Your data, in your control.

Last updated: 2026-10-12 · India operations

Saarthi is a product of SMEMINDS LLP ("we", "us"). This policy explains what personal data we handle when you use Saarthi, the marketing site, the dashboard at saarthi.smeminds.com, and the Saarthi assistant, and the rights you have under India's Digital Personal Data Protection Act, 2023 ("DPDPA").

1. What we collect

Account data: the email address and WhatsApp number you give us at signup, your business name, GSTIN(s), legal name, registered address, and the marketplace(s) you sell on.

Marketplace data: orders, returns, inventory, settlements, sponsored-ads reports, whatever you upload from Amazon Seller Central, Flipkart Seller Hub, or Myntra Studio. Once SP-API / Marketplace API integrations are live (separate consent step), we also pull this directly with your authorisation.

Saarthi conversations: the messages you send and receive through the in-app chat. In-app voice clips are transcribed by Deepgram. If you talk to Saarthi in Voice Saarthi (live voice conversation), what you say and what Saarthi says is kept as text in the same conversation history; the audio itself is never recorded or stored. Saarthi does not hold conversations on WhatsApp; WhatsApp, once active, is used only to send you briefs and alerts.

Web pages you ask Saarthi about: if you install the Saarthi browser extension and turn on page reading, a question you send from the extension's side panel while its page chip is switched on (the “Reading: …” label above the box you type in) carries what is on the page you are on — any website, not only marketplaces: its visible text, its tables (as rows of cells), its headings, the labels of its form fields and buttons, its address and title, and anything you had highlighted. We never read what is typed into a form field — a password, a card number, a message you are writing — only the field's label. Only that page, only with that question. The chip starts switched on for Amazon, Flipkart, Myntra and Seller Central / Seller Hub pages and off on every other site; one tap switches it either way, and “Pause page reading” in the panel's menu stops all reading. We do not read pages in the background, and the extension cannot read a page unless you have the panel open on it. The text is used to answer that question; it is not saved with the conversation (only your own question and Saarthi's answer are). This is off until you turn it on, either at Settings → Privacy & Consent or with “Allow page reading” in the panel, which shows the same notice and records the same consent; turning it off (in either place) leaves the rest of Saarthi working.

Screenshots, for pages drawn as pictures: some pages draw their content instead of writing it as text — Google Sheets, Excel Online, PDFs, some dashboards. On those, a question sent with the chip on carries a screenshot of the visible part of that one tab instead, taken at the moment you press send and shrunk in your browser first. It goes to our AI provider's vision model (see Section 3) only to turn what is on screen into text for that answer. The screenshot is never stored: not with the conversation, not in our logs, not in our file storage; the small thumbnail you see under your question lives only in the open panel and is gone when you close it. It is not used to train any AI model. A screenshot is never taken in the background, of any other tab, or of anything outside the browser window.

“Guide me” highlights: when you ask how to do something on the page in front of you, Saarthi may outline the buttons or links to use, with a numbered badge. The outline is drawn by the extension in your browser and goes away on your next question, when you press Escape, or when you leave the page. Saarthi never clicks, types or submits anything for you.

Files you attach to a question (in Ask, the Saarthi panel or the side panel): the file is sent to our server, read in memory to answer that one question, and not stored. For a spreadsheet or CSV we pass a summary to the AI — sheet names, column headings, the first rows, totals, ranges and formulas — not the whole file. For a PDF, Word, PowerPoint, text or email file we pass its text (for a long PDF, the first 30 pages). A scanned PDF or an image is passed as up to ten pictures through the same vision model and on the same terms as a screenshot, with photo metadata such as location removed. If the file is a marketplace report Saarthi can read and you press “Import into Saarthi”, it is uploaded through the same route, with the same checks, as an upload on the dashboard, and from then on it is handled like any other upload.

Free Money Leak Audit (no account): if you use the free audit at /audit before signing up, the marketplace reports you drop there are read on our server in memory only, to calculate the money the marketplace may owe you, and are discarded as soon as the result is sent back to your browser. Nothing from those files is written to our database or file storage, and nothing is linked to you: the audit has no account and no name. If you then sign up, you upload the files again inside your account, under the consent you give there. We keep only the abuse-protection counter for your IP address (see Retention) and, if product analytics is switched on, anonymous counts (how many files, whether anything was found, a rough band of the amount) under a random audit id that identifies nobody.

Product and order pages you open the extension on: with page reading turned on, opening the Saarthi panel on a page (or pressing “Check this page again”) reads that one page once, inside your browser, to show your net in hand on a product or the claims on an order. The page's text stays in your browser; only the identifiers on it — a product id such as an ASIN, or order ids — are sent to us, to match against your own records, and they are not stored. The panel shows exactly what it read. It never clicks, types or submits anything on Amazon, Flipkart or Myntra, and nothing it reads is used to train any AI model. We can switch the extension off for everyone from our side at any time.

Photo identify: when you ask Saarthi to identify a product from a photo you attached (in Ask or the side panel), that one photo is sent through the same vision model, on the same terms as other pictures you attach: read for that request, not stored, not used to train any AI model, and only with page & picture reading turned on. The answer is a likely product name with how sure the model is; it names a brand only when the brand is printed on the product.

Price comparison (side panel): only when you press “Compare prices” and confirm, the extension opens the public search page for the product name you gave on Amazon.in, Flipkart and Myntra (at most one search on each) in tabs you can see, grouped as “Saarthi price check”, and reads the visible results (product names and prices) inside your browser. It never opens or reads a signed-in or seller page. The product name is checked by our server before the tabs open; the results are shown to you with where and when they were read, and go to us only if you then ask Saarthi about them, as part of that one question. Nothing is scheduled or stored, and the tabs stay open for you to close.

Signing in to the browser extension: you sign in inside the extension itself, with your email and password or with “Continue with Google”. With Google, Chrome opens our own sign-in page in a small window; Google tells us only your verified email and name, as on the website, and we never see your Google password. We then give the extension its own sign-in token, kept in the extension's storage on your device. We store only a one-way hash of it, with a label for the browser (for example “Chrome on Windows”), the IP address it was issued to, and when it was created and last used. It works only for the extension's own requests, expires after 30 days without use, and ends when you sign out in the extension, disconnect it at Settings → Security, change your password, or delete your account.

Operational metadata: IP address, user-agent, timestamps for every sensitive change (audit log). Sparingly used for security and abuse-detection.

2. How we use it

To run the dashboards, KPIs, alerts, GSTR-1 generation, and Saarthi answers.
To compose the morning brief and surface anomalies (low stock, return spikes, reimbursement opportunities, settlement mismatches).
To bill the subscription on the tier you selected.
To debug failures (audit log, server-side error monitoring).
Support access. If you ask us for help, or to fix a fault on your account, an authorised SMEMinds staff member may view your account as you see it, for up to 8 hours, read-only. Every such session is logged with the staff member's identity, and we email you when it starts. Staff cannot give or withdraw consent, make payments or delete anything on your behalf.

We do not sell your data, share it with Amazon / Flipkart / Myntra outside what those platforms' APIs require, share it with your CA, or use it to train public-facing AI models. The Saarthi system uses your data only to answeryour questions in your account.

3. Where it lives

Hosted on Microsoft Azure in India (Central India / Pune region). Your application data and database stay in Indian data centres. These are the services we send data to, and what each one receives:

Microsoft Azure OpenAI Service (Azure South India region) for Saarthi reasoning. We send the message you typed plus the relevant query results Saarthi needs to answer it, that includes your own business identifiers (GSTINs, ASINs, order IDs), rupee amounts, supplier names, and any text you yourself wrote into the conversation. We do not send payment-instrument data (we don't hold any). Microsoft processes this under a data-processing agreement; messages are not used to train public models. If you use the browser extension with page reading enabled, the page text you send with a question, and the summary of a file you attach, are sent to the same service, in the same region, for the same purpose, and on the same terms.
Screenshots and attached images are read by a separate vision model on the same Azure OpenAI resource in South India. That model runs as a Microsoft Global deployment: Microsoft keeps any data at rest in the resource's region in India, but the model itself may process the request in another Azure region, inside or outside India. Only the picture and your question are sent. We do not store them, and Microsoft does not use them to train models.
Voice Saarthi (a live voice conversation, when you start one) streams your microphone audio to our voice service in Azure Central India, which sends it to Microsoft Azure AI Speech (Central India) to be turned into text and turns Saarthi's reply into speech the same way. The text of your question is answered by the Azure OpenAI service described above, in India. Audio is processed in memory and never recorded or stored by us. A text transcript of both sides is saved in your conversation history (see Retention). Voice Saarthi needs voice consent, shows a notice before its first use, and can be switched off with the same voice toggle in Settings → Privacy.
Deepgram (United States) for voice transcription of in-app voice clips. Audio sent for transcription is processed outside India. Apart from this and the screenshots and images described above (which may be processed in another Azure region), nothing about your account leaves the country. Voice Saarthi audio stays in India. WhatsApp audio is not yet processed end-to-end.
Razorpay Software Private Limited (India) for subscription payments. Razorpay receives the order amount, the plan you chose and your email address to pre-fill their checkout. Your card, UPI or bank details are entered inside Razorpay's own window and never reach us. Razorpay sets its own cookies on its own domains, and only if you actually open checkout.
Microsoft Azure Application Insights (Central India) for error and performance monitoring. Receives error messages, stack traces and your seller id, so we can find a fault without asking you to reproduce it.
Microsoft Azure Communication Services for sending transactional email (sign-in links, receipts, alerts). Receives your email address and the message.
Google (only if you use “Sign in with Google”) for authentication. We receive your email address and a Google account identifier. There is no Google script on our pages.
Meta WhatsApp Business Cloud API for message delivery. Not currently active — the feature is built but switched off, so no data reaches Meta today. This line will stay here for when it is turned on.

That is the complete list as of the date at the top of this page. We do not run Google Analytics, Meta Pixel, Google Tag Manager, Hotjar, or any advertising or marketing tracker. We do not sell or share your data with data brokers.

Each is gated by contractual data-processing agreements and used only for the immediate operation. No cross-customer data sharing.

4. Retention

Audio uploads (in-app voice clips), processed in-memory for STT/TTS and not persisted as raw audio in our app database today. Voice Saarthi audio is never recorded; its text transcript is kept with your other conversations (30 days), and a usage record (when a voice conversation started and how long it lasted, no content) is kept for 13 months to meter your plan's voice minutes.
CSV uploads, the original raw file and the derived structured data (orders, returns, etc.) are retained while your account is active, so your historical analysis keeps working; both are deleted when you erase your account.
Free audit files, not retained at all. Read in memory, discarded when the result is returned. The per-IP request counter that stops abuse of the free audit is deleted once its one-hour window has passed, by the same daily job that enforces the rest of this list.
Account + business data, retained while your account is active. After you close it, we delete or anonymise within 30 days, except where retention is required by law (GST records: 6 years).
Free-trial record, to stop repeat free trials we keep a keyed one-way code made from your email, phone number or Google account ID for 24 months after your account is deleted. It is not linked to your account and is used for nothing else.
Saarthi conversations, retained 30 days from your last message in that thread, then deleted automatically. This was missing from earlier versions of this page, which left the impression that chats were kept indefinitely. They are not.
Audit log, retained 24 months. That is our own commitment, made so that we can answer “who touched this account and when” long after the fact.

5. Lawful basis for processing

Under DPDPA §6 we process your data on the lawful basis of consent — for sign-up, billing, marketplace integrations, Saarthi conversations, error monitoring, abuse detection, audit-log retention, and any marketing communication. You give that consent per purpose, and you can withdraw any of it from Settings without affecting the rest.

The one thing we do without asking is comply with the law: retaining records a statute requires us to keep, and responding to a lawful request from an Indian regulator, court or law-enforcement agency. That falls under DPDPA §7(b)–(d) (performance of a legal obligation, compliance with a judgment or order).

We do not rely on any “legitimate interest” basis. India's DPDPA has no such ground — §7 is a closed list, and it does not include security, fraud prevention or analytics. If you have read a policy that claims otherwise, it was written against Europe's GDPR, not Indian law.

6. Automated decision-making (our commitment)

Saarthi uses LLM-driven analysis to surface recommendations (low stock, return spikes, reimbursement gaps, ad-spend anomalies). These are advisory, every recommendation is human-reviewable in /dashboard, can be dismissed or marked done, and produces no automated action against your marketplace account, your bank, or any third party without your explicit confirmation. We do not run automated pricing changes, automated PO creation, or any other action with legal or significant effect on you without a human-in-the-loop.

If at any point we add a feature with autonomous decisions of legal or significant effect, you will be notified at least 14 days in advance, the feature will be opt-in, and we will offer human review of any decision on request.

7. Your rights under DPDPA

Access (DPDPA §11). You are entitled to three things, and you can have all of them: a summary of the personal data we process, a summary of what we do with it, and the identities of everyone we have shared it with. The first is self-serve — Settings → Download my data exports it as JSON. The second is section 2 of this page. The third is section 3. For anything else, email privacy@smeminds.com.
Correction, completion and updating (DPDPA §12). Fix anything inaccurate, fill in anything incomplete, update anything that has changed. Most fields are self-serve in Settings.
Erasure, self-serve via Settings → Danger Zone → "Delete my account". A 7-day grace window starts on request; you can cancel any time before it ends. At day 7 the purger runs: your PII (name, email, phone) is anonymised; Saarthi conversations are hard-deleted; CSV uploads and raw storage objects are deleted. GST records are retained for the period the CGST Act §36 requires (72 months from the due date of the relevant annual return); audit logs and consent records are retained 24 months, which is our own commitment rather than a statutory minimum. If you can't access the Settings page (account locked, etc.), email privacy@smeminds.com from your registered email and we'll process within 30 days.
Withdraw consent, granular per-purpose toggles live at Settings → Privacy & Consent (Saarthi reasoning, voice STT, browser-extension page reading, marketing channels). For WhatsApp messages specifically, you can also reply STOP / UNSUBSCRIBE from the same WhatsApp number on file and we silence the channel immediately.
Grievance, our Grievance Officer is Maheshwariba Yadav, reachable at ecommerce@smeminds.com or at our registered office below. We respond within 30 days. That is the period we commit to and publish; the Act requires us to have a mechanism and to state its timeline, not to meet any particular number.
Nominate someone (DPDPA §14). You can name a person to exercise these rights on your behalf if you die or become unable to act. Email privacy@smeminds.com with their name and contact details and we will record it against your account.
Complain to the Data Protection Board of India (DPDPA §13). If our Grievance Officer does not resolve your complaint, or does not respond within the 30 days above, you may take it to the Board. The Act asks you to use our mechanism first, so please write to the Grievance Officer before escalating. The Board publishes its complaint channel at meity.gov.in; we will update this link when the Board publishes a direct one.

7a. If there is a security incident

For your own account data — your name, email, WhatsApp number, GSTIN, business address — SMEMINDS LLP is the Data Fiduciary. If we become aware of a personal data breach affecting it, we will tell you and the Data Protection Board of India, as DPDPA §8(6) requires. We aim to notify you within 24 hours of confirming the breach, with what we know at that point rather than waiting for a complete picture.

For the buyer data inside the marketplace reports you upload, you are the Data Fiduciary and we are your Processor. In that case we notify you within 24 hours and support your own notification. That split is set out in the Data Processing Agreement.

7b. Significant Data Fiduciary status

SMEMINDS LLP has not been notified as a Significant Data Fiduciary under DPDPA §10. If that changes, the additional obligations that follow — an India-resident Data Protection Officer, a data protection impact assessment and an independent data auditor — would apply, and we would publish the DPO's details on this page.

8. Children

Saarthi is for businesses. We do not knowingly process data of children under 18. If you believe a child has signed up, contact privacy@smeminds.com and we'll delete the account.

9. Changes to this policy

We'll email registered users at least 14 days before any material change takes effect. The date at the top of this page reflects the most recent version.

10. Contact

SMEMINDS LLP, A2/306 Sundaram Status, Opp. Swapna Shrushti, Bhestan, Surat - 395023, Gujarat, India · ecommerce@smeminds.com