Legal
Data Processing Agreement
How Sharan AI processes data on your organization's behalf. This page describes the arrangement; a countersigned agreement is available to subscribing organizations on request.
Roles
Your organization is the data controller: you decide what is put into the assistant and why. Sharan AI acts as a data processor, handling that data to provide the assistant, and — through a reviewed training flywheel — to improve answer quality, as described here and in the Privacy page. Sharan AI operates the infrastructure the hosted service runs on.
Scope of processing
Processing covers the questions your team asks, the answers produced, any screens uploaded for a question, and the feedback and corrections your team submits. SAP-grounded questions and uploaded screens are processed on Sharan AI's own infrastructure and are not sent to an outside model provider. General, non-SAP questions may be processed by an external model, and are captured only in minimal form.
Identity and personal data
Sign-in identity is reduced to a salted, one-way hash before it is stored; the raw account identifier is not retained. The assistant is built for SAP and process work, not for collecting personal data. You remain responsible for what your team chooses to enter into a question.
Sub-processors
The SAP-grounded path uses no third-party sub-processor: it runs on Sharan AI's own infrastructure. Where a general, non-SAP question is routed to an external model, that model provider processes only that minimal, non-SAP request. Payment processing, when a paid plan is used, is handled by a payment provider that receives billing details only, never your SAP content. We will make the current list of any such sub-processors available to subscribing organizations and give notice of a material change before it takes effect.
Security
Access is restricted to authorized users of the subscribing organization through Google sign-in. Stored identity is hashed, request access is authenticated per tenant, and mutations are recorded to an audit trail. Sharan AI controls the network, storage, and backup boundary around the infrastructure the service runs on. This page describes the measures in place; it does not promise a service level or a specific certification.
Data-subject rights
The assistant supports the rights individuals hold under laws such as the GDPR and India's Digital Personal Data Protection Act, including access to and deletion of the data held for a subject. An authorized user can request their stored data or its erasure from the account settings; a deletion removes the subject's records across every store in a single operation and records a tamper-evident audit entry that holds counts only, not the erased content. See the Privacy page for the detail.
Retention, return and deletion
Captured interactions are retained on Sharan AI's infrastructure for model improvement for as long as the account is active. On termination, you can export the stored data and erase it. Deletion is irreversible.
Changes
This agreement may be updated as the service changes. Material changes affecting how data is processed will be communicated to subscribing organizations. Continued use after a change takes effect means the updated terms apply.