Who We Are
Tensor Machine ("Tensor Machine", "we", "us", or "our") is a company incorporated under the Companies Act 2013, with its registered office in Bengaluru, Karnataka, India.
Tensor Machine operates a sovereign AI inference platform accessible via API and web console at tensormachine.ai. For the purposes of the DPDP Act 2023, Tensor Machine is the Data Fiduciary for personal data collected through this platform.
Our Data Protection Officer can be reached at dpo@tensormachine.ai.
Data We Collect
We collect the following categories of personal data:
Account Data: Name, email address, mobile number, and organisation name provided during registration. Password hashes (never plaintext). Profile preferences.
Billing Data: Name, billing address, GST number, and payment method details. Card numbers are processed and stored solely by our payment partner Razorpay and are never stored on Tensor Machine servers. Invoices and transaction records are retained for the period required under Indian tax law.
API Usage Data: API key identifiers, request timestamps, endpoint called, token counts (input and output), response latency, and error codes. We do not log the content of your API requests or model responses — inference payloads are processed in memory and discarded immediately after the response is sent.
Technical Data: IP addresses, browser type, operating system, and session identifiers collected via web console access logs. Cookies as described in our Cookie Policy.
Support Data: Communications you send to our support or sales teams, including email content and attachments.
How We Use Your Data
We process your personal data for the following purposes, each supported by a lawful basis under Section 7 of the DPDP Act 2023:
Service Delivery: Authenticating your account, processing API requests, and providing access to our platform. Lawful basis: performance of contract.
Billing and Finance: Generating GST-compliant invoices, processing payments, and maintaining financial records. Lawful basis: legal obligation (Indian tax law).
Security and Fraud Prevention: Detecting and preventing abuse, unauthorised access, and policy violations. Lawful basis: legitimate interest.
Platform Improvement: Analysing aggregate usage patterns (never individual request content) to improve performance and reliability. Lawful basis: legitimate interest. Website and documentation analytics (Google Analytics) rely instead on your consent, which you can withdraw at any time — see our Cookie Policy.
Communications: Sending service notifications, billing alerts, and — with your consent — product updates. Lawful basis: consent (for marketing) or contract (for transactional messages).
Data Retention
We retain personal data only for as long as necessary for the purpose it was collected:
Account Data: Retained for the duration of your account. Deleted within 30 days of account closure, subject to legal hold obligations.
API Usage Logs: Aggregated usage metrics (token counts, latency, error rates) retained for 12 months for billing verification and platform analytics. No inference payload content is logged or retained.
Billing Records: Retained for 8 years from the relevant tax year as required under the Income Tax Act 1961 and GST laws.
Support Communications: Retained for 24 months from last contact, then deleted unless required for legal proceedings.
Data Localisation and Transfers
All personal data collected by Tensor Machine is stored and processed within India. Our infrastructure runs on AWS’s Mumbai (India) region. No personal data is transferred outside India unless explicitly required by law or with your explicit consent.
One consent-based exception applies to website analytics: if you accept our cookie banner, Google Analytics processes pseudonymous usage data from our public website and documentation, which may involve processing by Google outside India, including in the United States. This concerns anonymous website visitors only — your account, billing, and API/inference data are never shared with Google and never leave India. See our Cookie Policy and Sub-processors page.
Inference processing happens entirely within Indian data centres. Prompts and model responses are processed in-memory and are never written to persistent storage outside the session context.
Where we use third-party service providers (such as Razorpay for payments or Cloudflare for DDoS protection), we ensure through contractual arrangements that any personal data they process on our behalf is handled in compliance with the DPDP Act. A full list of our sub-processors is available at tensormachine.ai/legal/sub-processors.
Your Rights Under DPDP Act 2023
As a Data Principal under the DPDP Act 2023, you have the following rights with respect to your personal data:
Right to Access: You may request a summary of the personal data we hold about you and the purposes for which it is being processed.
Right to Correction and Erasure: You may request correction of inaccurate data or erasure of data that is no longer necessary. We will fulfil such requests within 15 business days, subject to our legal retention obligations.
Right to Grievance Redressal: If you have a complaint about how we process your data, you may contact our Data Protection Officer at dpo@tensormachine.ai. If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once it is constituted.
Right to Nominate: You may nominate another individual to exercise your rights in the event of your death or incapacity.
Withdrawal of Consent: Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
To exercise any of these rights, write to us at dpo@tensormachine.ai with your account email address and the right you wish to exercise. We will respond within 15 business days.
Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include encryption of data in transit (TLS 1.3) and at rest (AES-256), network isolation via VPC, multi-factor authentication for internal access, and regular security assessments. Our security practices are described in detail at tensormachine.ai/security.
Despite these measures, no system is perfectly secure. If you suspect a security incident involving your data, contact us immediately at security@tensormachine.ai.
Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified to you by email at least 15 days before they take effect. Continued use of our services after the effective date constitutes acceptance of the updated policy. The current version is always available at tensormachine.ai/legal/privacy.