Review Draft v0.9Cutoff: 17 Oct 2026

Service Providers and International Processing

Full register of cloud hosts, AI providers, OCR services, and cross-border data considerations.

Legal Review & Compliance Status Notice

This policy draft is tailored to AI Tathastu's verified architecture and engineering practices. Under India's phased legal framework (Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025), substantive obligations commence in scheduled tranches.

Any item labelled with an [Awaiting Verification] tag designates operational data (such as formal legal entity name, designated grievance officer contacts, or vendor contractual tiers) reserved for verified business confirmation. This platform makes no unverified certification claims.

International transfersActual service regions may be outside India. Deployment location, subprocessors, logging regions and cross-border safeguards must be assessed with counsel. We will not claim 'India-only hosting' unless all relevant paths are verified. Subject to the DPDP framework's applicable commencement and notified transfer restrictions.

Training and retentionVendors differ. We will not claim all providers never train on submitted inputs. Google distinguishes unpaid and paid Gemini API terms; OpenRouter can route inputs to multiple model providers; verify the current contract and selected settings.

ContactAwaiting Verification: monitored privacy contact

Overview#

This page lists categories of technical recipients relevant to AI Tathastu. A configured API key is not proof that a provider is active or receives personal data. See verified date and technical operation status for each entry before publication.

Vendor/technology	Potential purpose	Personal data categories	Active / actual region / retention
Vercel / Next.js runtime	Website hosting, serverless APIs	HTTP/session metadata, CV requests where processed	[VERIFY]
Render / Python	Selective OCR and structured CV extraction	CV file, text and supporting evidence	[VERIFY]
Neon PostgreSQL	User/profile/consent data	Identifiers, reviews, education and projects	[VERIFY]
Upstash Redis	Rate limiting and operational counts	Opaque IDs/counters, possible operational metadata	[VERIFY]
Google OAuth	Sign-in/account connection	OAuth identifiers, scopes/tokens	[VERIFY]
GitHub OAuth / REST	Connected repositories/projects	Authorized account metadata	[VERIFY]
Groq	Optional external AI	Authorized prompts/context	[VERIFY account retention controls]
Cerebras	Optional external AI	Authorized prompts/context	[VERIFY account, contract]
Gemini Developer API	Potential optional AI; AGE AND FREE-TIER BLOCKER	Prompts/context if permitted	[HOLD pending eligibility & tier review]
OpenRouter and upstream model hosts	Routed optional AI	Prompts/context and metadata	[VERIFY upstream vendors and settings]
Mistral	Optional external AI	Authorized prompts/context	[VERIFY]
SambaNova	Optional external AI	Authorized prompts/context	[VERIFY]
Firecrawl (if enabled)	Permitted public-page retrieval	Submitted URLs and authorized public content	[VERIFY ACTIVE? terms/location]
Stack Exchange API	Public coding-profile information	Public account/profile statistics and contributions	[VERIFY enabled fields/attribution]
Kaggle API (if enabled)	Supported datasets/notebooks/public records	Authorized/public API records	[VERIFY exact endpoints]
Hugging Face, ORCID and other public APIs	Public technical/research records	Limited public identifiers and outputs	[VERIFY]

Questions or privacy inquiries?

Reach out to our privacy desk or review grievance redressal procedures.