Privacy policy — Stagehand AI

The short version

Stagehand AI runs on your business’s own computer. Your conversations, contacts, bookings and quotes are stored there, not with us.
With Managed AI, what the AI needs to write each reply passes through our servers to Anthropic, a US company, which processes it in the United States and other countries where Anthropic runs its models. We do not store it. Under its current published policy, Anthropic deletes it within 30 days unless it is flagged for misuse or the law requires longer.
To check your license, Stagehand sends Stagehand Cloud this computer’s name, a one-way code made from its system ID and some technical details about every 12 hours, and we record its internet (IP) address. These checks never include your messages.
This website does not set cookies itself or run analytics.
We do not sell personal data, use it for advertising, or use your conversations to train AI models.
You can ask for a summary of your data, correct it or erase it by emailing info@gravaxis.in.

Who we are

Stagehand AI is a software product of Gravaxis Infrastructure LLP. Gravaxis Infrastructure LLP is a limited liability partnership registered in India. For the personal data described in this policy we are the data fiduciary: we decide why and how it is used. The exception is your customers’ and team’s data that we process for your business through Managed AI, where your business decides (see Your customers’ data).

Email: info@gravaxis.in
Post: Gravaxis Infrastructure LLP, 3B, 131/68, LDG Road, Little Mount, Saidapet, Chennai 600015, Tamil Nadu, India
Privacy questions and grievances: Our Grievance Officer, at the same email and address (details)

The law we follow

We handle personal data under India’s Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. We also follow the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as their provisions come into force; most of their duties for businesses are due to apply from May 2027. We already offer the rights that Act gives you, as described below.

This website

No cookies, analytics or ads from us. This site does not set cookies itself, run analytics, show ads or load anything from other companies. Fonts and images are served from this site. If Cloudflare’s security features ever need to check a visitor, Cloudflare may set a strictly necessary security cookie; it is not used for tracking or advertising.
Hosting. The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes technical data such as your IP address, browser details and the pages you request, to deliver the pages and protect the site from abuse. Cloudflare keeps its own records of these requests under its terms; we do not use them to identify or track visitors.
Theme choice. If you use the light or dark theme switch, your choice is saved in your own browser (local storage) so the site remembers it. It is never sent to us.
Email links. The buttons on this site open your own email app with a message addressed to info@gravaxis.in. Nothing is sent until you send it.

When you email us

When you write to info@gravaxis.in, we receive your email address and whatever you include, such as your name, business name, business type, city and preferred plan, or for billing questions the date, amount and reference of a payment. We use it to reply, to give you access to Stagehand AI, to set up and bill your subscription, to support you and to handle your requests. If you send us logs, screenshots or files for support, we use them only to help you.

If your business subscribes

When your business becomes a customer, we record in Stagehand Cloud: the business name; the contact person’s name, email address and phone number; the GSTIN and billing address; notes our team keeps about your account, such as what we agreed; your plan, add-ons and subscription status; and your payments (amount, date, period and payment reference).

Razorpay. If you pay through Razorpay, we send Razorpay your business name, contact email, phone number and GSTIN to set up your subscription, and Razorpay may contact you about it directly, for example to confirm a payment. You enter your card, UPI or bank details on Razorpay’s page: we never see or store them. Razorpay tells us the payment ID, amount and status.
Invoices and bank transfers. If we agree that you pay by invoice or bank transfer, we record the payment reference.
License emails. We email your license key and any payment links to the address you gave us, and our records note that we sent them and to which address.

Stagehand AI and Stagehand Cloud

Stagehand AI is self-hosted: it runs on your business’s own Windows PC or Linux server. Stagehand Cloud (cloud.stagehandai.gravaxis.in) is our online service for license checks, Managed AI and updates.

What stays on your computer

Conversations and messages, contacts and their WhatsApp numbers, CRM notes, leads, bookings, quotes, your knowledge base and prices, team accounts, media files and backups are stored on the computer where you install Stagehand. Stagehand has no remote-access feature and does not send us this data, apart from what Managed AI sends for each request (below). We do not access your installation. Updates we sign do run on your computer to install new versions (see Updates in our terms); they do not send us your data. Stagehand sends us no telemetry, crash reports or usage analytics; its Analytics page is calculated on your computer.

License activation and checks

When you activate a license, and then about every 12 hours while Stagehand runs, Stagehand sends Stagehand Cloud:

your license key (when you activate) or the signed license it was given;
a random installation ID that Stagehand creates;
a one-way code (a salted hash) made from the computer’s system ID: on Windows the MachineGuid, on Linux the machine-id, or if neither is available, the computer’s name and network adapter address. The system ID itself never leaves the computer. The code is the same every time for the same computer, so it identifies that computer to us: it is not anonymous;
the computer’s name, which often includes a person’s name (for example RAVI-LAPTOP);
the operating system, processor type and Stagehand version.

Stagehand Cloud also records the internet (IP) address the computer connects from. We store these details with your license, with the times the computer was first and last seen, so that one license works on one computer, to detect copied licenses, and to show you which computer holds your license. When you deactivate a computer, we record that too. These checks never send your messages, contacts or bookings. Stagehand also asks Stagehand Cloud for your license status and AI reply count, to show them in the dashboard; we do not store anything from those requests, apart from our server logs (see How long we keep data).

Keep your license key secret. If someone enters a key that is already active on another computer, Stagehand Cloud shows them a shortened form of that computer’s name (its first three characters and last character), its operating system, Stagehand version and dates, so that the owner can find it.

Managed AI

On a managed plan (Starter, Growth and Pro, including the Hybrid add-on), each time the AI writes something, Stagehand sends the request through Stagehand Cloud to Anthropic, PBC, which writes it with its Claude models. A request contains what the AI needs to answer well:

the recent messages in the conversation, including your team’s replies. Long messages are shortened. Photos, videos, voice notes and documents are not sent, only their captions and file names; for a shared location, only its name is sent;
your business details: name, contact details, address, opening hours, services, prices, your policies (including your cancellation policy), the voice guidance you write for the assistant, and relevant knowledge-base entries;
what Stagehand knows about that customer: their name and WhatsApp display name, email, company, tags, whether they are marked VIP or have opted out of follow-ups, facts your team recorded, their enquiry details and lead stage, bookings and quotes, a summary of the conversation, and a summary of what your team told them. Your team’s private CRM notes are not sent;
the results of lookups the AI makes, such as availability and prices.

Stagehand does not add the customer’s WhatsApp number to requests, but it is sent if it appears in a message. Requests are made for replies to customers, suggested replies, follow-up drafts, conversation summaries, summaries of your team’s messages when a chat is handed back to the assistant, and replies to messages that arrived while Stagehand was off.

Our servers pass each request to Anthropic and the reply back to you. We do not store or log the content. We keep only usage records: the time, the AI model, the size of the request and reply in tokens, how long it took, what it cost, and a one-way code of the reply’s internal ID, which we use to count AI replies against your plan. Anthropic processes the content for us as our sub-processor, under its commercial terms, in the United States and other countries where Anthropic runs its models. Under Anthropic’s current published policy, it deletes this content within 30 days unless it is flagged under its usage policy (then it may keep it for up to 2 years) or the law requires longer, and by default it does not use it to train its models. Anthropic may also keep the start of a request for a few minutes to answer the next one faster.

If you do not want any conversation content to leave your computer, use Local AI.

Local AI

With Local AI (the Local plan, and the Hybrid add-on when Managed AI is unavailable or paused by a usage limit), the AI runs in Ollama on the same computer as Stagehand. Conversation text is not sent to us or to any AI service. When you choose to download a model, Ollama fetches it from ollama.com, which sees your IP address.

Updates

About every 6 hours while the computer is activated, Stagehand asks Stagehand Cloud whether a newer version exists. It sends its signed license, version, operating system, processor type and update channel, and our service sees its IP address. The check continues after a subscription ends, but new versions are offered only while your subscription is active. Updates are downloaded from Stagehand Cloud. We keep only a count of downloads, not a record of each check, apart from our server logs (see How long we keep data).

Other connections Stagehand makes

Stagehand connects to WhatsApp as a linked device: your messages travel between your computer and WhatsApp’s servers under WhatsApp’s own terms, not through us. If the computer has no Microsoft Edge, Google Chrome or Chromium, Stagehand downloads a browser component once from Google’s download servers. These services see your IP address.

Your customers’ data

If your business uses Stagehand AI, your business decides what personal data about its own customers Stagehand holds and why. Your business is the data fiduciary for that data and is responsible for handling it lawfully: having a lawful reason to use it, telling its customers how their data is used and that an AI assistant may answer them (with Managed AI, at the start of each conversation, as our terms require), and answering their requests.

When your business uses Managed AI, Gravaxis processes that data on your business’s behalf, only to produce each piece of writing it asks for, under the data processing terms in our terms of service.

If you are a customer of a business that uses Stagehand AI, please contact that business about your data. If you write to us instead, we will tell you how to reach it, or pass your request on where we can.

Sensitive personal data

We do not ask for sensitive personal data such as health or biometric information. Card, UPI and bank details you use in Razorpay’s payment pages go to Razorpay directly, not to us. If you pay us by bank transfer, or ask us to refund you to a different bank account, we receive the bank account details you give us; we use them only for that payment or refund and keep them with our billing records. License keys work like passwords, so we store them only as one-way codes.

Your customers may put sensitive details, such as health information, in their messages. With Managed AI those pass through to Anthropic like the rest of the conversation. If your business often receives such messages, consider Local AI, and keep approvals on.

Why we use personal data

To answer your enquiries and give you access to Stagehand AI.
To provide Stagehand AI under our agreement with your business: license activation and checks, Managed AI, updates and support.
To bill you and keep the accounts and tax records the law requires.
To protect the service: to stop licenses being copied or misused, to prevent abuse and attacks, and to keep security logs.
To tell you about important changes to Stagehand AI, your subscription and these policies.

Most of this data is given to us by you or your business for these purposes, and we use it only for them. Where we rely on your consent, you can withdraw it at any time by emailing us; that does not affect what we did before, but if the data is needed to provide Stagehand AI, we may then be unable to provide it. We send marketing emails only if you ask for them.

We do not sell personal data. We share it only with these service providers, who act for us and must protect it. We are putting written data protection terms in place with each of them.

Cloudflare, Inc.: Hosts this website. Visitors’ IP addresses, browser details and the pages they request. Location: Cloudflare’s global network, including outside India.
Anthropic, PBC: Writes Stagehand Managed AI replies with its Claude models, as our sub-processor. The content of each Managed AI request (described above) and the reply. Location: The United States and other countries where Anthropic runs its models.
Razorpay Software Private Limited: Takes subscription payments and sets up payment mandates, once our online payments are live. Business name, contact email and phone number, GSTIN, and our internal customer and subscription references. You give your card, UPI or bank details to Razorpay directly. Location: India.
Our email provider: Carries email to and from info@gravaxis.in, including license keys and payment links. Names, email addresses and what the emails say. Location: May be outside India.
Our server hosting and backup storage providers: Run Stagehand Cloud: its servers, database, backups and logs. Everything Stagehand Cloud stores (described above), and Managed AI requests while they pass through our servers. Location: May be outside India.
Our accounting and invoicing provider: Prepares our GST tax invoices and keeps our accounts. Business name, GSTIN, billing address, contact email, and the amounts, dates and references of payments. Location: May be outside India.

We will name our email, server hosting and accounting providers on this page once those terms are in place.

We also share personal data with our professional advisers, such as accountants and lawyers, who must keep it confidential, and with government authorities, courts or regulators when the law requires it.

WhatsApp, the Ollama project and browser publishers are not our service providers: Stagehand connects to them for you, and they act under their own terms.

Transfers outside India

Some of this processing happens outside India. Managed AI requests are processed by Anthropic in the United States and other countries where Anthropic runs its models. Cloudflare serves this website from its global network. Our email, server hosting and accounting providers may store data outside India. We transfer personal data abroad only as needed to provide our service, to providers that must protect it, and we will follow any restriction the Government of India sets on transfers to particular countries. With Local AI, conversation content stays on your computer.

How long we keep data

Some of these periods are applied automatically by Stagehand Cloud; others are rules we apply ourselves. We say which.

Visits to this website: We keep no records. Cloudflare keeps its own under its terms.
Emails that do not lead to a subscription: We delete them about 1 year after our last exchange (a rule we apply ourselves).
Your account and contact details: While your business is a customer. After that, until you ask us to erase them, except what we must keep as billing records.
Billing records: Business name, GSTIN, billing address, invoices, payments, subscription details (including Razorpay references), bank details you gave us for a payment or refund, AI reply counts and monthly usage totals: for at least as long as tax and accounting law requires (currently about 8 years). We do not yet delete them automatically after that; you can ask us to once that period has passed.
License and activation records: Until your data is erased: we revoke licenses but do not delete them. A deactivated computer’s name is deleted automatically 90 days after it is deactivated. The installation ID and device code stay with the license record until your data is erased.
IP addresses: Deleted automatically: in license records, 90 days after the computer’s last contact; in our records of actions on your account, 90 days after the action. Server logs are separate (below).
Managed AI content: Not stored by us. Anthropic: deleted within 30 days, unless flagged under its usage policy (up to 2 years) or the law requires longer.
Managed AI usage records: Records of each request (time, model, size, cost): deleted automatically after 400 days. A one-way code of each AI reply’s internal ID, with its reply count, and the monthly usage totals: with your billing records (above). None of these contain content.
Records of actions on your account: For example, that we emailed you a license key and to which address: as long as your account exists. When we erase your data, we remove the personal data from them.
Security and system logs on our servers: We keep them for 180 days (Indian cyber-security rules require at least this). They can include IP addresses and, in error messages, details of the request.
License activation limits: To stop key guessing: a one-way code of the license key on each activation attempt, and the IP address used (for IPv6, its network range) on failed attempts. Deleted automatically after 7 days.
Backups of Stagehand Cloud: Nightly backups: 14 days (the newest 3 are always kept). Copies taken before a software upgrade are kept until the next upgrade. Data we erase can remain in a backup until that backup is replaced.

How we protect data

Connections between Stagehand and Stagehand Cloud are encrypted (HTTPS).
We store license keys only as one-way codes, plus their last 4 characters so you can recognise them.
A computer’s system ID never leaves it; we store only a one-way code made from it.
Managed AI content is held only in memory while a request is processed.
Access to Stagehand Cloud’s administration is limited to Gravaxis staff who need it, with passwords, two-step sign-in and a record of their actions. Signing keys and sign-in secrets are stored encrypted.
We back up Stagehand Cloud every night.

No security measure is perfect, and we cannot promise that data will never be accessed without permission. Because Stagehand AI is self-hosted, keeping your computer, its backups and your team’s accounts secure is in your hands; Stagehand includes team roles, an audit log and encrypted backups to help.

If something goes wrong

If a personal data breach affects you, we will tell you by email without undue delay: what happened and when, what it may mean for you, what we have done, what you can do, and who to contact. We will also report it to the Data Protection Board of India and to CERT-In as the law requires. If a breach affects data we process for your business through Managed AI, we will tell your business so that it can meet its own duties.

Your rights

You can ask us:

for a summary of the personal data we hold about you and what we do with it, and the names of the other businesses we shared it with and what we shared;
to correct, complete or update it;
to erase it, where we no longer need it and the law does not require us to keep it;
to withdraw consent you gave us, for the future;
to let someone you nominate exercise these rights for you if you die or become unable to;
to address a grievance (see below).

These rights come from the Digital Personal Data Protection Act, 2023. We offer them now, before that Act’s duties fully apply.

How to ask

Email info@gravaxis.in (the link fills in the subject), or write to us at our address. Tell us your name and the email address or phone number we hold. If your business is a customer, also give the business name and the last 4 characters of your license key; never send the whole key. We may ask you to confirm the request from the email address we hold before we act. We acknowledge requests within 2 working days and complete them within 30 days.

What erasing an account means

While your business has a subscription that is active, in a trial or waiting for payment, we cannot erase the data we need to provide it; cancel first. When we erase your account, we remove the contact person’s name, email and phone number, our notes, computer names, installation IDs, device codes and IP addresses, and we revoke the license. We keep the business name, GSTIN, billing address and payment records where tax law requires it. Razorpay keeps its own payment records under its terms and the law; you can contact Razorpay too.

Language

This policy is in English. If you need it in another language listed in the Eighth Schedule to the Constitution of India, such as Tamil or Hindi, email us and we will provide a translation.

Grievance Officer

If you have a concern about how we handle personal data, or a complaint about Stagehand AI, contact our Grievance Officer:

Designation: Grievance Officer, Gravaxis Infrastructure LLP
Email: info@gravaxis.in
Post: 3B, 131/68, LDG Road, Little Mount, Saidapet, Chennai 600015, Tamil Nadu, India

The email link fills in the subject. We give each grievance a reference number, acknowledge it within 48 hours and resolve it within one month. Once the relevant parts of the Digital Personal Data Protection Act, 2023 are in force (expected from May 2027), you may also complain to the Data Protection Board of India if you are not satisfied with our answer.

Children

This website and Stagehand AI are for businesses, not children, and we do not knowingly collect children’s personal data. If your business’s customers include children, your business is responsible for their data, including getting a parent’s consent where the law requires it (see our terms).

Changes to this policy

If we change this policy, we will update this page and the date at the top. If a change significantly affects how we use our customers’ data, we will also email them before it takes effect.

Related: Terms · Cancellation and refunds · Delivery · Contact