips to monitor dedicated GPU cluster capacities.

We hold contractual and technical privacy safeguards with our upstream model partners:

• Commercial API Terms: Enterprise API agreements with OpenAI, Anthropic, Google AI, Mistral, and Cohere explicitly prohibit the use of API payloads for model training.
• Transient Execution: Prompts are routed in-memory to upstream inference clusters to generate replies, and returned outputs are stored in your private database tables for dashboard display.
• Unconditional Erasure: You retain the technical ability to delete any single message thread, wipe an entire project workspace, or purge your account history at any time from Settings.

To provide a seamless multi-model experience, we partner with verified enterprise infrastructure providers:

ChatBox AI implements defense-in-depth engineering practices to prevent data interception and exfiltration:

• In-Transit Encryption: All communications between your client device and our servers operate strictly over TLS 1.3 with modern cryptographic cipher suites.
• At-Rest Encryption: Database volumes, file attachments, and user profiles are stored encrypted using AES-256.
• Hashed API Keys: Developer API keys are stored strictly as salted SHA-256 hashes. Even in the event of an internal infrastructure audit, plaintext keys cannot be retrieved.
• Multi-Factor Authentication (MFA): Optional email-based OTP verification blocks credential-stuffing and automated password attacks.

We retain personal data only for as long as necessary to provide platform services and satisfy statutory obligations:

Under India's Digital Personal Data Protection Act (DPDP Act) and global privacy regulations, you possess enforceable data rights:

• Right to Access: You can review your account metadata, credit history, and past invoice records directly in your dashboard.
• Right to Correction & Rectification: You can edit personal information, email addresses, and billing credentials at any time from Settings.
• Right to Erasure (Forgotten): You have the right to permanently delete your account, triggering automatic removal of your identifiers and threads within 30 days.
• Right to Grievance Redressal: You may submit complaints regarding data handling directly to our appointed Data Protection Officer.

We use cookies and browser local storage strictly for essential platform operation and session continuity:

• Essential Authentication Tokens: HttpOnly secure session cookies keep you authenticated across web page transitions without repetitive logins.
• Client-Side Storage: LocalStorage preserves UI state, collapsed sidebar preferences, and recent model selections.
• No Third-Party Ad Trackers: We do not load advertising tracking pixels (such as Meta Pixel or cross-site ad beacons).

ChatBox AI is designed for professionals, researchers, developers, and adult learners. We do not knowingly market to or solicit accounts from individuals under 13 years of age.

If we determine that an account has been registered by a minor under 13 without verified parental consent, we will immediately suspend the account and permanently delete all associated conversation data and billing profiles.

Our primary computational databases, account management clusters, and routing engines are hosted within India. When international users connect, data is securely routed over encrypted internet backbones to Indian datacenter regions.

When model inference is delegated to specialized frontier partners (e.g., Anthropic or OpenAI), data packets are protected by Standard Contractual Clauses (SCCs) and commercial zero-retention transit agreements.

We may periodically revise this Privacy Policy to reflect platform enhancements, newly added foundation model capabilities, or evolving statutory frameworks.

When material revisions occur, we will notify users via dashboard banner alerts or registered account email announcements prior to the changes taking effect. Continued use of ChatBox AI after notice represents acceptance of updated terms.