Privacy Policy

PDGMS is currently in an alpha phase. We are still putting some protections in place, including zero data retention with our AI providers, and these may not be fully active yet. By using PDGMS during the alpha, you understand and accept this. To the maximum extent permitted by law, DeepThought CultureTech Ventures Private Limited is not liable for loss arising from the alpha state of these protections, and you agree to use the alpha on that basis.

DeepThought CultureTech Ventures Private Limited, 30-268/97, Santoshimanagar, Secunderabad, Telangana, India. CIN: U70200TG2020PTC139812. We decide how and why your data is used, so we are the data controller, which DPDP calls the data fiduciary.

For any question or concern about your data, write to Tarun, CEO, at tarun@dtgrowthteams.com. He is our grievance officer.

This policy covers personal data we process when you use PDGMS as a workspace user, and personal data of external contacts held in the platform, such as CRM contacts and recruitment candidates. It applies to both of our stores: identity data in the NodeBB layer and behavioural and operational data in the PDGMS database.

• Account and identity: your name, email, username, IP address, and session information.
• Work you record: plans, reports, reflections, and tickets, plus timings, counts, and scores. Some of this is free text you write.
• AI interactions: the inputs you send to AI features and the responses, when you use them.
• Where it applies: call recordings and transcripts, candidate media, and leave reasons, which can reveal health.
• External contacts: name, email, and phone for CRM contacts.

• To run the service you signed up for.
• To give you AI coaching and assistance, where you choose to use those features.
• To improve PDGMS, using usage metadata only. We do not read the content you write for this purpose, and it is enforced in the platform, not just promised. It is optional and you can withdraw anytime.
• To manage attendance, leave, payroll, and performance, where you are an employee or fellow.
• To manage prospects and candidates, where you are in the CRM or recruitment flow.

When you use AI features with your own API key, your inputs are sent to third-party AI providers to generate a response: Anthropic (Claude), OpenAI, Google (Gemini), and Perplexity. These providers may process data outside India and the EU, so using these features can transfer your data across borders.

An organisation leader can connect one Google account to PDGMS, from BD Meetings settings. When they do, PDGMS asks Google for three things: the account's email address, to show which account is connected; Google Calendar events (calendar.events); and Google Drive files that PDGMS itself creates (drive.file).

• Calendar: when someone books a BD meeting, PDGMS creates one event on the connected account's calendar, with a Google Meet link, and Google sends the invitation to the attendees. Rescheduling updates that event and cancelling deletes it. PDGMS does not read, list, or change any other event or calendar.
• Drive: files people add in PDGMS are stored in the connected account's Drive: meeting recordings, knowledge collection documents, support-ticket images, and CRM screenshots. PDGMS can see only the files it created there, not the rest of the Drive. When a meeting's participant chooses transcript only, the audio is deleted once the final transcript is made.
• We keep the account's access token encrypted and never show it, along with the IDs of the events and files PDGMS created, so it can find them again.

We use Google data only to provide these features. We do not sell it, use it for advertising, or use it to train AI models. People at DeepThought do not read it unless you ask us to, it is needed for security, or the law requires it. Where an organisation turns on AI transcription or analysis, recordings and documents are sent to the AI providers in section 5, using the organisation's own key, only to produce that feature's result.

PDGMS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. How we protect this data is set out in section 7.

A leader can disconnect the account in BD Meetings settings at any time, and PDGMS then deletes its stored token. To end the app's access completely, remove PDGMS at myaccount.google.com/permissions. Files PDGMS created stay in your Drive until you delete them.

We protect personal and sensitive data, including Google account data, with these measures:

• Encryption in transit: PDGMS and its API are served only over HTTPS (TLS), and our connections to our databases are encrypted.
• Encryption at rest: our databases are hosted by MongoDB Atlas and Supabase, which encrypt stored data at rest.
• Extra encryption for secrets: Google access tokens, AI provider keys and other credentials are encrypted with AES-256-GCM before they are stored, and are never shown back in the app. Identity and verification documents you upload are encrypted the same way.
• Passwords are stored only as salted bcrypt hashes, never in readable form.
• Access control: every request is checked against your organisation and your role, so people see only their own organisation's data and only what their role allows. An organisation can also have its data kept in a separate database of its own.
• Least access to Google data: PDGMS asks only for the Google permissions described in section 6, and meeting recordings are stored in your organisation's own Google Drive, not on our servers.
• Accountability: changes to records in PDGMS are written to an audit log, and only DeepThought staff who need it to run or support the service can reach production systems.

If we become aware of a breach that affects your personal data, we will tell you and the relevant authority as the law requires.

We do not sell personal data. We share it with the AI providers named above when you use AI features, Google when your organisation connects a Google account (section 6), and with the infrastructure providers that host the platform: MongoDB Atlas (identity store), Supabase (database), and Brevo and Mailgun (email).

We keep personal data only as long as we need it for the purpose we collected it, or as long as the law requires. Payroll and attendance records are kept for the statutory period. The content of AI logs is removed after 30 days.

You can ask us to show you your data, correct it, delete it, give you a copy to take elsewhere, and withdraw a consent you gave. Withdrawing improvement consent is as easy as giving it, in Settings then Privacy, and it does not change your service.

To use any of these, write to tarun@dtgrowthteams.com. We respond within 30 days. If you are not satisfied, you may raise it with the Data Protection Board of India, or your EU supervisory authority.

Some features use AI to score or give feedback on work. A person reviews these, and you can ask us to explain or reconsider a score.

PDGMS is intended for people aged 18 and over, in a workplace or professional setting. It is not directed at children.

We use one essential cookie to keep you signed in. We do not use advertising cookies and we do not sell or share your data with advertisers.

If you opt in to Improving the platform, we run Microsoft Clarity to see which parts of PDGMS get used and where people get stuck. Clarity sets its own cookies and records how you move through the pages. It receives your user id, organisation, department and role, never your name or email, and it is configured to mask page text so the things you write are not captured. Nothing is loaded until you opt in, and turning the consent off in Settings → Privacy stops it.

We will post changes here, and for material changes to a consent-based purpose we will ask you to review the updated notice.