Home / Legal
Privacy policy
What we collect, why we collect it, and what you can ask us to do about it.
Effective 1 August 2026 · Last updated 1 August 2026
This policy explains how ChartGPT, a sole proprietorship owned and operated by Kanishk Mehra ("we", "us") handles personal data when you use chartgpt.co and related services. It is written to be read. If anything in it is unclear, ask us at [email protected] and we will explain — and probably rewrite the paragraph.
The short version
- We collect the least we can: your account details and basic usage data.
- Your chart data is used to make your chart and nothing else. It is not stored afterwards, not used to train AI models, not sold, and not shared with advertisers.
- We do not keep your charts, on any plan.
- Comments you post on our articles are the one thing you write that we do store, because publishing them is the point. Your name and picture appear beside them.
- You can ask for a copy of your data, or to close your account, by writing to us, and we will act within 30 days.
1. What we collect
Information you give us
- Account details. Your name and email address when you create an account, and a password stored only as a cryptographic hash. Optionally a profile picture, a line about yourself, a job title and links to your LinkedIn or Instagram, if you choose to add them in your account settings.
- Comments. What you write in the discussion under an article, and which article it was on. Comments are stored, read by a moderator before they appear, and then published on a public page alongside your name and picture. Treat anything you post there as public.
- Chart content. The prompts you write and the data you paste. These are held in memory for as long as it takes to build your chart and are not written to our database. The chart comes back to your browser and stays there.
- Billing details. If you subscribe, your billing name, address and GST number where relevant. Card details go directly to our payment provider and are never stored on our systems.
- Messages. What you send us through the contact form or by email.
Information collected automatically
- Usage data. Pages viewed, features used, how many charts were generated, and rough timings. A count, not the charts themselves. Used to understand what to fix.
- Technical data. IP address, browser type and operating system, recorded in server logs and kept for 30 days for security and abuse prevention.
- Cookies. Described in the cookie policy. We do not use advertising cookies.
We do not knowingly collect data from children under 18. If you believe a child has given us personal data, write to us and we will delete it.
2. Why we use it, and our legal basis
| Purpose | Data used | Basis |
|---|---|---|
| Making the charts you ask for | Prompts, pasted data — not retained | Performance of our contract with you |
| Running and securing your account | Account details, technical data | Performance of contract; legitimate interests in security |
| Publishing your comments, and moderating them before they appear | Comment text, your name and picture | Performance of contract; legitimate interests in keeping the discussion usable |
| Taking payment and issuing invoices | Billing details | Contract; legal obligation to keep tax records |
| Improving the product | Aggregated usage data | Legitimate interests |
| Answering your messages | What you send us | Legitimate interests |
| Product emails you opted into | Email address | Consent, withdrawable at any time |
3. AI processing
Turning your words into a chart specification requires sending your prompt, and any data you paste, to our model provider. We currently use OpenAI's API for this step.
Under our commercial agreement with that provider, content sent through the API is not used to train their models. The provider may retain the content for a limited period for abuse monitoring, after which it is deleted. Processing may take place outside India, including in the United States.
The drawing step happens on our own systems. If you would prefer that your data never reaches a third-party model, do not paste it — there is currently no offline mode, and we would rather say that plainly than bury it.
4. Who else sees your data
We share data only with service providers who need it to run the service, each bound by contract to protect it:
- Cloud hosting — application and database hosting, Mumbai region.
- AI model provider — chart generation, as described above.
- Payment processor — subscriptions and invoices.
- Email delivery — transactional email such as password resets and receipts.
- Analytics — privacy-respecting, aggregated usage measurement.
The current list with names is on the data processing page. We do not sell personal data. We may disclose data if required by law, and where we are permitted to tell you, we will.
5. How long we keep it
| Data | Kept for |
|---|---|
| Prompts, pasted data and charts | Not stored — held only in memory while the chart is being made |
| Account details | While the account is open, then 30 days |
| Comments | Published indefinitely, or until you ask us to remove them. Closing your account does not delete them by itself — ask us and we will |
| Server logs | 30 days |
| Invoices and tax records | 8 years, as Indian tax law requires |
| Support conversations | 2 years |
6. Your rights
Wherever you are, you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything inaccurate;
- delete your data, subject to records we must keep by law;
- stop sending you marketing email, which you can also do from any such email;
- give you a copy of your account data in a machine-readable format. Charts are not covered by this, because we do not hold any — use the export buttons under the chart while you have it open.
There is no button that closes an account or removes a comment — both are done by hand so that a request to delete a comment can be weighed against the replies underneath it. Write to us and we will do it.
Write to [email protected]. We will respond within 30 days and will not charge you for a reasonable request.
If you are in India, the Digital Personal Data Protection Act 2023 gives you these rights, along with the right to nominate someone to exercise them on your behalf if you die or become incapacitated, and the right to complain to the Data Protection Board of India. If you are in the UK or EEA, the UK GDPR or GDPR applies and you may complain to your local supervisory authority. In either case we would appreciate the chance to put things right first.
7. Keeping data safe
Data is encrypted in transit and at rest, production access is limited and logged, and we patch dependencies on a regular cycle. Details are on the security page. No system is perfectly secure, and we will tell affected users and the relevant authority without undue delay if a breach is likely to cause them harm.
8. International transfers
Your data is stored in India. Some providers, particularly the AI model provider, process data outside India. Where that happens we rely on the provider's contractual commitments, including standard contractual clauses where applicable.
9. Changes to this policy
When we change this policy we update the date at the top. If a change materially affects your rights, we will email account holders at least 14 days before it takes effect.
10. Who is responsible for your data
Kanishk Mehra, as sole proprietor of ChartGPT, is the data fiduciary under the Digital Personal Data Protection Act 2023 and the controller under the GDPR, and is the person accountable for the decisions described in this policy.
11. Contact
ChartGPT, a sole proprietorship owned and operated by Kanishk Mehra, 91 Springboard, Sector 44, Gurugram, Haryana 122003, India. Email [email protected].
Questions about this document? Write to [email protected].