This policy outlines our commitments to enterprise data privacy, model isolation, and organizational tenant security across the RHA OneAI platform and connected services.
Effective Date: October 01, 2026
Zero Model Training
Customer prompts, documents, and agent outputs are never used to train public foundational AI models.
Tenant Isolation
Logical data separation, source ACL preservation, and AES-256 token encryption at rest.
Processor vs. Controller
Your enterprise controls tenant content as Data Controller; RHA OneAI processes strictly under contract.
Global Compliance
Architected to comply with GDPR and India DPDP Act 2023.
Section 01
Overview & Scope
RHA OneAI ("RHA OneAI," "we," "our," or "us") provides an enterprise artificial intelligence platform, autonomous multi-agent orchestration engines, workflow automation tools, and enterprise data connectors. These services enable organizations to securely query connected workplace data, trigger multi-step workflows, and access modern machine learning models (collectively, the "Services").
This Privacy Policy explains how we collect, use, process, disclose, retain, and protect personal information when you access or use our websites (including https://rhaone.ai/), application dashboards, APIs, software development kits (SDKs), enterprise connectors, and related digital touchpoints.
Important Distinction: Data Controller vs. Data Processor
RHA OneAI is architected primarily for organizational and enterprise use:
Customer Content (Data Processor): When you or your organization submit prompts, connect workplace applications (e.g., Google Drive, Slack, Jira), upload internal documents, or generate AI outputs, your organization is the Data Controller (or Data Fiduciary under the India DPDP Act), and RHA OneAI acts as a Data Processor (or Data Processor on behalf of the Data Fiduciary). Our processing of Customer Content is governed by our enterprise customer agreement and Data Processing Addendum (DPA).
Account & Operational Data (Data Controller): RHA OneAI acts as a Data Controller for account registration information, direct billing records, administrator contact details, support communications, and website telemetry collected to administer accounts and secure platform operations.
Section 02
Information We Collect
The categories of information we process depend on how you interact with our platform, the specific features enabled by your organization, and the integrations configured for your tenant.
2.1 Account and Authentication Information
When an account is created or administered, we collect your full name, professional work email address, job title, organizational affiliation, tenant identifiers, and authentication credentials. For enterprise accounts utilizing Single Sign-On (SSO) via SAML 2.0 or OpenID Connect (OIDC) (such as Google Workspace, Microsoft Entra ID / Azure AD, or Okta), we collect identity assertion attributes provided by your identity provider. We do not receive or store your identity provider's master password.
2.2 Prompts, Conversations, and Uploaded Content
When using RHA OneAI agents, chat interfaces, or workflow builders, we process the text prompts, system directives, conversation transcripts, AI-generated completions, uploaded documents (e.g., PDFs, spreadsheets, code files), and vector embeddings derived from uploaded files. This data is processed within your organization's isolated tenant space to fulfill workflow requests, maintain session state, and provide audit logging where enabled.
Enterprise Usage Notice: Users should avoid submitting unnecessary sensitive personal information (such as government IDs, unencrypted financial records, or special category data) unless specifically authorized by their organization's internal governance guidelines.
2.3 Connected Enterprise Workplace Information
When your organization authorizes enterprise data connectors (such as Google Drive, OneDrive, SharePoint, Slack, Microsoft Teams, Jira, Confluence, Notion, GitHub, PostgreSQL, or Snowflake), RHA OneAI connects to those services to retrieve relevant context. We only access documents, channels, ticket metadata, and records within the authorized permission scopes configured by your administrator. RHA OneAI respects source Access Control Lists (ACLs) so that users cannot query information they do not have rights to view in the underlying source system.
2.4 Integration Credentials and Secrets
Connecting third-party systems requires OAuth 2.0 access tokens, refresh tokens, API keys, or webhook secrets. All credentials are encrypted both in transit and at rest using industry-standard AES-256 encryption with cloud Key Management Services (KMS). Credentials are only decrypted in memory within sandboxed microservices to execute authorized synchronization or retrieval tasks. Administrators retain full control to revoke tokens and disconnect connectors at any time.
2.5 Usage Telemetry, Diagnostics, and Technical Information
To ensure platform reliability, security, and performance, we automatically capture technical logs, including IP addresses, browser user agent, device operating system, request timestamps, response latencies, agent step execution outcomes, error stack traces, and API rate limits. Operational telemetry is scrubbed of customer prompt and document payloads and used solely for platform observability, abuse prevention, and infrastructure scaling.
2.6 Support and Inquiries
When you communicate with our support, sales, or security personnel, we collect your contact details, correspondence transcripts, and any diagnostic logs or screenshots voluntarily submitted to troubleshoot technical issues.
Section 03
How We Use Information & Legal Bases
We process personal and organizational information strictly in accordance with applicable data protection laws and enterprise contractual commitments.
Performance of Contract & Legal Compliance (Art. 6(1)(c) GDPR)
Customer Support & Troubleshooting
Support tickets, email communications, error diagnostics
Performance of Contract / Legitimate Interests
Advisory on AI-Generated Outputs
AI models operate probabilistically. While RHA OneAI incorporates ground-truth retrieval mechanisms (RAG) and citation verification, outputs may occasionally be incomplete or inaccurate. Organizations and individual users are responsible for validating critical outputs before making consequential operational, financial, or legal decisions.
Section 04
AI Models & Zero-Training Guarantee
The RHA OneAI Enterprise Zero-Training Guarantee
We strictly guarantee that your proprietary enterprise data-including prompts, connected document contents, database schemas, internal communications, vector embeddings, and generated answers-is NEVER utilized to train, retrain, or improve foundational large language models (LLMs), whether operated by RHA OneAI or third-party foundation model providers.
All inference routed through commercial model providers utilizes enterprise-tier commercial API agreements governed by strict zero-data-retention (ZDR) or non-training clauses. Customer inputs are never fed into consumer training pools or used for advertising.
Model Routing Architecture
RHA OneAI features an LLM-agnostic orchestration engine. Depending on your organization's preferences and deployment configurations, inference requests may be routed to:
Enterprise Foundation Providers: OpenAI (API / Azure OpenAI Service), Google Cloud Vertex AI (Gemini), Anthropic (Claude Commercial API), Groq Cloud, or Moonshot AI (Kimi).
Private & Customer-VPC Deployments: Organizations requiring complete network isolation can configure RHA OneAI to route requests exclusively to private endpoints running inside their own cloud tenant (e.g., Azure OpenAI Dedicated, AWS Bedrock, or self-hosted vLLM clusters).
Ephemeral Processing: When an inference request is routed to an external enterprise model endpoint, only the prompt, context retrieved for that specific query, and attachments are transmitted. Once the response is generated, the provider executes ephemeral in-memory processing without retaining customer data beyond the contractually defined transient security buffer.
Section 05
Subprocessors & Third-Party Service Providers
To deliver scalable enterprise infrastructure, high-availability search, and advanced AI agent capabilities, RHA OneAI engages qualified third-party subprocessors. Each subprocessor is vetted through rigorous security assessments and bound by Data Processing Agreements incorporating standard contractual safeguards.
Enterprise customers may request our current comprehensive subprocessor register or subscribe to subprocessor update notifications by emailing compliance@rhaone.ai.
Section 06
Data Retention & Deletion Lifecycle
We retain personal and tenant data only for as long as necessary to fulfill the purposes set out in this policy, maintain contractual SLAs, resolve disputes, and comply with statutory obligations.
Tenant Prompts & Conversations
Configurable by organization administrators. Retained for active workspace history until deleted by user or purged via tenant retention policy.
Connector Access Credentials
Retained while the connector is active. Purged immediately upon connector revocation or tenant deprovisioning.
Audit & Observability Logs
Retained for 90 to 365 days for forensic tracking, security auditing, and compliance monitoring, then securely overwritten.
Encrypted Disaster Recovery Backups
Rolling automated database snapshots are retained for up to 30 days before permanent cryptographic erasure.
Tenant Deletion & Termination: Upon termination of your enterprise agreement, RHA OneAI deletes all customer tenant data, vector indices, and integration secrets within 30 days, with rolling backups purged within 30 days thereafter, except where preservation is required by applicable law.
Section 07
Enterprise Security & Protection
RHA OneAI implements comprehensive administrative, physical, and technical controls designed to protect enterprise information against unauthorized access, destruction, alteration, or disclosure.
Encryption Everywhere
All data in transit is protected using TLS 1.3 with Perfect Forward Secrecy. Data at rest (databases, object storage, vector embeddings, backups) is encrypted using AES-256.
Logical Tenant Isolation
Multi-tenant architecture enforces strict logical data partitioning at the database and search-index layers, preventing cross-tenant leakage.
Access Governance (RBAC)
Role-Based Access Controls enforce the principle of least privilege. Production access requires hardware-backed multi-factor authentication (MFA) and is strictly audited.
Sandboxed Code Execution
Diagnostic agent scripts and comparative analytics tasks execute within ephemeral, network-isolated sandboxes with automatic teardown upon completion.
While we maintain continuous security monitoring and penetration testing, no method of transmission or electronic storage is completely impenetrable. Organizational administrators must maintain strong password hygiene, enforce MFA across corporate identity providers, and safeguard API credentials.
Section 08
International Data Transfers
RHA OneAI operates globally, with core systems and infrastructure hosted in regional data centers across the United States, the European Union, and India. Depending on your organization's geographical location and contractual settings, your information may be processed in countries other than your own.
Cross-Border Transfer Safeguards
Standard Contractual Clauses (SCCs): For transfers from the EEA, Switzerland, or the UK, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
India DPDP Act 2023 Alignment: For personal data originating in India, transfers are conducted in full compliance with Central Government regulations and cross-border data transfer guidelines.
Dedicated Regional Residency: Enterprise customers with strict data residency mandates may contractually specify regional hosting locations (e.g., India-only or EU-only data processing zones).
Section 09
Privacy Rights & Regional Disclosures
Depending on your jurisdiction and applicable data protection legislation (such as GDPR, UK GDPR, CCPA/CPRA, or the India DPDP Act), you may hold specific statutory rights regarding your personal information.
1. European Economic Area & United Kingdom (GDPR / UK GDPR)
Data subjects hold the right to access, rectify, or request erasure of personal data; the right to restrict or object to processing; the right to data portability; and the right not to be subject to decisions based solely on automated processing having legal effects. You also have the right to lodge a complaint with your local Data Protection Authority.
2. California & US State Privacy Rights (CCPA / CPRA)
California residents hold the right to know what personal information is collected, disclosed, or sold; the right to delete personal information; the right to correct inaccurate information; and the right to non-discrimination for exercising privacy rights.
Statutory Disclosure: RHA OneAI does NOT sell your personal information and does NOT share your personal information for cross-context behavioral advertising.
3. India Digital Personal Data Protection Act (DPDP Act, 2023)
Data Principals have the right to obtain a summary of personal data being processed, request correction and erasure of personal data, seek grievance redressal, and nominate an individual to exercise rights in the event of death or incapacity.
How to Submit a Data Rights Request
For Enterprise Workplace Content: If your account is provisioned by your employer or institution, your organization is the Data Controller. Please direct inquiries regarding internal records, chat histories, and workplace connector files to your organization's workspace administrator.
For Direct Accounts & General Inquiries: You may submit privacy requests directly to compliance@rhaone.ai. We verify requests and respond within statutory timeframes (normally 30 calendar days).
Section 10
Organizational Accounts & Governance
If you access RHA OneAI using an email address provided by your employer or organization, your account is an "Organizational Account." Your organization administers your workspace, controls access permissions, designates authorized integrations, and determines internal data retention schedules.
Organizational administrators may access conversation transcripts, inspect tool invocation logs, configure connector scopes, and suspend or terminate user seats. Your use of RHA OneAI is subject to both this Privacy Policy and your employer's internal acceptable use policies.
Section 11
Children's Privacy
RHA OneAI is exclusively an enterprise business platform intended for professional and workplace use. Our Services are not directed to individuals under 18 years of age (or the legal age of majority in your jurisdiction). We do not knowingly collect personal data from children. If you believe a minor has provided personal information to us, please notify us immediately at compliance@rhaone.ai so we can delete the information promptly.
Section 12
Changes to This Privacy Policy
We may revise this Privacy Policy periodically to reflect enhancements to our platform, changes in statutory requirements, or operational updates. When revisions occur, we will update the "Effective Date" at the top of this policy. For material changes that significantly affect your rights or data processing terms, we will provide advance notice via email to tenant administrators or through a prominent notice within the application interface.
Section 13
Contact Information & Grievance Redressal
For privacy inquiries, Data Processing Addendum execution, data subject rights requests, or questions regarding our security architecture, please contact our privacy and compliance team:
Responsible Legal Entity
RHA Technologies Private Limited
3rd Floor, Unit No 311 C, D-21 Corporate Park, Sector 21, Dwarka, New Delhi - 110077, Delhi, India