Privacy Policy

Rithvik Mysore Suresh (Bloomington, Indiana, United States) is the Data Fiduciary for personal data processed through Mitra, as that term is used in India's Digital Personal Data Protection Act, 2023 (“DPDP Act”). Questions or requests: mitracontentsupport@gmail.com.

• Card numbers, UPI PINs or bank credentials — Razorpay handles payments; we only receive the outcome.
• Your YouTube password, or permission to upload, edit or delete anything on your channel.
• Advertising or cross-site tracking data. We don't run ads or third-party analytics trackers, and we don't sell personal data.

Mitra uses YouTube API Services. Mitra's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google and YouTube data only to provide the features you see in Mitra.
• We don't sell it, use it for advertising, or let humans read it — except with your permission (for example, a support request), for security, or where the law requires.
• We don't use it to train general-purpose AI models.

Google's handling of your data is described in the Google Privacy Policy. You can remove Mitra's access at any time from Connections or your Google account permissions page.

We share personal data only with service providers that help us run Mitra, under contracts that limit their use of it:

We use Anthropic under its commercial API terms, which at the time of writing state that Anthropic doesn't train its models on API inputs and outputs by default. We may also disclose data if required by law or to protect the rights and safety of users, or as part of a merger or acquisition, in which case this policy continues to apply.

Mitra is operated from the United States, and some providers, including Google and Anthropic, also process data outside India. We transfer data only as permitted under the DPDP Act and any restrictions notified by the Government of India, and protect it the same way wherever it's processed.

• Account data — until you delete your account.
• YouTube tokens and channel name — until you disconnect YouTube or delete your account.
• YouTube analytics and comments — a recent copy is kept encrypted (refreshed every 1–24 hours) and deleted after 7 days, when you disconnect YouTube, or when you delete your account. It lets pages load fast and keeps your dashboard working if YouTube is briefly unavailable.
• AI results — kept for up to 24 hours so asking the same thing again is instant and free, then deleted. We don't keep your prompts. Our AI provider may keep requests for a limited period under its own terms.
• AI usage log (feature, model, token counts, cost — no content) — until you delete your account.
• WhatsApp number — until you disconnect WhatsApp or delete your account. Sending STOP pauses reports but keeps the number so you can resume with START.
• Reports we sent (including the data behind the PDF version) — 90 days, then deleted. PDF download links expire after 30 days.
• Sign-in sessions — expire after 30 days or when you sign out.
• Usage counts and subscription records — until you delete your account. Payment records held by Razorpay, and any records we must keep for tax purposes, are retained for the period the law requires.

We use no advertising or analytics cookies, so there's nothing to opt out of.

Under the DPDP Act and other applicable law you can:

• Access a summary of your personal data and how it's processed;
• Correct or update inaccurate data;
• Erase your data — use “Delete my account” on the Plan & billing page, or email us;
• Withdraw consent — disconnect YouTube or delete your account at any time. This doesn't affect processing that already happened;
• Nominate someone to exercise your rights if you die or become incapacitated;
• Complain to our Grievance Officer (see Contact), and if you're not satisfied, to the Data Protection Board of India.

Email mitracontentsupport@gmail.com from your account email address. We respond within 30 days.

We use HTTPS, encrypt YouTube tokens at rest (AES-256-GCM), store only hashes of session tokens, and limit access to production systems. No system is perfectly secure; if a breach affects your personal data, we'll notify you and the Data Protection Board as the law requires.

To invite creators to Mitra, we look up public YouTube channel information through YouTube's official API: channel name, public statistics, recent video titles, and any business email or link the creator published in their channel description. We use it only to send a small number of personal invitations. If you don't want to hear from us, reply “stop” or email mitracontentsupport@gmail.com: we'll mark you as do-not-contact and won't write again. We never buy contact lists.

Mitra is for people aged 18 and over. We don't knowingly process children's data; if you believe a child has signed up, contact us and we'll delete the account.

If we change this policy in a way that affects how we use your data, we'll notify you by email or in the dashboard before the change takes effect, and ask for fresh consent where the law requires.