Privacy Policy

We collect the following categories of data:

• Account information: name, email address, and authentication details provided when you sign up.
• Form content and responses: the forms you build and the responses submitted by respondents to those forms.
• Payment metadata: transaction identifiers, amounts, statuses, and timestamps received from our payment gateway when payments are made through published forms.
• AI prompts and chats: the messages you send to GrabUrPass AI and the form they refer to, which are processed to produce a result (see section 5).
• AI credit and purchase records: your credit balance, a count of AI messages used, and the credit packs or plans you bought.
• Usage and device data: an account ID (or a random anonymous ID if you are signed out), your account role, device and browser type, approximate location (city and country, derived from your IP address), and events such as which features you use. We use this to run, secure and measure the Service.
• Uploaded files: files you or your respondents upload through forms.

We never see or store card numbers, CVVs, UPI PINs, or net-banking credentials. All sensitive payment data is handled directly by our payment gateway partner on its PCI-DSS compliant infrastructure.

We use collected data to operate and improve the Service, authenticate accounts, deliver form responses to form owners, process payouts, provide support, and comply with legal obligations. We do not sell personal data.

We use cookies and similar technologies for authentication sessions, security, and remembering your preferences (such as theme). We also use your browser's local storage to keep a random anonymous ID (used for feature flags and analytics), your theme, and unsent form drafts on your device. You can control cookies and local storage through your browser settings; disabling essential cookies may prevent sign-in.

We share data only with service providers necessary to operate the Service:

• Our payment gateway partner — payment processing and settlement.
• MongoDB Atlas — database hosting for account, form, and response data.
• Vercel Inc. — application hosting.
• Google — sign-in (we receive your name, email and profile picture).
• Cloudflare R2 — storage for uploaded files. Uploaded files are served from public links, so anyone who has a file's link can open it.
• Statsig — feature flags and product analytics (account or anonymous ID, role, device and approximate location, and feature-use events).
• OpenRouter and the AI model provider it routes to — to run GrabUrPass AI (see section 5).
• Resend — sends email alerts you turn on for new responses. It receives your account email address and the form's title, never the responses.

Some of these providers process data outside India. We may also disclose data where required by law, court order, or to protect our rights and the safety of users.

When you use GrabUrPass AI, we send to the AI provider: your prompt, the earlier messages in that chat, the structure and text of the form you are editing (titles, descriptions, question labels and options, conditions and payment settings), and any current validation errors. We do not send respondents' submitted answers, uploaded files, or your payment or bank details.

These providers process the request to produce a reply and handle the data under their own terms and retention practices, which we do not control. Some may keep requests for a limited time, and some process data outside India. Our servers do not save your prompts or the AI's replies in our database; the chat stays in your browser until you close or clear it. We keep only a usage count so we can bill for credits and prevent abuse.

Please do not enter sensitive data. Do not put any of the following into a prompt, or into form text that you use with GrabUrPass AI: passwords, API keys or access tokens; card, bank or UPI details; government ID numbers (such as Aadhaar, PAN or passport numbers); health or medical information; biometric data; precise location; or other people's personal data. Use placeholders such as "Full name" instead of real details. AI output can be wrong, so review it before publishing.

If you do not want your form content processed by AI providers, simply do not use GrabUrPass AI. Building forms by hand does not send anything to them.

Under the Digital Personal Data Protection Act, 2023 and other applicable Indian law, you have the following rights over your personal data:

• Right to access: request a summary of the personal data we hold about you, the processing we carry out, and the identities of the third parties we've shared it with.
• Right to correction and erasure: ask us to correct inaccurate or incomplete data, or erase data we no longer need for the purpose it was collected for. We will comply unless we're required to keep it (for example, tax or accounting records, or an active dispute).
• Right to withdraw consent: withdraw consent for any processing that relies on it, at any time, as easily as you gave it. Withdrawal doesn't affect processing already carried out, or processing we're required to do for another lawful reason (such as fulfilling a contract with you or complying with law).
• Right of grievance redressal: raise a complaint with us (see "Grievance Officer" below); we aim to acknowledge it within 7 days and resolve it within 30 days. If you're not satisfied with our response, you may escalate the complaint to the Data Protection Board of India.
• Right to nominate: nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, by writing to us with the nominee's details.

To exercise any of these rights, contact us using the details in section 11 below. We may need to verify your identity before acting on a request.

Some of the service providers listed in section 4 process data outside India. The Digital Personal Data Protection Act, 2023 permits transfer of personal data outside India except to countries restricted by the Central Government; we do not currently transfer data to any such restricted country. Where a provider processes data abroad, it remains subject to that provider's own security and confidentiality obligations to us.

We apply industry-standard technical and organisational measures to protect your data. We retain data for as long as your account is active or as needed to provide the Service and meet legal obligations, after which it is deleted or anonymised. Purchase and invoice records are kept for as long as tax, accounting and other laws require.

If a personal data breach occurs that is likely to affect you, we will notify affected users without undue delay, in plain language, describing what happened, the likely impact, the steps we've taken, and who to contact for help. Where required by applicable law, we will also notify the relevant regulator, including the Data Protection Board of India.

GrabUrPass is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, our Grievance Officer is:

Name: GraburPass Support Team
Email: graburpass@gmail.com
Phone: +91 9946846101
Address: GraburPass, a product from Beond Innovations — Kerala, India

For privacy questions, email graburpass@gmail.com or visit our Contact page.