Legal

Privacy Policy

Last updated: 8 October 2026

This policy applies to MMA Router, operated by KAMAKRIPA ENTERPRISES (OPC) PRIVATE LIMITED ("we", "us", "our").

1.Information we collect

Information you give us

• Account details — name, email address, phone number, password (stored only as a cryptographic hash, never in readable form), and organisation name if you provide one.
• Project configuration — project names and descriptions, categories, budgets, allowed IP addresses, and the API keys you generate. API keys are stored only as a hash plus a short non-secret prefix, so we cannot show you a key again after it is created.
• Request content — the prompts, text, images, audio and video you submit, and the output returned to you.
• Correspondence — messages you send us for support, billing or legal requests.

Information generated by your use

• Usage records — for every request: timestamp, project, category, which model served it, tokens or units consumed, latency, credits deducted, success or error status, and error messages. We retain request and response data in these logs so we can investigate problems you report and resolve billing disputes.
• Generated media — images, audio and video produced for you are stored in our object storage so you can retrieve them from your media library.
• Technical data — IP address, browser and device information, and authentication cookies.

Payment information

Payments are processed by our payment gateway. We do not receive or store your full card number, CVV, UPI PIN or net-banking credentials. We receive only a transaction reference, the amount, the status, and the limited details the gateway shares with us for reconciliation.

2.Why we use it

We do not sell your personal data, and we do not use your prompts or outputs to train our own models.

3.Who we share it with

• AI model providers. Your prompt and any attached media are sent to the provider selected for your request so it can be fulfilled. MMA Router deliberately does not disclose which provider served a given request; if you need to know for compliance reasons, contact us. Each provider processes that content under its own terms and privacy policy.
• Payment gateway. To take payment and process refunds.
• Cloud hosting and object storage. To run the service and store your generated media.
• Professional advisers. Accountants, auditors and lawyers, under confidentiality obligations.
• Authorities. Where we are legally required to disclose, or to protect our rights, safety, or those of others.

If our business is transferred, your information may transfer with it; we will notify you if that happens.

4.Cross-border transfers

Model providers and infrastructure services we rely on may operate outside India. By using MMA Router you accept that your request content and related data may be processed outside India, including in jurisdictions with different data protection rules.

5.How long we keep it

• Account and project data — while your account is open, and for a reasonable period afterwards to meet legal and accounting obligations.
• Usage and request logs — retained for operational, billing-dispute and security purposes. Error logs are cleaned up automatically on a rolling basis.
• Generated media — until you delete it or your account closes.
• Transaction records — for the period required by Indian tax and company law.

6.Security

We use access controls, encrypted transport (HTTPS), hashed passwords, hashed API keys, role-based administrative access, per-key rate limits and optional IP allowlisting. No system is perfectly secure, so we cannot guarantee absolute security — but if a breach affects your data, we will notify you and the relevant authority as required by law.

Your API keys are yours to protect. Anyone holding a key can spend your credits. Do not embed keys in client-side code or public repositories, and revoke any key you believe is exposed.

7.Your rights

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you may:

• ask what personal data we hold about you and get a copy;
• have inaccurate details corrected or completed;
• ask us to erase your data, where we are not required to keep it;
• withdraw consent, understanding that this may make the service unusable;
• nominate another person to exercise your rights if you die or become incapacitated; and
• complain to us, and then to the Data Protection Board of India if you are not satisfied.

Email the grievance contact in clause 11. We respond within 30 days.

8.Cookies

We use a small number of cookies and browser storage entries, and only for things the product needs: keeping you signed in (an authentication token) and remembering interface preferences. We do not use advertising or cross-site tracking cookies. Clearing them signs you out.

9.Children

MMA Router is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.

10.Changes

We may update this policy. The "last updated" date above always reflects the current version, and we will notify you of material changes by email or an in-product notice.

11.Contact and grievance officer