Privacy Policy & Data Governance

1. Data Controller Identification

This Privacy Policy governs the processing of technical, telemetry, and personal data by SKOPAQ AI PRIVATE LIMITED ("SKOPAQ", "we", "us", or "our"), a company incorporated under the laws of India with Corporate Identification Number (CIN) U62011TS2026PTC220462 and registered office in Hyderabad, Telangana, India. Communications regarding this policy may be directed to [email protected] or [email protected].

2. The Zero-Training Guarantee

We never train artificial intelligence or foundation models on customer spacecraft telemetry, operational manuals, FMECA matrices, or incident records. Jantar runs as a multi-tenant service in which records, graph reads and approvals are scoped to the caller’s tenant. The hosted production service reasons with Google Gemini 3.7 Flash on Vertex AI through Google Cloud’s global endpoint: investigation prompts, including telemetry values and channel names, may be processed in any Google Cloud region under Google Cloud’s terms for Vertex AI, and every drafted claim is still checked against the spacecraft’s own documents and knowledge graph before it can be released. Airgap deployments always reason locally with the deterministic model and send nothing.

3. Egress Identifier Redaction

When egress redaction is enabled (it is off by default), the spacecraft and tenant identifiers of an investigation are replaced with stable, salted hash pseudonyms before a prompt is sent to a hosted model, and restored in the response within Jantar’s own process. Telemetry values and channel names are not redacted, because the grounding checks depend on them.

4. Alignment with India’s DPDP Act 2023

Jantar is designed to align with the Digital Personal Data Protection Act, 2023 (India). This posture is self-attested and has not been independently audited; applicability of specific obligations has not been formally assessed.

• Data Sovereignty: Cloud data is stored in Google Cloud’s Mumbai region (asia-south1); investigation prompts go to the hosted model described above. The platform is deployable within MeitY-empanelled sovereign cloud infrastructure.
• Right to Erasure & Rectification: Operators may request deletion of account profiles and casefiles upon termination of service; deletion is carried out by SKOPAQ on request, and self-service deletion tooling is roadmapped. Where per-tenant encryption is enabled, revoking the tenant key renders its encrypted records unreadable. Audit-ledger entries are append-only and are not removed; where a retention window applies, their content is redacted while the hash chain stays verifiable.
• Encryption at Rest: In our Google Cloud deployment, stored data is encrypted at rest by Google Cloud’s default encryption. Per-tenant envelope encryption of record payloads is available as an opt-in deployment setting, with keys held in HashiCorp Vault, AWS KMS, or a locally managed key. Customer-managed Google Cloud KMS and on-premises HSM keys are not currently supported.

5. Telemetry & Log Retention Periods

Raw telemetry is loaded into memory for the duration of an investigation and is not retained by the triage engine beyond it; in-process pass and alert histories are bounded by count, not by time. Investigation records and audit traces are append-only: no update or delete path exists on the audit trail, and the compliance ledger is hash-chained. Retention windows for the compliance ledger are off by default and are set per deployment or contract; when a window is configured, expired entries have their content redacted while the chain remains verifiable.

6. CERT-In Directions 2022: Log Retention & Clock Discipline

Jantar is designed to align with the Cyber Security Directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B of the Information Technology Act 2000. Cybersecurity event logs, authentication transactions, and administrative access records are retained within India for a 180-day target; write-once object-lock retention is roadmapped. Clock discipline is provider-managed NTP on Google Kubernetes Engine; NPL/NIC time synchronisation is available for on-premise deployments. This posture is self-attested and has not been independently audited.

7. IN-SPACe Lawful Interception (Section B.19)

Jantar does not currently include a Lawful Interception Management System. A design note on what a provision under Section B.19 of the IN-SPACe SSA Guidelines (IN:ISP2023:NGP-SSA:2026/V1.0) could look like has been prepared; whether Section B.19 applies to SKOPAQ is under review by counsel.

8. Contact & Grievance Redressal (DPDP Act 2023)

For privacy inquiries, audit requests, or grievance redressal under Section 13 of the Digital Personal Data Protection (DPDP) Act 2023:
Data Protection Officer (DPO) & CISO
SKOPAQ AI PRIVATE LIMITED
Hyderabad & Bengaluru, India
Email: [email protected] · [email protected]

9. Cookies, Browser Storage & Website Analytics

Public pages. jantar.space — including the pricing page, /try and the public demo at /demo/ — sets no cookies.

Signing in to the console. Our sign-in service (Keycloak) sets strictly necessary cookies while you sign in (AUTH_SESSION_ID, KC_AUTH_SESSION_HASH, KC_RESTART) and session cookies while you are signed in. They exist only to keep you signed in, not to track you. If you sign in with Google, Google sets its own cookies under Google’s privacy policy.

Browser storage. The console keeps your sign-in token in your browser’s session storage (cleared when you close the tab) and your display preferences (theme, sidebar, workspace) in local storage. Neither is sent to us.

Website analytics. We use Cloudflare Web Analytics to count page views and measure page speed. Cloudflare states that it uses no cookies or local storage for this and does not fingerprint visitors. It records the page address, the referring page, your browser and operating system, your approximate country and page-load timings. Cloudflare processes this on our behalf.

Cloudflare also delivers and protects this website (content delivery, security filtering and the secure connection to our servers). Like any such service, it processes your IP address and request details to do so.

10. Requests made through this website

When you ask for a demo, a sandbox or a quote, the form sends us your name, your email address, optionally your organisation and message, and the choices you made in the guided request (what you run, which page you sent it from). We use these only to answer your request and to follow up on it, and only after you have agreed to that on the form. They are delivered to our team mailbox through Cloudflare’s email service; nothing you type into the form is stored on jantar.space itself. We keep a request for 24 months after our last contact with you, then delete it. You can withdraw your consent or ask us to delete your request sooner at [email protected]; withdrawing is as easy as giving it.