Privacy Policy
Last updated
This policy explains what personal data Servabo handles, why, who else processes it, how long we keep it, and how you can use your rights. It applies to the Servabo app and this website. It is written to meet India's Digital Personal Data Protection Act, 2023 and, for people in the European Union and the United Kingdom, the GDPR.
Who we are
Servabo is operated by Sabarish N, an individual (sole proprietor) in India, trading as Servabo ("we", "us"). For the personal data described under "What we collect" below we decide why and how it is used: we are its data fiduciary (controller). Contact: sabarishwarne@gmail.com.
Your documents and our role
The documents your organization uploads, and what Servabo extracts from them, belong to your organization. They often contain personal data (a supplier contact's name, an employee on a receipt). For that data your organization decides why it is processed, and we process it on its behalf and on its instructions, to provide Servabo: we act as its data processor. Requests about personal data in your organization's documents are best sent to that organization; we will help it answer them.
What we collect and why
| Data | Why we use it |
|---|---|
| Account details: name, email address, password (stored only as a hash), two-factor settings, profile picture, time zone and display preferences. | To create your account, sign you in securely and show the app the way you set it. Needed to provide the service. |
| Organization details: organization name, members and their roles, invitations, settings, branding. | To run your organization's workspace and its permissions. Needed to provide the service. |
| Documents and their contents, conversations with the assistant, and the results Servabo produces. | To provide the service your organization asked for (see "Your documents and our role"). |
| Billing details: billing name and email, country, plan and seats, invoices and payment status. Card details go to Dodo Payments directly and never reach us. | To sell and manage your subscription with our merchant of record, and to keep records the law requires. |
| Security and usage records: sign-in times, IP addresses, browser and device type, the audit log of actions in your organization, and usage counts (documents, pages, questions). | To keep accounts and data secure, detect abuse, apply plan limits, show you your usage, and fix faults. Our legitimate interest in a secure, working service, and your organization's audit needs. |
| Messages you send us by email. | To answer you and improve Servabo. |
We do not sell personal data, we do not use your documents to train AI models, and we do not show advertising. This website collects nothing about you: it sets no cookies and runs no analytics.
AI providers
To read documents and answer questions, Servabo sends the text of the relevant document pages, and the question asked, to an AI model provider, which returns the result. Servabo uses:
- Groq, Inc. (GroqCloud, United States): Runs the AI model that reads document text into fields and answers questions about your documents, on Servabo's own account. Text is sent to read it for you; the result comes back to your workspace.
Text recognition (OCR), search indexing and re-ranking run on our own server; no third party sees your documents for them. If your organization connects its own AI provider key (OpenAI, Anthropic, Azure OpenAI, Mistral, Groq or Google Gemini), document text for the tasks it chooses goes to that provider, under your organization's own agreement with it.
Who else processes data
We use these service providers (subprocessors) to run Servabo. Each processes personal data only to provide its service to us, under contract:
- Hetzner Online GmbH — Hetzner Cloud, Germany (EU). All customer data.
- Cloudflare, Inc. — Cloudflare R2 object storage, European Union (R2 jurisdiction: EU). Uploaded documents; encrypted backups.
- Groq, Inc. — GroqCloud, United States. Document text and questions you ask.
- Postmark (ActiveCampaign, LLC) — Postmark transactional email, United States. Recipient email addresses and email content.
- Dodo Payments — Payments, as merchant of record, See Dodo Payments' buyer terms. Billing name, email address, country and payment details (card details go to Dodo Payments directly and never reach Servabo).
The current list, and the date it last changed, is on the subprocessors page. We may also disclose data when the law requires it, to protect our rights or the safety of others, or to a successor if our business is transferred (you would be told).
International transfers
Servabo's application and database run in Germany (EU). Some providers above process data in other countries, including the United States (Groq, Inc., Postmark (ActiveCampaign, LLC)). Where data leaves India or the European Economic Area, we rely on the transfer safeguards these providers offer in their contracts, such as the European Commission's standard contractual clauses, and we do not transfer personal data to any country the Indian government restricts.
How long we keep data
- Account and organization data: while the account or organization exists. When you delete your account or ask us to, we delete it, except what we must keep by law.
- Documents and results: until your organization deletes them, sets a retention period that removes them, or asks us to delete the organization. A trial or subscription that ends does not delete them: the organization stays readable so you can export.
- Audit log: for the period your organization chooses (at least 400 days), or indefinitely if it chooses none.
- Backups: encrypted database backups are kept for about five weeks and then replaced, so deleted data leaves them within that time.
- Billing records: as long as tax and accounting laws require; Dodo Payments keeps its own records as merchant of record.
- Security records such as sign-in history: as long as needed to secure accounts, and no longer than the account.
Your rights and requests
You can ask us to tell you what personal data we hold about you and how we use it; to correct, complete or update it; to delete it; to give you a copy in a common format; to object to or restrict a use; and to withdraw any consent you gave. In India you may also nominate someone to exercise your rights if you die or cannot. Much of this you can do yourself in the app (profile, export, deletion).
Email sabarishwarne@gmail.com with "Privacy request" in the subject. We may ask you to confirm who you are. We answer within 30 days, and sooner where we can. If you are not satisfied, you may complain to the Data Protection Board of India, or to your local data protection authority in the EU or UK.
Cookies and browser storage
The app uses one cookie, which keeps you signed in, and stores a few settings in your browser; none are for advertising or tracking. This website sets no cookies. The details are on the cookies page.
Security
We protect data with tenant isolation, role-based access, encryption in transit and of stored secrets, encrypted backups and an append-only audit log; the security page describes each. If a breach affects your personal data, we will tell you and the authorities as the law requires.
Children
Servabo is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children.
Changes
We will update this policy when what we do changes; the date at the top shows the latest version. For a material change we will email the owners of active organizations before it takes effect.
Grievance and contact officer
Our grievance officer, and the contact for any question about this policy or your data, is Sabarish N, reachable at sabarishwarne@gmail.com. We acknowledge a grievance within two business days and resolve it as quickly as we can, within the time the law sets.