Privacy Policy

1. Introduction

Welcome to Chowdhury Duo ("we", "our", or "us"), operated by Sampad Chowdhury and Bharti Shaw. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit https://www.chowdhuryduo.in/ (the "Platform") and purchase or use our digital products and automation services.

By accessing or using the Platform, you agree to the practices described in this policy. If you do not agree, please discontinue use immediately.

2. Information We Collect

2.1 Information You Provide Directly

• Account registration data (name, email address) via Clerk authentication
• Payment information processed by Razorpay (we do not store card numbers)
• Gmail account credentials (App Passwords) you voluntarily provide for our Gmail AI Support Automation product — stored in AES-256-GCM encrypted vaults
• Business configuration, AI grounding rules, and support policies you enter in automation workspaces
• Messages, comments, and reviews you post on the Platform

2.2 Automatically Collected Information

• IP address, browser type, device identifiers, and referring URLs
• Pages visited, time on site, and interaction events (analytics)
• Session tokens and cookies necessary for authentication and security
• Server-side logs (retained for up to 30 days)

2.3 Third-Party Data

When you connect a Gmail account for automation, our system accesses your Gmail inbox via IMAP/SMTP solely to read, classify, and respond to customer-support emails on your behalf. We do not index, sell, or share the contents of your Gmail with any third party other than the AI model provider specified in Section 4.

3. How We Use Your Information

• Provide, operate, and improve the Platform and its features
• Process payments and fulfill digital-product orders
• Operate Gmail AI automation on your behalf under your explicit instruction
• Send transactional emails (order confirmations, receipts, support replies)
• Send marketing emails, if you have opted in (you may unsubscribe at any time)
• Detect and prevent fraud, abuse, and security breaches
• Comply with legal obligations

4. Third-Party Service Providers

We share data with the following service providers only to the extent necessary to deliver our services:

• Clerk — Authentication and user identity management. Clerk Privacy Policy
• Supabase / Neon PostgreSQL — Database hosting for your workspace data, automation configurations, and order records.
• Vercel — Platform hosting and edge CDN delivery. Vercel Privacy Policy
• Cloudinary — Media and file storage for product images and downloadable deliverables.
• Razorpay — Payment processing (India). Your card and bank details are processed directly by Razorpay and never stored on our servers. Razorpay Privacy Policy
• Brevo (Sendinblue) — Transactional and marketing email delivery. Your email address is shared with Brevo to send emails on our behalf.
• OpenRouter / AI Model Providers — When you use our Gmail AI Support product, email content (customer messages + your business grounding rules) is sent to AI model providers via OpenRouter for response generation. No personally identifiable customer data is stored by us beyond your workspace configuration.
• Google APIs — If you connect Gmail via OAuth, Google processes your authentication. If you use App Passwords via IMAP/SMTP, your credentials are encrypted at rest using AES-256-GCM.

We do not sell, rent, or trade your personal data to any third party for advertising or marketing purposes.

5. Data Retention

• Account data is retained for the lifetime of your account plus 90 days after deletion request
• Order records are retained for 7 years for tax and accounting compliance
• Gmail App Passwords are retained in encrypted form until you disconnect the account from the automation workspace
• Server logs are retained for up to 30 days
• Marketing email suppression lists are retained indefinitely to honour opt-out preferences

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access a copy of the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Object to or restrict certain processing activities
• Data portability
• Withdraw consent at any time without affecting prior lawful processing

To exercise any of these rights, email us at sampadchowdhury777@gmail.com.

7. Cookies & Tracking

We use strictly necessary session cookies for authentication and security. We also use analytics to understand aggregate traffic patterns. We do not use third-party advertising cookies. You can control cookies through your browser settings; disabling strictly-necessary cookies may prevent login.

8. Children's Privacy

Our Platform is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us data, please contact us immediately and we will delete it.

9. International Transfers

Chowdhury Duo is operated from India. By using the Platform, you consent to your data being processed in India and in other countries where our service providers operate. We take steps to ensure appropriate safeguards are in place for international transfers.

10. Security

We implement industry-standard security measures including AES-256-GCM encryption for credentials, bcrypt password hashing, HTTPS/TLS for all communications, and strict access controls. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Last updated" date and, where appropriate, by sending an email notification. Continued use of the Platform after updates constitutes acceptance of the revised policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data: