1. Who we are
Pharma AI is made by N Automations, Hyderabad, India ("N Automations", "we", "us").
- Website: www.nautomations.in
- Licences and privacy questions: info@nautomations.in
- Help: support@nautomations.in
- Phone/WhatsApp: +91 96669 36366
2. Summary
- Your company's working data stays on your company's own server. This covers user accounts, questions, uploaded files, records of downloads, audit logs, settings, AI keys and, only if your Administrator switches answer storage on, AI answer text. N Automations has no account on that server and cannot read it.
- We receive only licence data. Our Licence Service gets only what it needs to register your company, deliver the e-mail verification code, run the free trial, issue and check licences, and bill per active user account (section 4).
- Your AI provider is your company's choice and contract. Questions go from your company server to the AI provider your company selected, using your company's own API key. They never pass through N Automations.
- No telemetry, analytics, crash reports, advertising or tracking. We do not sell or rent any data.
3. Who is responsible for what
Your company decides how it uses Pharma AI and controls its company server and the data on it. Under India's Digital Personal Data Protection Act, 2023, your company is the data fiduciary for that data: it gives notices to its employees, sets retention, handles its employees' requests and makes backups. N Automations does not process that content. N Automations decides how the licence data in section 4 is used and is responsible for it. This section is a summary, not legal advice.
4. Data N Automations receives
| Data | Why we need it | How long we keep it |
|---|---|---|
| The Administrator's company e-mail address | Registering the company, sending the 6-digit verification code, enforcing one free trial per company domain, and licence contact | Kept in your company's licence record while that record exists. Records of ended trials or licences are currently not deleted automatically; you can ask us to delete yours (section 11). A domain-hold entry with the address is kept for up to 7 days after a verified code (it is removed earlier when the trial starts). A verification-code entry is kept until the code is used or expires (24 hours); expired entries are deleted by a daily clean-up job. |
| Company e-mail domain (for example, examplepharma.com) | One free trial per company domain | Kept in the company record, as above. Domain holds are kept for up to 7 days. A domain allowance (a second registration that N Automations permits for a domain) is kept without automatic deletion. |
| 6-digit verification code | Proving that the Administrator controls the company mailbox | We store only a keyed hash, never the code itself. It is valid for 24 hours with 5 tries, and is deleted when used, or by the daily clean-up job after it expires. |
| Company server address (its https address) | Sent with the trial request at the end of setup step 3. It binds the licence to that server and enforces one trial per company server. | Kept in the company record, as above. |
| App version | Sent with the trial request and in every daily report | Kept in the company record and with each daily report (see below) |
| Licence record: licence ID, licence type (trial, 1-year or lifetime), status, validity dates, grace days, billing-period start, signed licence token, last report day, latest active-account count and the peak count for the period | Issuing and checking your licence, and billing on the highest daily number of active user accounts | Kept in the company record, as above. |
| Daily counts: the India-time day, the number of active user accounts, disabled accounts and total accounts, and the app version | Billing per active user account. Your company server sends these once a day at 06:00 IST and re-sends missed days up to 30 days back. The report body contains exactly these five fields; the request is identified by your licence ID and signed with HMAC. It contains no names, usernames, e-mail addresses or PC identifiers. | 731 days (2 years), then deleted automatically by the daily clean-up job |
| Network (IP) address of requests to the Licence Service | Rate limits on registration, verification-code, trial and setup requests, and blocking of repeated failed requests | Never stored in plain form. Only a truncated keyed hash is kept as a rate-limit counter; counters are deleted by the daily clean-up job once they are more than one day old. The per-address limit for verification codes uses a keyed hash of the e-mail address in the same way. |
| Supabase permission (OAuth code and token) during automatic server setup or a later company-server update | Supabase requires our app's secret key for the final sign-in step, so this single step passes through the Licence Service | Not stored and not logged. It passes through only for the moment of the exchange. |
| Records of N Automations' own actions on licence records, including the automatic registration record that contains your company domain | Auditing our own actions | Kept as a permanent audit record, without automatic deletion |
| Billing contact details for your order, and invoice status | Contract, invoicing and support | Kept outside the app, in our contract and accounting records, for as long as the contract and Indian tax and accounting law require |
Website version only: the website installer build requests the signed update file https://www.nautomations.in/pharma-ai/updates/latest.json when an Administrator checks for updates, and at start when the Administrator has approved a newer version. The request carries no account, company or usage data, and the app stores nothing about it. Like any web request, it reaches our website host with the PC's network address, and the host may keep standard request logs. Downloading the installer from our website works the same way. The Microsoft Store version has no updater; Microsoft delivers its updates.
5. Data N Automations never receives
- Names of users, or usernames
- Sign-in passwords and Level-2 passwords
- Recovery codes and authenticator set-up keys
- Questions (prompts) and AI answers
- Uploaded files and their extracted text
- Downloaded or created files
- Audit logs and activity records
- AI provider API keys
- Model routes, token limits, budgets, branding, department set-up and other company settings
- PC names, the PC list or any PC identifier (PCs never contact the Licence Service)
- Any e-mail address other than the Administrator's company e-mail address
- Telemetry, analytics, crash reports or advertising data. The app has none of these.
6. Data on your company server and PCs
- All company data is stored only on your company's server. That server is either a Supabase project in your company's own account or a self-hosted server that your company runs.
- AI answer text is not stored by default: only each answer's SHA-256 fingerprint, length, tokens and model are kept, unless your Administrator switches on answer storage for a set number of days.
- Your Administrator controls retention: by default 1,095 days (3 years), within a range of 30 to 36,500 days. A nightly job at 02:00 IST applies it. Legal holds stop deletion. Deletions need a written reason and a password re-check, and are recorded in a permanent Deletion Log.
- Backups of the company server are your company's responsibility.
- On each PC, chat answers are kept only in memory and are gone at sign-out. The sign-in session, the PC connection details and the device key are stored encrypted with Windows DPAPI. Files a user downloads are saved on that PC, where your company's own controls apply.
- For questions about data on your company server, please contact your company's Administrator. N Automations cannot access that data.
7. AI providers
- Your company chooses and contracts its AI provider: OpenAI, Microsoft Azure OpenAI, Anthropic (Claude) or Google (Gemini). It uses its own API key.
- AI providers are called only from your company server's AI Gateway. They are never called from PCs and never through N Automations.
- For every allowed question, the AI provider receives the department instructions (which contain the company name, the app name and the department name), the question, recent turns of the same conversation, text extracted from attached files and, for pictures sent to a vision-capable model, a reduced image.
- For the department check, a smaller "classifier" model chosen by your Administrator receives the question and, for uploads, the upload reason and description. This happens for every question that the first, rule-based stage does not refuse, including questions that are then refused. A question refused by the rule-based stage is not sent to any AI model.
- The provider's handling of this data is governed by your company's own agreement with that provider. N Automations is not a party to that agreement.
- We recommend paid business API accounts in your company's name, zero-data-retention or enterprise options where offered, regional options where required (Azure OpenAI allows an India region), and spending limits set in the provider's own console.
8. Service providers we use
- Cloudflare hosts the N Automations Licence Service and its database, which holds the licence records in section 4. Worker logs, traces and metrics are switched off. As the hosting provider, Cloudflare carries the network traffic of these requests. At registration, we also use Cloudflare DNS-over-HTTPS for one mail-server (MX) lookup of your company e-mail domain, to refuse domains without mail.
- Resend sends the 6-digit verification e-mail from info@nautomations.in. To do so, it receives the Administrator's company e-mail address and the code.
- Supabase is the default company server platform. It runs in your company's own account under your company's own contract with Supabase. For automatic setup, and later company-server updates, we use our "Pharma AI" OAuth app on Supabase. It is used only from the Administrator's PC, and the Administrator can remove it in Supabase afterwards.
- Microsoft provides Microsoft Store distribution and signing of the app package, installation through winget and Intune, and the Edge WebView2 runtime. The standard website installer downloads WebView2 from Microsoft only if it is missing. Microsoft's own privacy statement applies to your use of the Microsoft Store.
- Cloud hosts for self-hosted company servers, such as AWS, Microsoft Azure, Google Cloud, DigitalOcean, Oracle Cloud or Hetzner, are chosen and contracted by your company.
We use no analytics, tracking, crash-reporting, advertising or CDN providers.
Cloudflare and Resend operate internationally, so the data in section 4 may be stored or processed outside India.
9. What we do not do
- We do not sell, rent or trade any data.
- We do not show advertising, use advertising IDs or embed trackers.
- We do not collect telemetry, analytics or crash reports.
- We do not access your company server. N Automations holds no credentials for it and has no back door.
10. Security
- All traffic uses TLS.
- Verification codes and network addresses are kept only as keyed hashes.
- Licence data is signed with Ed25519, and daily reports are signed with HMAC.
- Licence Service logging is switched off.
- On PCs, the session, connection details and device key are protected with Windows DPAPI.
- At every start, the app checks its own integrity (for the Store version, the Microsoft signature).
11. Your choices and rights
- You can ask for a copy of the licence data we hold about your company, or ask us to correct or delete it, by writing to info@nautomations.in. Please write from, or name, the Administrator's company e-mail address so that we can verify the request. Deleting the company record ends the licence. Records that we must keep while a licence is active, or for legal and accounting reasons, are kept only for that purpose.
- For a complaint about how we handle personal data, write to info@nautomations.in with the subject "Privacy".
- Your Administrator can remove our Supabase OAuth app from your company's Supabase account at any time after setup.
- Questions about data on your company server go to your company's Administrator.
12. Children
Pharma AI is business software for companies and their employees. It is not directed at children, and we do not knowingly collect children's data.
13. Changes to this policy
When this policy changes, we publish the new version on this page and update the effective date.
14. Contact
N Automations, Hyderabad, India
- Privacy and licences: info@nautomations.in
- Help: support@nautomations.in
- Phone/WhatsApp: +91 96669 36366
- Website: www.nautomations.in