Privacy Policy
Effective Date: November 1, 2026
1. Introduction
Datasiq ("Company", "we", "us") operates datasiq.com — a data operations platform that connects to the data sources you choose, measures and monitors their quality, and investigates data incidents. This Privacy Policy explains what information we collect, how we use, share and protect it, and the choices you have, under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 as their provisions come into force.
This Policy is our notice to you. Where we rely on your consent — today, only for optional analytics — we ask for it separately, through our cookie banner, and you can withdraw it at any time; withdrawing it does not affect processing that took place before.
2. Definitions (DPDP Act Aligned)
Personal Data: Any data about an individual who is identifiable by or in relation to that data.
Data Principal: The individual to whom personal data relates — for example, you, the user.
Data Fiduciary: The person who decides the purpose and means of processing personal data.
Data Processor: A person who processes personal data on behalf of a Data Fiduciary.
Processing: Any operation on personal data including collection, storage, use, sharing or deletion.
Consent: Free, specific, informed, unconditional and unambiguous agreement, given by a clear affirmative action.
Order form: A written order or agreement signed by you and Datasiq that sets out a specific service, such as a dedicated environment.
3. Our Role
Your account and use of the website: Datasiq is the Data Fiduciary for the personal data in your account (for example your name and email) and for data about how you use the Service.
Data in the sources you connect: For personal data contained in the databases, files and tools you connect, including questions and AI requests you make about that data, your organisation decides why and how that data is processed, and Datasiq processes it on your organisation's behalf, as its Data Processor, to provide the Service.
4. How Datasiq Is Delivered
Shared service (available today): The service at datasiq.com runs on infrastructure that Datasiq operates and shares between customers, with each organisation's records kept separate. Everything in this Policy describes this service unless it says otherwise.
Dedicated environment (only if your order form provides for one): A private, single-customer Datasiq environment that Datasiq runs in its own cloud account, on the cloud provider (Amazon Web Services, Microsoft Azure or Google Cloud) and in the region named in your order form. You use it through the web application only; you do not receive, install or operate the Datasiq software.
Connector (only if your order form provides for one): A small program that Datasiq deploys and operates next to your own databases, in the location you approve (for example inside your network), which connects only to the databases you choose and sends results to your Datasiq environment. You do not install, run or update it. See section 6.
Dedicated environments and the connector are being built and are not yet available to customers; they are described here so that you know how they will work. Datasiq does not offer on-premise, locally installed or offline (air-gapped) versions of the Service.
5. Data We Collect
Account Data: Name, email address and profile photo (through our authentication provider, Clerk, or through Sign in with Google), organisation name and business type. If your organisation sets up single sign-on, your organisation’s identity provider sends us your name and email. If you choose a free @datasiq.com mailbox during sign-up, the address you pick and your name are used to create it; we email you a one-time password for it and add the address to your sign-in account.
Connection Data: The details you give us to connect a source, such as host names, database names, user names and passwords or API keys. These are encrypted before we store them (see section 10). If you enable automated schema changes where they are offered, the separate credentials you give us for them, which can change table structure, are stored encrypted under a separate key.
Metadata and Measurements: Names of your sources, tables and columns, a few example values per column, row counts, quality measurements (counts, distinct counts, minimum, maximum, averages and similar statistics), issues found, lineage, and incident records.
Rows Read During a Sync: When a connected source syncs on the shared service, we read a limited sample of its rows to work out the metadata and measurements above, and then discard them: we do not store the rows themselves. For PostgreSQL, MySQL, SQL Server, Oracle, Snowflake and MongoDB: up to 100 rows from each of up to 5 tables or collections. For Google BigQuery: up to 100 rows from each of up to 5 tables in each of up to 5 datasets. For Stripe: up to 100 of your most recent charges, customers and products. For Shopify: up to 1,250 products and 1,250 orders. For REST API and GraphQL sources: up to 200 records. For Tally and Petpooja: up to 500 records of the report you choose. What we keep from them is described under Metadata and Measurements, including the few example values per column, which can contain personal data that is in the source. Row previews that were copied before we stopped storing rows are cleared on the source’s next sync.
Uploaded Files: Files you upload on the Upload page (such as CSV, Excel or JSON): the whole file, plus a copy of its first 50 rows and column statistics (including the most frequent values in each column). Files you add as a data source (CSV, Excel, JSON, XML or ZIP): the whole file, kept so the source can be re-synced, plus a copy of up to 500 rows (20 for JSON and XML). Google Sheets you import: up to 100 rows and column statistics.
Nyksen and AI Data: The questions you ask Nyksen, its answers, your conversation history, files and images you attach to a message, and facts Nyksen automatically saves from your conversations (memories).
Usage Data: Error reports (Sentry): the error, the address of the page or request, and your browser and operating system. Reports from your browser also include the steps just before the error: the pages you moved between, the page elements you clicked or typed in (described by their kind, ID, class names and label, title or name attribute; never their text or what you type), and the addresses of requests the page made to our servers. Reports from our servers also include the request’s headers and content, with passwords and other secrets removed, and sometimes your user ID. For a sample of requests to our servers, Sentry also receives performance traces: timings and request addresses. The text of database queries, including queries on your connected databases, is removed from them before they are sent. Each page load also sends Sentry a session signal, without page content, that counts visits with and without errors. Application logs (Better Stack): server events and errors, which can include your user ID, your organisation and source IDs, and the address of the request. Invitation and share-link codes, and sign-in codes in an address, are removed before anything is sent to Sentry or PostHog. Only if you accept analytics in our cookie banner: the address of each page you visit and of the page you came from, time on page and scroll depth, clicks, changes to form fields and form submissions, and a few product events. If you are signed in, these are linked to your account (user ID, email address, name, plan and sign-up date). All of this is sent to PostHog (section 15).
Device Data: IP address, browser type, operating system, cookies and session identifiers.
Communications: Messages you send us, support requests and feedback.
6. What Stays in Your Databases, and What Reaches Datasiq
Measurement runs inside your database where we support it. For sources where push-down measurement is supported and switched on, the quality checks are run as queries inside your own database and return totals and statistics, not rows.
What reaches us today on the shared service: the metadata and measurements described in section 5 (including a few example values per column); the file copies described in section 5; your Nyksen conversations and saved memories; and, for uploaded files, imported Google Sheets and files you attach to Nyksen messages, the data sent to our AI provider described in section 7. Rows from a connected source are read during a sync and then discarded; we do not store them, and previews copied before that change are cleared on the source’s next sync.
If your order form provides for a dedicated environment and the connector: the connector connects only to the databases you choose; it makes outbound, encrypted connections to your Datasiq environment and never accepts inbound connections; it performs only a fixed list of operations (it cannot run arbitrary queries sent to it); your database credentials stay in the location you approve; and if it cannot confirm that an operation is permitted, it refuses. The first version of the connector is read-only. The checks run inside your database, and only totals, metadata and — only if you approve them — small, capped previews reach your Datasiq environment. Raw rows otherwise stay in your databases. Datasiq deploys, operates, updates and removes the connector, in the location you approve; updates are applied automatically or with your approval, as your order form says, and without waiting for approval where needed for security or to keep working with the Service (Terms section 9). Where you agree in your order form, Datasiq may connect to Snowflake or Google BigQuery directly instead of through the connector.
7. AI Processing
Nyksen and our other AI features (for example written explanations of anomalies and forecasts) use a large language model. Quality scores and measurements are computed by our own code, not by an AI model. Some features — the automatic analysis of an uploaded file and pattern analysis — ask the AI model to describe quality issues, anomalies and patterns; those descriptions, and any figures in them, are AI-generated. Pattern analysis is not based on your rows (it receives only your column names and counts of outliers) and its figures may be illustrative rather than taken from your data.
Shared service today: AI features use Claude, provided by Anthropic, through its commercial API. Under Anthropic’s commercial terms, data sent through the API is not used to train its models.
What is sent: What a request needs: your question and conversation; names of sources, tables and columns; quality scores, issue lists, row counts and summary statistics, including the most frequent values in a column. For uploaded files and imported Google Sheets, rows are sent too: when you upload a file we automatically send its first 50 rows and its column statistics to produce an initial analysis (for an imported Google Sheet, 10 rows); reports, including scheduled reports each time they run, send up to 20 rows of the file; presentations send up to 15 rows; asking Nyksen about a file sends up to 25 rows of it, with its column statistics, with each message; uploading files from the chat screen automatically sends up to 10 rows of each; documents (up to 50,000 characters) and images you attach to a Nyksen message are sent in full; comparing files sends up to 5 rows of each; and a plain-English question about a file sends one example row. A file with 50 rows or fewer may therefore be sent in full. For connected databases and services we send metadata and statistics, not rows.
If you choose another model: Where your order form provides for it (this is not yet available on the shared service), you may choose instead the AI service in your own cloud account (such as AWS Bedrock, Azure AI Foundry or Google Vertex AI) or another model you connect through its API. That provider then processes the data sent to it under your own agreement with that provider, and its terms and privacy practices apply.
Dedicated environments: If your order form provides for a dedicated environment, AI features are switched off until you choose a model provider.
No silent fallback: We do not switch your AI requests to a different provider without your choice. If your chosen provider is unavailable, the AI feature stops working rather than sending your data somewhere else.
Customer-chosen models and switching AI off are not yet available on the shared service.
8. Purpose of Processing
- Providing and operating the Service, and improving it using data about how the Service is used. We use data from the sources your organisation connects only to provide the Service to your organisation.
- Identity authentication and account security.
- Data quality measurement, monitoring, incident investigation, comparison of your scores with stored industry reference ranges (these ranges are not built from other customers’ data), and AI-powered features including Nyksen.
- Transactional communications (for example security alerts, scheduled reports you set up, and service notices).
- Billing, once paid plans begin (no payment is taken today).
- Legal compliance.
- Preventing misuse of accounts and the Service.
We do not sell your data or use it for advertising, and we do not use your data to train AI models.
9. Grounds for Processing (DPDP Act 2023)
Consent (section 6): Optional analytics, and any other optional feature we ask you to opt into.
Personal data you voluntarily provide for a specified purpose (section 7(a)): Your account, the Service you signed up for and its security, including preventing misuse of your account, unless you tell us that you do not consent to that use.
Legal obligations, judgments and orders (section 7(d) and (e)): Where Indian law, or a judgment or order, requires us to process or disclose data.
Data in sources your organisation connects: We process it as your organisation’s Data Processor (section 3), and your organisation is responsible for the lawful basis.
10. Data Storage & Security
Database: Neon PostgreSQL (encrypted at rest by the provider).
File storage: AWS S3, in a private bucket, with each user’s files stored under their own path.
Authentication: Clerk.
Hosting: Railway (application servers) and Cloudflare Pages (website).
Dedicated environments: If your order form provides for one: a single-customer environment in Datasiq’s own cloud account, on the cloud provider and in the region named in your order form.
Security measures in place today:
- Passwords are handled by Clerk and are not stored by us.
- Encrypted connections (HTTPS) between your browser and the Service. Connections to PostgreSQL, MySQL and SQL Server databases you host use TLS only when you enable it for the source (SQL Server connections are encrypted by default), and for these we do not yet verify the database server’s certificate. MongoDB connections use TLS when your connection string asks for it. Connections to cloud services such as Snowflake, BigQuery, Stripe and Shopify use HTTPS.
- Connection credentials are encrypted with AES-256 when saved, are removed from our API responses, and are redacted from logs and error reports.
- Each request is limited to your organisation’s records, with database row-level security policies as an additional layer on the tables they cover.
- For PostgreSQL and MySQL, push-down checks run in a read-only database session; for other databases, whether they can change data depends on the permissions of the credentials you give us, so we recommend credentials limited to reading; the Service uses the credentials you provide.
- Rate limiting on our API.
- Records of measurements, decisions and events cannot be edited or deleted by the application once written, except through the approved erasure process described in section 12.
We do not currently hold security certifications of our own (such as SOC 2 or ISO 27001). No system is completely secure; see section 16 for what we do if a breach occurs.
11. Data Retention
- Account data: deleted when you delete your account. If your account holds data-source history, or you are the only member of an organisation, deletion from Settings is refused, and we complete it through our reviewed erasure process when you contact privacy@datasiq.com. Copies in our database backups are removed as those backups expire. We keep data where the law requires it, including logs the DPDP Rules require us to keep for at least one year once that rule applies.
- Rows from connected sources: not stored; they are discarded at the end of each sync. Example values per column and other metadata: kept while the source exists. Row previews copied before we stopped storing rows are cleared on the source’s next sync, or deleted with the source. At present, removing a source that has already been synced cannot always be completed from the app; if it cannot, contact privacy@datasiq.com to have the source and its data deleted.
- Files uploaded on the Upload page, and Google Sheets imports, with their samples: deleted automatically 30 days after upload, or sooner if you delete them.
- Files you add as a data source: kept while the source exists, so that it can be re-synced. Removing the source stops its use; to have the stored file erased, contact privacy@datasiq.com.
- Measurement and incident history: kept while your organisation uses the Service, because it is the evidence behind your scores and decisions; it does not expire on a timer. It is deleted when you ask us to, or after your organisation leaves the Service and any period stated in your order form has passed. If one person leaves an organisation, the organisation’s history stays with the organisation.
- Nyksen conversations and saved memories: kept until you delete them or your account.
- Security audit log: 12 months. Activity records of AI analyses (short question and answer excerpts): not deleted automatically, including when you delete your account (the link to your account is removed, the excerpts remain); to have them erased, contact privacy@datasiq.com.
- Billing records, once paid plans begin: as long as Indian tax law requires.
12. Your Rights (DPDP Act 2023)
Right to Access: Request a summary of the personal data we hold and how we process it, and the identities of the other Data Fiduciaries and Data Processors we have shared it with, with a description of what was shared. You can also export your account data from Settings.
Right to Correction, Completion, Updating and Erasure: Request correction, completion or updating of inaccurate or incomplete data, or its deletion, subject to legal retention obligations. You can request deletion from Settings; some accounts must be deleted through our reviewed erasure process (section 11). Erasure of measurement history is carried out as a deliberate step approved by a person, and we keep a record that the erasure happened, not the data erased.
Right to Withdraw Consent: Withdraw any consent you have given, as easily as you gave it — for analytics, through (also on our Cookie Policy page).
Right to Grievance Redressal: Raise a complaint with our Grievance Officer (section 17), and, once the relevant provisions of the DPDP Act are in force, with the Data Protection Board of India.
Right to Nominate: Nominate a person to exercise your rights on your behalf in the event of death or incapacity.
Contact: privacy@datasiq.com. Please write from the email address on your account so that we can verify your identity. Response within 30 days. If the personal data concerned is inside a source your organisation connected, we will pass your request to that organisation, which decides how it is handled.
13. Service Providers
We share data with the following providers, for the stated purpose:
Anthropic: AI features (Claude). Receives the AI request data described in section 7.
Clerk: Sign-in and account identity.
Google: Sign in with Google, if you use it; read-only access to your Google Drive, which we use only to read the Google Sheets you pick (we do not store the access token; when you open the Integrations page, your browser loads Google’s scripts for the Sheets picker); Google BigQuery, if you connect it; and fonts that HTML presentations and data catalogues you download from Datasiq request from Google when you open them.
Browser push services (Google, Mozilla, Apple): Delivery of push notifications you turn on; the content is encrypted.
Railway: Application hosting.
Cloudflare: Website hosting (Cloudflare Pages).
Neon: Application database.
AWS: Storage of uploaded files.
PostHog: Product analytics, only if you accept analytics (section 15). Hosted in the United States.
Sentry: Error reports and performance traces (section 5, Usage Data).
Better Stack: Application logs.
Resend: Delivery of emails we send, such as scheduled reports and the one-time password for an optional @datasiq.com mailbox.
Zoho: Hosting of the optional @datasiq.com mailbox, only if you choose one.
Temporal: Scheduling of some background data syncs, where that feature is switched on. Receives job identifiers, table names, counts and status messages, not your rows.
If your organisation sets up single sign-on, its identity provider exchanges sign-in information with us. If your order form provides for a dedicated environment, it is hosted by the cloud provider named in your order form (Amazon Web Services, Microsoft Azure or Google Cloud). If you choose your own AI model provider, that provider processes data under your agreement with it, not ours (section 7). No payment provider is used today; we will name one here before any paid billing starts. We also disclose data where the law requires it.
14. Where Data Is Processed (Cross-Border Transfers)
On the shared service, several of our providers store or process data outside India, including in the United States (for example Anthropic, and PostHog if you accept analytics). The DPDP Act permits transfers outside India except to countries the Government of India restricts by notification, and we will follow any such restriction. We do not currently guarantee that data on the shared service stays in India.
If your order form provides for a dedicated environment, your data in that environment is stored in the cloud region named in your order form. Our own supporting services (for example error tracking) may still process limited operational data elsewhere, as your order form will describe.
15. Cookies and Analytics
We use essential cookies and browser storage to keep you signed in and to remember your settings, including your cookie choice. Optional analytics (PostHog) runs only if you accept it in our cookie banner: until then, PostHog is not started and nothing is sent to it. If you accept, PostHog records the address of each page you visit and of the page you came from (with invitation, share-link and sign-in codes removed), how long you stay on each and how far you scroll, your clicks, changes to form fields and form submissions (the kind of element, its style class names and, for a link, the address it points to; never the text on the page or what you type), and a few product events (your first file upload, your first Nyksen message, and the industries you pick during onboarding); if you are signed in, these are linked to your user ID, email address, name, plan and sign-up date. PostHog also receives your IP address and browser and device details (such as screen size). We do not record your sessions. If you decline, or later withdraw, analytics stops at once (events not yet sent to PostHog are dropped, not sent) and we delete PostHog's cookies and storage from your browser. You can change your choice at any time with . See our Cookie Policy for the full list.
16. Children's Data & Data Breaches
Datasiq is not directed at individuals under 18. We do not knowingly collect data from minors. Contact privacy@datasiq.com if you believe a minor has provided us data.
If a personal data breach affects personal data for which we are the Data Fiduciary (section 3), we will inform the Data Protection Board of India and the affected individuals as the DPDP Act and Rules require, and CERT-In where Indian law requires. If it affects personal data in sources your organisation connected, we will inform your organisation without undue delay, and in time for it to meet its own notification duties, and give it the information it needs to notify the Board and affected individuals.
17. Grievance Officer
As required by the IT Act 2000 and its Rules, and by the DPDP Act 2023:
Designation: Grievance Officer, Datasiq
Email: privacy@datasiq.com
Location: Hyderabad, Telangana, India
Response time: Within 30 days of receipt
18. Changes to This Policy
Material changes will be notified via email or in-app notification at least 30 days before taking effect. Where a change needs your consent, we will ask for it and will not rely on your continued use.
19. Contact
Email: privacy@datasiq.com
Website: datasiq.com
Location: Hyderabad, Telangana, India