Legal

Privacy Policy

Last updated September 29, 2026

The short version: we don't log what you send to Wity or what it answers, and we never train on it or sell it. We keep the minimum needed to run, secure and bill the service. This page explains exactly what that is.

Who we are#

This policy covers the Wity website, the Playground, the console and the Wity API (together, the “Service”), operated by AlphaNimble Technologies LLP (“we”, “us”), No 114/1, 5th Floor, Sai Complex, Mahatma Gandhi Road, Ashok Nagar, Bengaluru, Karnataka 560001, India. It applies wherever you use the Service from. It does not cover Wity deployed on your own premises: there, the model runs inside your network and your data never reaches us.

Our two roles#

For your account, billing, emails and website use, we decide how your personal data is used. We are its controller (a “data fiduciary” under India's Digital Personal Data Protection Act, 2023).
For the content you send to the API, you decide what goes in and why. We process it only on your instructions, to produce the response. For any personal data in it, you are the controller and we are your processor. A data processing agreement (DPA) is available on request.

If a company uses Wity to process your data and you want to exercise your rights, please contact that company. We will help them respond.

What you send to the API#

The state, instructions, options, images and other content in your requests, and the answers Wity returns (together, “Content”), are processed only to produce the response.

Request and response bodies are never logged or written to disk. The model server may keep recent requests in a temporary in-memory cache to answer repeats faster. Later requests overwrite it, and it is cleared when the server restarts.
When sessions arrive, a session will hold the context you add to it only while it is open, so later calls can build on it. That context will not be kept once the session ends or expires.
We do not use your Content to train or improve models.
We do not look at your Content, except when you send it to us yourself, for example to report a problem.
These rules also apply to requests that reach Wity through platforms that resell it with our agreement. What the platform itself does with your data is covered by its own privacy policy.

What we do collect#

Operational records

every API and console call

Which key and account made the call, when, the endpoint, its status, how many questions it had, the reasoning setting, the token counts, how long it took and what it cost. Never the text or images. We use these to run the Service, stop abuse and bill you.

Account details

when you sign up

Your email address and the organisation your account belongs to. If you sign in with Google, the name and profile picture Google shares. Our sign-in provider also records sign-in events, IP address and browser details to keep accounts secure.

API keys

when you create one

A one-way hash of each key, its first few characters, its name, and when it was created, last used and revoked. We never store the full key.

Payment records

when you buy credit

The amount, currency, status and Razorpay order and payment IDs, plus your credit history. Razorpay collects your card details, email address and phone number directly in its checkout. We never see or store your card details.

Correspondence

when you email us

What you write to us and our replies.

Site analytics

when you visit the website

Vercel Web Analytics records page views, and Vercel Speed Insights measures page load performance. Neither uses cookies. Visitors are counted with a hashed identifier that changes every day, so we cannot identify you or follow you across sites.

Playground rate limiting

when you run the Playground

Your IP address, to limit how many runs one visitor can make in a few minutes. It is held in memory only, never written to disk, and cleared when the server restarts.

What we never do#

Train or improve models on your Content.
Sell personal data, or share it for advertising.
Use advertising or cross-site tracking cookies.
Log request or response bodies.
Build profiles of you or make automated decisions about you that have legal or similarly significant effects.

Why we use it#

Where the GDPR or a similar law applies, these are our legal bases:

Providing the Service

performance of a contract

Creating your account, answering your API calls, keeping your balance and charging usage.

Security and abuse prevention

legitimate interests

Rate limiting, bot checks, investigating misuse and protecting the Service and its users.

Improving the Service

legitimate interests

Using operational records, never Content, to plan capacity and fix faults.

Service messages

performance of a contract

Sign-in codes, receipts, and notices about your account or changes to the Service.

Accounting, tax and legal duties

legal obligation

Keeping payment records and answering lawful requests.

Site analytics

legitimate interests

Counting page views and measuring load times, to improve the website.

Correspondence

legitimate interests

Answering your emails and keeping a record of support requests.

Marketing emails

consent

We do not send them today. If we start, we will only send them to people who opt in.

Under India's Digital Personal Data Protection Act, we process personal data for the purposes above with your consent, given when you create an account, or for the legitimate uses the Act allows. You can withdraw consent at any time. If you do, we will stop the processing that relies on it, which may mean closing your account.

Cookies and browser storage#

We use only storage that the Service needs to work. We use no advertising, analytics or cross-site tracking cookies, so we do not show a cookie banner.

Sign-in cookies

cookies · console

Set by Clerk, our sign-in provider, to keep you signed in and protect sign-in from bots.

wity-sidebar

cookie · console · 1 year

Remembers whether you collapsed the console sidebar.

wity-theme

local storage · console

Remembers whether you chose light or dark mode in the console.

wity-console-v3

local storage · console

Your current Playground draft and up to 200 recent runs, including their text, images and answers. It stays in your browser and is never sent to us. You can delete runs in the console or clear your browser storage.

wity_ref

cookie · 30 days

Set only when you open a link in an email from our team. It holds a random code from that link (not your name or address) so we can tell that the email led to your sign-up. It is saved with your account when you sign up and then removed; otherwise it expires after 30 days.

wity_referral

cookie · 30 days

Set only when you open a Wity user's referral link. It holds the short code from that link so the account you make is credited to the person who shared it, and you both get the referral credit. It expires after 30 days.

wity:hero-intro, wity-auth-resume

session storage

Remember that you saw the home page intro, and resume sign-in after a redirect. Cleared when you close the tab.

Razorpay's checkout window, which opens only when you pay, may use its own cookies and storage under its own policy. If we ever add cookies that are not strictly necessary, we will ask for your consent first and update this page.

We use these service providers to run the Service. They process personal data only on our instructions and only to provide their service to us.

Vercel

Singapore and global edge

Hosts the website, the Playground and console backend, and the analytics described above.

Railway

Singapore and United States

Runs the API gateway in Singapore, and the database in the United States that holds accounts, keys, operational and payment records.

Vast.ai

Provides the GPU server that runs the model. Content passes through it only to produce the response.

Clerk

United States

Runs sign-up and sign-in, sends sign-in codes by email, and checks sign-ups for bots.

Cloudflare

global

Runs the bot check inside Clerk's sign-up (Turnstile). It sees your IP address and browser details.

Razorpay

India

Processes card payments for credit. Its checkout collects your card details, email address and phone number.

If you choose to sign in with Google, Google handles that sign-in under its own privacy policy and shares your basic profile with us.
Platforms that resell Wity, such as API marketplaces, are independent. They handle your account and billing with them under their own policies, and pass your requests to us.
We may disclose information when the law requires it, or to protect the Service and its users from fraud or abuse.
If Wity is involved in a merger, acquisition or sale, this policy continues to apply to data transferred as part of it.

We keep this list current. Customers with a DPA are told about new providers before they start processing Content.

International transfers#

We are based in India. Our API gateway runs in Singapore, and our database and sign-in provider are in the United States, so your data may be processed outside your country. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses and our providers' data processing terms. If your data must stay in your own environment, talk to us about an on-premises deployment.

How long we keep it#

Content: never logged or written to disk. It stays only in the model server's in-memory cache until overwritten.
Operational records, API keys and account details: while your account is open, then deleted.
Payment records: 8 years, as Indian accounting and tax law requires.
Correspondence: 1 year after the last message.

Our Data Retention Policy gives every period in full, including logs and backups.

Security#

All traffic to the website and the API is encrypted in transit with TLS.
API keys are stored only as one-way hashes. The full key is shown once, when you create it.
The GPU server has no public HTTP port. The API gateway reaches it through an encrypted tunnel that can only forward to the model server.
The API gateway writes no access logs, and production access is limited to the people who run the Service.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authorities without undue delay, as the law requires.

Your rights#

Depending on where you live, you have some or all of these rights over your personal data:

Access it, and get a copy in a portable format.
Correct or complete it.
Delete it, including closing your account.
Object to or restrict how we use it.
Withdraw consent where we rely on it.
Nominate someone to exercise your rights if you die or become unable to (India).
Complain to us, and then to a regulator.

To use any of them, email wity@alphanimble.com from the address on your account. We may ask you to confirm your identity. We respond within 30 days. There is no charge unless a request is clearly unfounded or excessive.

Where to complain

India: our Grievance Officer (below), and then the Data Protection Board of India.
European Economic Area and United Kingdom: the data protection authority where you live or work, or the UK ICO.
Elsewhere: the data protection authority in your country, if there is one.

California and other US states

If you live in California or another US state with a privacy law, you can ask to know, correct and delete the personal data we hold about you. We do not sell or share personal data for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. We will not treat you differently for using your rights. An authorised agent may make a request for you if we can verify their authority.

Automated decisions#

We do not use Wity or anything else to make decisions about you that have legal or similarly significant effects. Customers who use Wity to make decisions about other people are responsible for those decisions and for the rights of the people affected.

Children#

The Service is for developers and businesses and is only for people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.

Grievance Officer and contact#

For questions, requests or complaints about privacy, contact our Grievance Officer at wity@alphanimble.com, or write to Grievance Officer, AlphaNimble Technologies LLP, No 114/1, 5th Floor, Sai Complex, Mahatma Gandhi Road, Ashok Nagar, Bengaluru, Karnataka 560001, India. We respond within 30 days.

Changes#

We will post changes here and update the date above. If a change materially reduces your privacy, we will email account holders before it takes effect. Customers with a DPA are also told about changes as the DPA sets out.

Questions about this page? Write to wity@alphanimble.com.