This page describes what personal data Elite.pankh.ai processes, why, where it lives, how long we keep it, and the rights you have over it. It applies to everyone who uses Elite.pankh.ai anywhere in the world; EEA / UK / Swiss customers also get the GDPR / UK GDPR / FADP protections specifically named below.
Elite.pankh.ai is built by Pankh AI Pvt Ltd. The data controller for personal data processed through Elite.pankh.ai is Pankh AI Pvt Ltd.
Account data
Email, name, hashed password, avatar — to identify you, sign you in, and let workspace teammates address you.
Workspace content
Records, emails, missions, attachments — processed on your behalf to deliver the product. We do not sell or share workspace content with third parties.
Operational metadata
Timestamps, IP at login, user-agent — for security audits and abuse prevention.
OAuth tokens
Gmail, Outlook, Slack (only if you connect them) — held encrypted at rest and used only to drive integrations you've explicitly enabled.
Contract performance
To deliver Elite.pankh.ai to you under our terms.
Legitimate interest
Security logging, abuse prevention, product improvement.
Consent
For optional analytics cookies and marketing emails.
Production data is hosted on Microsoft Azure. EEA / UK customers are provisioned to an Azure EU region. Data leaving the EEA is covered by Standard Contractual Clauses (SCCs).
Account data
Until you delete your account, then 30 days for backup expiry.
Workspace content
Same as account, governed by your workspace's retention.
Operational logs
90 days rolling.
Billing records
7 years (statutory).
Under GDPR / UK GDPR you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data.
Elite.pankh.ai uses third parties (Microsoft Azure, OpenAI, Anthropic, optional Google/Slack OAuth) to deliver core functionality. Each is bound by a Data Processing Agreement (DPA). Prompts sent to LLM providers may include workspace content you ask the agent to act on. We use providers' zero-data-retention APIs where available.
TLS in transit. AES-256 at rest. Secrets in a managed vault. Per-workspace isolation enforced at the database layer. Vulnerability reports go to security@pankh.ai.
Confirmed personal-data breaches are reported to affected users and the relevant supervisory authority within 72 hours of confirmation, in line with GDPR Art. 33-34.
Where workspace data must leave the EEA / UK (e.g., LLM inference in the US), we rely on the EU SCCs and equivalent UK addenda, plus the provider's own privacy program.
Material changes are communicated by email at least 14 days before they take effect. The current effective date is below.
You can exercise your technical rights directly from your account settings:
We'll respond to all rights requests within 30 days.
Have privacy questions or concerns?