Privacy Policy - Ostera AI

Ostera AI Private Limited (“Ostera AI”, “we”, “us”, or “our”) is committed to protecting your privacy and the security of your data. This Privacy Policy explains what personal data we process, why, and the choices you have.

It covers two products:

• Ostera Mission Control— our workspace platform for teams, available at mission.ostera.ai and through the Mission Control mobile apps (Part A).
• The Ostera AI on-device app— our offline AI assistant app for Android (Part B).

This Privacy Policy is prepared in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the rules framed thereunder, as applicable in India.

Mission Control is a cloud service. To provide it, we store and process the data you and your organization put into it on our servers, as described below.

A1.1 Account information

• Your name, email address, password (stored only as a salted hash), profile photo and role.
• The organization and teams you belong to, and any optional profile details you add.
• Sign-in and security data such as one-time codes, two-factor authentication settings and active sessions.

A1.2 Content you create

• Issues, tasks, boards, OKRs, notes, pages, whiteboards, comments and attachments.
• Chat messages, reactions, files and read receipts.
• Meetings and calls: audio and video are relayed in real time to other participants. When live transcription is turned on, meeting audio is transcribed and the transcript and meeting notes are saved to the meeting.
• Requests you make to ELSA, our AI assistant, and its responses.
• Finance, attendance and other records your organization chooses to manage in Mission Control.

A1.3 Connected email accounts (Mails)

If you connect an email account to Mails, we process the messages, attachments, folders and settings of that mailbox, and the credentials or access tokens needed to reach it. Gmail data is covered in detail in section A5.

A1.4 Usage and device information

• Workday activity your organization has enabled, such as session start and end times and activity heartbeats used for attendance.
• Device and browser type, IP address and logs needed to keep the service secure and working.
• Push-notification tokens, if you allow notifications.
• Payment records for paid plans (we do not store full card details).

We do not use advertising identifiers and we do not sell personal data.

• To provide Mission Control’s features to you and your organization.
• To authenticate you, secure accounts and prevent abuse.
• To send service emails and notifications, such as sign-in codes, mentions and meeting invitations.
• To answer requests you make to ELSA.
• To process payments and meet legal and accounting obligations.
• To diagnose problems and improve reliability.

We do not use your content for advertising, and we do not use your content to train generalized AI or machine-learning models.

ELSA helps you work with your data in Mission Control: for example, finding issues, summarising meetings, drafting messages and, if you connect an email account, reading, drafting, sending or deleting your mail.

• ELSA acts only on requests made by the signed-in user, and only on data that user can already access.
• Actions that send or delete data, such as sending an email, require your explicit confirmation first.
• Some requests are processed by AI models running in your browser or device. Others are processed in the cloud by Google Cloud Vertex AI, which receives only the content needed to answer the request.
• Your content is not used to train AI models, by us or by our AI providers.

We do not sell, rent or trade personal data. Content you create is visible to the people in your organization you share it with. We share data with the following service providers only as needed to run Mission Control:

We may also disclose data when required by law, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy will continue to apply to your data.

If you connect a Gmail account to Mails using “Sign in with Google”, Mission Control requests the Google permission https://mail.google.com/, together with your basic profile and email address. This lets Mission Control connect to Gmail over the standard IMAP and SMTP protocols.

What we access

Your email messages, including their headers, content and attachments; your folders and labels; message status (such as read, flagged, or deleted); and the email address of the connected Google account.

How we use it

• To display, search and organise your mail in Mails.
• To send, reply to and forward mail that you write, and to save your drafts.
• To let ELSA find, summarise, draft, send or delete your mail when you ask it to. ELSA never sends or deletes mail without your explicit confirmation.

We use Gmail data only to provide these user-facing features.

AI processing

When you ask ELSA about your mail, the relevant content is processed by Google Cloud Vertex AI solely to produce the response you requested. Gmail data is not used to develop, improve or train generalized AI or machine-learning models.

Sharing

We do not sell Gmail data, use it for advertising, or share it with third parties. The only exceptions are:

• The service providers needed to run the features above: AWS hosting and Google Cloud Vertex AI.
• When the law requires it.
• When you explicitly ask us to.

Our staff do not read your Gmail data unless you give us permission for a specific message, it is necessary for security purposes such as investigating abuse, or it is required by law.

Storage and security

Google access tokens are encrypted at rest using AES-256-GCM, and all connections to Gmail use TLS. Message headers and content are cached in our database so that your mailbox loads quickly. Each mailbox is private to the user who connected it.

Removing your data

Removing an account in Mails (Account settings → Remove) permanently deletes its stored tokens and all cached mail for that account. Deleting your Mission Control account does the same for every connected mailbox. You can also revoke Mission Control’s access at any time at myaccount.google.com/permissions.

Limited Use

Ostera AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Data is stored on AWS infrastructure and is protected in transit with TLS.
• Passwords are stored only as salted hashes, and mailbox credentials and tokens are encrypted at rest.
• Access to production systems is limited to authorised personnel.
• We keep your data for as long as your account is active or as needed to provide the service. When you delete content, connected mailboxes or your account, we delete the associated data, except where we must keep certain records (such as payment records) to meet legal obligations.

Each permission is requested only when you use the feature that needs it, and you can revoke it at any time in your device settings.

The Ostera AI on-device app is designed with privacy as a foundational principle. All AI processing in this app, including speech-to-text, text-to-speech, and language model inference, occurs entirely on your device. The app does not collect, store, or transmit any personal data to our servers.

B1.1 Information We Do NOT Collect

Through the on-device app, we do not collect any of the following:

• Voice recordings or audio inputs (processed locally).
• Chat messages or conversation history (stored only on your device).
• Personal identifiers such as name, email address, phone number, or any other personally identifiable information.
• Location data.
• Device identifiers or advertising IDs for tracking purposes.
• Usage analytics, behavioral data, crash reports, or any telemetry data.

No account registration is required to use the on-device app, and we do not maintain any user accounts for it on our servers.

B1.2 Information Processed Locally

The following data is processed and stored exclusively on your device:

• Audio input from the microphone for on-device speech-to-text transcription.
• Conversation history stored in the app’s private storage.
• Downloaded AI models (sourced from public repositories).

All data remains on your device and is used solely for the following purposes:

• Providing real-time speech-to-text transcription using on-device AI models.
• Generating text-to-speech audio output.
• Processing chat conversations with locally running language models.
• Enabling local storage of conversation history for user convenience.

No data is uploaded, analysed, or used for training models, advertising, or any other purpose.

The on-device app does not share, sell, rent, or disclose any user data with any third parties. No data is transmitted to our servers or to any external service providers.

B3.1 Model Downloads – Third-Party Sources

The app may download open-source AI models from public repositories such as:

• Hugging Face (huggingface.co)
• GitHub (github.com)

These are standard file downloads that do not include any of your personal data. We recommend that you review the terms and privacy policies of these third-party platforms independently. Ostera AI does not endorse or guarantee the security of third-party repositories.

B4.1 Local Storage

All user-generated data is stored locally in the app’s private storage on your Android device, protected by Android’s application sandboxing mechanism. This storage is accessible only to the Ostera AI application.

B4.2 Data Retention

• Conversation history remains on the device until you manually delete it or uninstall the app.
• Downloaded models remain until you delete them via the app or uninstall the application.

Uninstalling the app will permanently delete all associated local data.

The on-device app requests only the following permissions, with clear justification:

The Internet permission is used exclusively for model downloads. No user data, conversations, or personal information is ever transmitted over the internet. You may revoke these permissions at any time through your device settings.

After the initial download of AI models, the on-device app is designed to function completely offline. All inference and processing occur locally using your device’s CPU/GPU/NPU within the sandboxed environment of the app. No network requests are made to any external servers during normal operation.

In accordance with the DPDP Act and other applicable laws, you have the right to:

• Access the personal data we hold about you. In Mission Control, most of it is visible in your profile and workspace. In the on-device app, all data is on your device.
• Correction and erasure: edit your profile, delete content, remove connected mailboxes, or delete your Mission Control account from your profile settings. In the on-device app, delete conversations or models within the app.
• Withdraw consent: disconnect integrations (such as Gmail), turn off notifications, or delete your account. Uninstalling the on-device app removes all of its data from your device.
• Grievance redressal and nomination, as provided under the DPDP Act.

If your Mission Control account is managed by your organization, some requests may need to go through your organization’s administrator. You can also contact us using the details below.

Mission Control is intended for use by organizations and their members aged 18 and over, and we do not knowingly process personal data of children below the age of 18 in it. The on-device app does not collect personal data. Parents or guardians are encouraged to supervise minors’ use of either product.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Any material changes will be notified by updating the Effective Date and posting the revised policy on our website. Continued use of our products after such changes constitutes acceptance of the updated policy.

For any questions, concerns, or grievances regarding this Privacy Policy or data practices, please contact us at:

Email: coo@ostera.ai
Phone: +91 94287 28709

Grievance Officer

Email: coo@ostera.ai

We shall endeavour to address all grievances within the timelines prescribed under applicable Indian law.

Note: This Privacy Policy applies to Ostera Mission Control (web and mobile apps) and the Ostera AI on-device application, distributed through mission.ostera.ai, the Google Play Store, the Apple App Store and other official distribution channels. By using our products, you acknowledge that you have read and understood the practices described in this Privacy Policy.