Data retention policy
Darwinbox retains personal data for as long as is necessary to fulfil the service requested, determined on a case-by-case basis with the goal of retaining personal data for the shortest time possible. Retention is conducted in compliance with CCPA, CPRA, and GDPR principles.
Data archiving and removal policy
Darwinbox does not retain personal data beyond what is necessary to fulfil the purpose for which it was collected. Upon a valid data subject erasure request (Right to Erasure under GDPR / Right to Delete under CCPA), Darwinbox will process deletion within the timelines mandated by the applicable regulation — 30 days for GDPR requests and 45 days for CCPA requests. For enterprise customer data, the customer (as Data Controller) defines and is responsible for the deletion policy; Darwinbox will act on customer instructions as the processor.
Data storage policy
Darwinbox stores personal data securely using technical and organizational measures appropriate to the risk of processing. Quarterly reviews and periodic internal audits are conducted to ensure compliance with data protection principles. For cross-border data transfers, Transfer Impact Assessments and Standard Contractual Clauses (SCCs) are implemented before any transfer is executed. Darwinbox does not sell any personal data collected or processed under its privacy policy.
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
yes
LLM model(s) used
OpenAI GPT-4.1, accessed via Microsoft Azure AI Foundry (Azure OpenAI Service).
LLM retention settings
We use real-time inference only with no retention by LLM provider
LLM data tenancy policy
Multi-tenant architecture with logical isolation by tenant ID on shared infrastructure. GPT-4.1 inference runs within Darwinbox's Azure subscription — prompt and completion data stays subscription-scoped, inaccessible to other customers or OpenAI.
LLM data residency policy
Data residency is enforced through Azure OpenAI regional/Data Zone deployment. Prompts, completions, and embeddings are processed and stored within the configured Azure region [specify, e.g., Central India / a Data Zone].