Privacy Policy

A. Information you provide directly

• Email address and password (for email/password registration)
• Google account name and profile photo (if using Google OAuth)
• Chat messages, uploaded documents, and custom instructions entered in the workspace
• App Connector API credentials (e.g., WhatsApp Business tokens, Google OAuth, Daraz API keys) — automatically encrypted with AES-256-GCM authenticated encryption
• Sovereign RAG knowledge collections, custom legal/tax templates, and indexed document chunks
• Visual generation prompts and starting photographs uploaded for animation (under the Pak-Image and Pak-Video tools)
• Folder names, workflow automation pipelines, and thread titles you create
• Contact form submissions and universal feedback reports

B. Information collected automatically & Security Layer

• IP address and approximate geographic region (used for domestic micro-node routing and security)
• Amanah Gate Policy Interceptor: automatically scrubs and redacts Pakistani CNICs (XXXXX-XXXXXXX-X) and payment card numbers before storage
• Browser type, device type, and operating system
• Persistent guest identification cookies (pak_llm_guest_id) and device metrics cookies (pak_llm_guest_info)
• Immutable cryptographic ledger logs recording license subscriptions and workflow verification hashes
• Pages visited and time spent (via anonymized regional telemetry)
• Server-side request logs (retained for up to 30 days for security purposes)

C. Real-Time Sovereign Voice AI & Minimalist Zen Studio

• In-Memory Processing: Microphone audio is processed entirely in volatile RAM for real-time speech recognition (Faster-Whisper) and neural speech synthesis using the Standard English Model and Pak-LLM Voice of Awam across 34 regional languages and dialects.
• NIST SP 800-88 Zero Retention: In compliance with NIST SP 800-88 Media Sanitization Guidelines, raw voice audio recordings are NEVER stored, persisted, or logged to disk or permanent databases. Audio buffers are purged immediately upon transcription.
• Minimalist Clean Interface (No On-Screen Text): The Voice AI Studio interface operates in pure zen mode without printing user speech or AI responses as written text bubbles on the screen, safeguarding your privacy from shoulder-surfing, ambient screen recording, or unauthorized visual capture during spoken sessions.
• Transport & Vault Security: Voice WebSocket sessions use TLS 1.3 transport; stored credentials use AES-256-GCM.
• Pakistan PDPA Alignment: Strictly aligned with Pakistan's Personal Data Protection Act; only transcribed chat text is associated with your private user thread.

D. Multi-Agent Council, Custom Personas & Onboarding Telemetry

• Multi-Agent Voice Orchestra Telemetry: When interacting in Multi-Agent Voice Orchestra mode, operational telemetry (selected ethnic persona, solo vs council mode, latency in milliseconds, and MCP tools invoked) is logged to domestic database telemetry nodes to optimize cluster routing and speech model load balancing.
• Tenant-Isolated Custom Agent Personas: When you customize or write custom agent personas in the Voice Studio, your custom prompt instructions are stored in an encrypted, isolated database partition tied strictly to your authenticated account ID (custom_agent_personas). They are never shared with other tenants, exposed publicly, or utilized to train foundation models.
• Product Tutorial & Onboarding Discovery Analytics: Anonymized interaction milestones (onboarding launches, step views 1 through 5, skips, and completions) are logged to evaluate feature discoverability and streamline onboarding UX without tracking personally identifying data.

E. External Project API Keys & Webhook Telemetry

• Cryptographic API Key Security: When administrators generate external bearer API keys (pak_live_...), only a cryptographic SHA-256 hash (admin_api_keys.key_hash) and non-sensitive key prefix are persisted in the database. Raw secret keys are displayed only once upon generation and are never stored in plaintext.
• HMAC-SHA256 Signed Outbound Webhooks: Outbound webhook push transmissions to third-party endpoints (e.g. Gravitas Minds, customer CRMs) are signed using per-webhook HMAC-SHA256 secrets in the x-pakllm-signature-256 header.
• Delivery Audit Logs & Ephemeral Retention: Outbound webhook delivery logs (admin_webhook_deliveries) retain the event type, destination URL, delivery timestamp, response status code, latency (ms), and sanitized payload previews for diagnostic troubleshooting and audit verification.
• Zero Retention on REST Voice Endpoints: Voice audio generated or transcribed via public REST endpoints (/api/v1/voice/*) adheres strictly to NIST SP 800-88 zero-retention standards and is streamed ephemeral-only.

F. App Connectors (Notion, Shopify, WhatsApp, Discord, Slack, GitHub, Google Cloud) & Opt-In / Opt-Out Security Model

• Zero Default Connectivity (Opt-In Policy): No external third-party connector is ever linked or activated automatically by default. Users must explicitly grant granular, per-service authorization before any data, webhook connection, or API token synchronization is established.
• Notion API & Workers Runtime (ntn.dev): When you connect Notion workspace integration tokens (ntn_... or secret_...), Pak-LLM processes only explicitly authorized pages, database entries, comments, and member profiles. Live webhooks (28 supported event types) are authenticated via challenge tokens and SSL endpoints.
• Shopify Store, Plus Custom App & Webhooks: Shopify Partner App (pak-llm-1 / Client ID 8e9225690c7aa015fcb19292a1c93bff) installs on Plus organization stores via custom distribution. Order created/fulfilled webhooks (API 2026-07) and storefront App Proxy requests (/apps/pak-llm) are verified cryptographically via HMAC-SHA256 signatures.
• Google Workspace & 1-Click Consent: Google Cloud OAuth tokens are used solely for user-instructed actions (drafting emails in Gmail, reading spreadsheet rows in Sheets, or indexing PDFs in Drive). Unverified developer consent warnings are bypassed only upon user's explicit authorization.
• WhatsApp Cloud API (Meta Graph v26.0): We collect and process only explicitly authorized business metadata, phone number IDs, and webhook message events under granted scopes. Message webhooks are authenticated via HMAC-SHA256 signatures.
• Discord Bot & Event Webhooks: Interactions and slash commands (/ask, /urdu, /tax, /daraz) are verified cryptographically using RFC 8410 Ed25519 signatures. Only the prompt and public user tag are processed; server message logs are never stored.
• GitHub Developer & CI/CD Action Generator: GitHub tokens are restricted to user-selected repository actions and rennf93/[email protected] workflow generation. Raw source code is analyzed ephemeral-only in memory.
• Instant One-Click Opt-Out & Data Erasure: When a user clicks "Opt-Out & Disconnect Account" on any connector in the Connectors Hub, all associated access tokens, refresh tokens, and webhook registrations are immediately and permanently erased from the PQC Vault and database partitions.

G. Information we do NOT collect

• Raw payment card or banking passwords (payment processing is handled directly via PCI-DSS certified gateways: Swich, JazzCash, EasyPaisa, Raast)
• Biometric voiceprints, voice recordings on persistent media, genetic records, or unencrypted government ID numbers
• Precise GPS location
• Third-party account passwords or unencrypted OAuth secrets

H. Sacred Islamic Knowledge Retrieval Governance

• Deterministic Verbatim Delivery: Holy Quranic verses (Medina Mushaf Uthmani text), authentic Kutub al-Sittah Hadiths, and classical Tafseer exegesis are served deterministically from verified canonical databases and cannot be modified or poisoned by prompt injection or model hallucination.
• Zero Religious Profiling: User queries seeking recitation, translation, or religious analysis are answered with scholarly objectivity and are never utilized to profile individuals or construct religious tracking profiles.