Privacy Policy

TL;DR

• We collect only what we need to run Inherent.
• Your data stays yours.
• We do not sell it.
• We do not use your content to train AI models, whether ours or anyone else's.
• We protect it like adults.
• We keep your data as long as your account is active; expired trials are deleted after a grace period of at least 30 days, and we keep a cancelled paid account's content for now rather than deleting it, but we will email you before we ever start deleting it automatically.

Now the details.

Who Is Responsible for Your Data

Billion Brains Research (OPC) Pvt Ltd, registered in Bengaluru, Karnataka, India, operates Inherent and is responsible for the data described in this policy. For your account information and the data our website collects, we act as the controller, or the Data Fiduciary under India's Digital Personal Data Protection Act, 2023. For content you upload or connect to Inherent, the picture is different: you, the customer, are the controller, and Billion Brains Research is the processor, or the Data Processor, acting only on your instructions under our Terms of Service.

This split matters because it decides who answers what. If someone asks us to delete a document that lives inside your workspace, we point them to you, because you control that content. If someone asks us about their own account record, such as their name or email on file, we handle that request directly, because that is data we control.

What This Policy Covers

This policy covers inherent.sh, app.inherent.sh, api.inherent.sh, docs.inherent.sh, the Model Context Protocol (MCP) endpoint, and the emails we send you. It applies whether you are browsing the marketing site, running the hosted product, or calling our API or MCP endpoint from your own tools.

It does not cover the third-party sources you choose to connect, such as Notion, Confluence, Slack, Zendesk, Jira, GitHub, Google Drive or a connected Postgres database. Those tools have their own privacy practices, and connecting them to Inherent does not change how they handle your data on their side.

Information You Give Us

You may share the following with us:

• Account information: your name, email address, organisation, and a profile image if your sign-in provider gives us one.
• Content you upload or connect: documents, files, and data from the sources you choose to link to Inherent.
• Workspace settings and configuration choices.
• Support messages: anything you send us when you ask for help or give feedback.
• Billing details: these go directly to Paddle, our payments provider. We never see your full card number. We receive only your subscription status and, where Paddle shares it, the card's last four digits and brand.

You control what you upload. We do not go looking for extra data. If you connect a source like Slack or Google Drive, we only ingest the content you have given that connection permission to read, and we index it for retrieval, not for any other purpose.

Information We Collect Automatically

Some information is generated just by using the service:

• Server logs, including IP address, user agent, timestamps, and the request paths you hit.
• API and MCP usage metrics, so we can see how the service is performing.
• Error reports, so we can find and fix bugs.
• Product analytics, but only with your consent: we use PostHog and Google Analytics (GA4) for this.
• Cookieless web analytics from Ahrefs, which runs by default without asking for consent because it does not use cookies or persistent identifiers.

We use this automatically collected information to keep Inherent reliable and secure, to debug problems when something goes wrong, and to understand, in aggregate, how the product is used so we can prioritise what to build next. We do not use server logs or usage metrics to build advertising profiles.

How We Use Your Information

We use your information to:

• Run and improve Inherent.
• Store and retrieve your content exactly as you request.
• Power workflows and integrations you enable.
• Communicate important updates or respond to support requests.
• Monitor performance, reliability, and security.
• Meet legal or regulatory requirements.
• Send transactional emails, such as a trial-ending notice, a data-deletion warning, a payment-failed alert, or a receipt.
• Detect abuse and enforce fair use of the service.

We do not sell your data.

We do not use your content to train AI models, whether ours or anyone else's.

AI Processing

When you use retrieval, chat, or deep-retrieval features, your query and the relevant content are sent to third-party AI model providers for inference. That transfer is transient: it happens only to serve your specific request, and it takes place under contracts that forbid those providers from training on your data.

We choose these providers carefully and review the protections they offer before we send them any customer content. If we ever switch providers, the same standard applies to the new one: transient use only, no training on your data, and no use beyond serving the request you made. Under our contracts, these providers may not retain your content to train their models or use it for their own purposes.

Sub-Processors and Service Providers

We rely on a small set of specialist providers to run Inherent, and each one only receives the category of data it needs to do its job. Here is the current list:

We keep this list up to date on this page, and we email subscribers when we add a sub-processor that handles customer content.

Where Your Data Lives and International Transfers

Customer content and databases are hosted in Germany, within the European Union. We chose EU hosting deliberately, since it gives customers strong, well-understood data protection guarantees regardless of where they are based.

Some of the providers listed above are located outside the EU and outside India. Where we transfer personal data to them, for example for authentication, payments, transactional email, or AI inference, we rely on those providers' Standard Contractual Clauses or equivalent safeguards. Our company itself is based in India, so our support staff may access account and content data from India, under access controls that limit who can see what and log when they do.

How Long We Keep Data

We do not keep data longer than we need to. Specifically:

• Active accounts: we keep your data for as long as your account exists, so the service keeps working the way you expect.
• Expired trials: after your trial ends without a paid subscription, we keep your data for a grace period of at least 30 days and email you a warning before deletion. Once that grace period passes, your documents, workspaces, conversations, API keys, and connections are permanently deleted, and the account record itself is anonymised.
• Cancelled paid accounts: after your paid period ends, we keep your content rather than deleting it, so it stays retrievable: you can download your documents individually from the dashboard, and you can email support [at] inherent.sh to ask us to export everything for you or to delete it. We have not built an automated deletion schedule for cancelled paid accounts, and we will give you notice by email before we implement and run one.
• Backups: backups expire on their normal schedule regardless of when the underlying data was deleted, so a deletion can take a little longer to fully clear from backup storage.
• Logs: application logs are kept for up to 5 days. We may keep logs related to a security incident for longer, so we can investigate properly and tell affected customers what happened.
• Billing records: we keep these for as long as tax law requires, and Paddle holds the underlying transaction records as our Merchant of Record.

How We Protect Your Data

Security is not optional. We use standard, battle-tested safeguards, including:

• Secure storage environments.
• Encryption while data is moving and while it is stored.
• Strict access controls, applied on a least-privilege basis so people only see what their role requires.
• Ongoing monitoring and internal security practices.
• Daily backups, so we can recover from an incident without losing your work.
• Sign-in handled by Clerk: we never see your password.

If we ever discover a personal data breach that affects your content, we will notify you without undue delay, and we will tell you what we know and what we are doing about it as our investigation progresses.

Website Analytics and Cookies

We use Ahrefs Web Analytics for lightweight, cookieless website measurement. Ahrefs reports aggregated traffic trends without cookies or persistent identifiers by default.

With your permission, we also use Google Analytics 4 (GA4) and PostHog to understand visits, landing-page engagement, and conversion funnels. These optional tools may use analytics cookies or browser storage and do not initialize until you allow analytics.

You can decline optional analytics or reopen the analytics settings control to change your choice.

Your Rights

Depending on where you live, you can:

• Access your information.
• Correct inaccurate data.
• Export your data.
• Request deletion of your account or content.
• Restrict certain types of processing.
• Object to processing carried out on certain legal grounds.
• Ask for portability of the data you gave us.
• Withdraw consent for anything we process on that basis, such as optional analytics.
• Complain to a supervisory authority in the EU or UK, or to the Data Protection Board of India, if you believe we have mishandled your personal data.

We answer rights requests within 30 days. Email support [at] inherent.sh to get started. We may need to verify your identity before we act on a request, so that we do not hand over or delete someone else's data by mistake.

If content lives inside a customer's workspace, and you are not the account holder, we will usually direct your request to the customer, since they are the controller for that content, and we act on their instructions.

Grievance and Data Protection Contact

For matters under India's Digital Personal Data Protection Act, our Grievance Officer is reachable at Billion Brains Research (OPC) Pvt Ltd, Bengaluru, Karnataka, India, by email at legal [at] inherent.sh. We use the same contact for GDPR-related enquiries from customers and data subjects in the EU and UK. Write to us there if you want to escalate a concern about how we have handled your personal data, or if you need a signed Data Processing Agreement or Standard Contractual Clauses for your own compliance records.

Children

Inherent is built for business use, not for children. It is not intended for anyone under 18, and we do not knowingly collect personal data from anyone under that age. If we learn that we have collected personal data from someone under 18, we delete that account and the associated data.

Changes to This Policy

We may update this policy from time to time, as our practices, providers, or the law change. If a change is material, meaning it meaningfully affects how we collect, use, or share your data, we will tell you by email or in-app before it takes effect. Smaller clarifications may be made without individual notice, but the effective date at the top of this page always reflects the current version, so you can see at a glance whether anything has changed since you last read it.

Contact Us

Questions, concerns, or something unclear? Email support [at] inherent.sh for general help with your account or data, or legal [at] inherent.sh for legal and data-protection matters. For postal enquiries, write to Billion Brains Research (OPC) Pvt Ltd, Bengaluru, Karnataka, India.