Who We Are
Ayut is run by Hiraki Labs (OPC) Private Limited, operating as Ayut (“we”, “us”). Our website is https://ayut.dev.
For the personal data described in this policy, we decide why and how it is used. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) we are the “data fiduciary”. Under the EU and UK GDPR we are the “controller”.
You can reach us at [email protected].
If you use Ayut through a company or team, that organisation may decide how some of the data in its projects is used, such as its work records. If you need a data processing agreement for your organisation, email us.
What Ayut Does With Your Code and AI Accounts
Ayut lets you run many AI coding agents on one project, with any AI, from any device, while you stay in charge. It helps to know where things happen.
- Agents run on your machines. They run on your own computer or on a server you control. Ayut does not run them for you and does not host your repository.
- You choose the AI. You bring your own accounts and keys. When an agent sends code or prompts to an AI provider, that goes from your machine to that provider. It does not pass through our servers. The provider’s own terms and privacy policy apply, and we are not a party to them.
- Your keys are not kept in our database. Provider keys are held on your device in the operating system’s secure store. Where a key has to pass through Ayut’s servers for a task, it is held in memory for a short time only and is not written to our database, logs or records. If you add a key to a note, a prompt or a log by mistake, it can end up in the record, so keep keys out of those.
- Deliberation runs on our servers. If you use the Deliberation view, the question and context you give it are sent from our servers to OpenRouter and the AI models you pick, using a key you add for that project. We store the question, the answers and the analysis with your work records. Do not put anything in a deliberation that you do not want sent to those providers.
- Ayut keeps a record of the work. This is the part that reaches our servers. See “Your work records” below. It can include short excerpts of code, such as a test failure, an error message or a file path, if an agent or a check prints them. We try to remove known secrets from records, but we cannot promise to catch every one.
What We Collect
Account details
When you register or sign in we collect:
- Your name and email address
- A hashed version of your password if you use one. We never keep the password itself. You can also sign in with an emailed link.
- Whether you have confirmed your email, and when you last signed in
- Your time zone, country, preferred language and display settings, if you set them or your browser provides them
- Security records such as the IP address of your last sign-in and failed sign-in attempts, used to protect your account
Billing details
We collect no billing details unless you buy something. When you buy a plan or the 7-day pass, payment is handled by our payment provider, Dodo Payments, which acts as merchant of record. Your card or bank details go to them, not to us, and they may collect billing country and tax details to take the payment and issue invoices. We receive limited details back, such as your plan, payment status, amounts, invoice and refund records, and the payment and subscription IDs we need to match a payment to your account.
Your work records
When you use Ayut to run work, our servers store the records that make up the project:
- Organisations, projects, members and their roles
- Tasks and the instructions, goals and plans you or your agents give them
- Which agents, AI tools and models were used for a task, and the settings and permissions you chose
- Attempts, test and check results and their output, reviews, findings, decisions, approvals and handoffs
- Evidence and artifacts attached to a task, such as digests, changed file paths, summaries or output
- Output lines sent by a connected machine while a task runs. These are limited in size.
- Delivery records, such as a build, test or deploy you started
- An audit trail of who did what, and when
This is what Ayut calls its change record. It is how you see history and how Ayut can show what happened and when.
If you work offline, the desktop app keeps these records on your device and sends them to us when you reconnect. Records you mark as local only stay on your device and are not synced to us.
Connected machines
When you connect a machine, we store its name, operating system, a device ID, the public part of its signing key, the actions it is allowed to take, and when it was last online. We also issue it a signed licence record that says what plan access it has and until when. Private keys and access credentials for the machine stay in your operating system’s credential store and are not kept in our records.
Technical data
When you use the website or app, our systems receive and log technical data such as your IP address, browser and device type, the pages and actions requested, request IDs, and error details. We use it to run the service, find faults, stop abuse and keep it secure.
Messages and support
If you contact us, we keep your messages, your email address and anything you send us, so we can help you and keep a record.
What We Do Not Collect
- We do not clone, scan or store your repository. We store the records described above, which can include file paths and short excerpts.
- We do not sell your data, and we do not use it for advertising.
- We do not use your code, prompts or work records to train AI models.
- We do not use tracking or advertising cookies. See our Cookie Policy.
Why We Use Your Data
We use personal data to:
- Create and secure your account, and sign you in
- Run Ayut: sync your records, show history, enforce your approvals and permissions, and keep your connected machines in step
- Take payments, give you access to your plan and handle refunds
- Send service emails, such as sign-in links, confirmations, security notices and billing messages
- Answer your questions and give support
- Keep the service safe: detect abuse, prevent fraud, enforce limits and fix faults
- Understand how the service performs, and improve it
- Meet our legal, tax and accounting duties
Our Legal Basis
Where GDPR or similar law applies, we rely on:
- Contract. To give you the service you signed up for: your account, records, syncing, plan and support.
- Legitimate interests. To keep the service secure, prevent abuse and fraud, monitor performance and improve Ayut. We do this in ways that should not override your rights.
- Legal obligation. To keep financial records and respond to lawful requests.
- Consent. Where we ask for it, for example for optional emails. You can withdraw consent at any time.
Under the DPDP Act we process your data on the basis of your consent and for the “legitimate uses” the Act allows, such as providing a service you asked for, meeting legal duties and keeping the service secure.
Who We Share Data With
We share personal data only with companies that help us run Ayut, and only for that purpose. They are bound to protect it. The ones we use for Ayut are:
- Dodo Payments. Takes payments and handles subscriptions, invoices and refunds.
- Amazon Web Services (Amazon SES). Sends our emails, such as sign-in links and receipts.
- Cloudflare. Provides Turnstile, which checks that sign-in and registration are done by a person, plus network, security and backup storage services. Cloudflare sees your IP address and browser signals when you visit the site.
- AppSignal. Performance and error monitoring. Sensitive fields such as passwords, tokens and email addresses are filtered out of what it receives.
- Axiom. Stores our server logs, which can include IP addresses and request details.
- PostHog. Used for product diagnostics and error tracking. It is on only where we have switched it on, and it does not run inside your browser.
- OpenRouter and AI model providers. Only if you use Deliberation. They receive the text you send to it and handle it under their own terms.
- Hosting providers. Our application and database servers are rented from a hosting provider. Your account and work records are stored there.
- Google Fonts. Our pages load fonts from Google. Your browser sends Google your IP address and browser details to get them.
We may also share data:
- With professional advisers, auditors and insurers, under confidentiality
- With authorities or courts, where the law requires it or to protect people from harm
- With a buyer or successor, if we merge with or sell our business. We would tell you first, and the same protections would continue.
We do not sell personal data. Your own AI provider receives only what your agents send it. The only feature where Ayut itself sends your text to an AI provider is Deliberation, described above.
International Transfers
We are based in India. Our service providers may process data in other countries, including the United States. If we move personal data across borders, we do so under the law that applies, using safeguards such as standard contractual clauses with the provider where required.
How Long We Keep Data
We keep personal data only as long as we need it.
- Account and work records. For as long as your account is open.
- If you delete your account. You can do this in Settings or by emailing us. We deactivate it straight away and sign you out everywhere. You have 30 days to change your mind. After that we delete your account and personal data permanently. Work records that other members of your project or organisation rely on may be kept (see below).
- Support messages. For as long as we need them to help you and to handle follow-ups.
- Sync receipts. The receipts that prove a record was synced are kept for at least 90 days, and by default about 150 days, so replays and repairs are safe. Then they are removed.
- Billing and tax records. For as long as the law requires.
- Logs and monitoring data. For a limited period set by each provider and by our own settings.
- Backups. Deleted data can remain in backups for a short time until they are overwritten.
- Disputes and legal claims. We may keep what we need to handle them.
Security
We protect your data with access controls and encryption in transit. On your device, records that are waiting to sync are encrypted. Access to our systems is limited to people who need it.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.
You also have a part in security: keep your password, keys and devices safe, and tell us at [email protected] if you think your account has been used by someone else.
Your Rights
You may have these rights over your personal data, depending on where you live:
- Access. Ask what we hold about you and get a copy.
- Correction. Ask us to fix data that is wrong or out of date.
- Deletion. Ask us to delete your data.
- Portability. Ask for your data in a common, machine-readable format.
- Objection and restriction. Ask us to stop or limit some uses, such as use based on legitimate interests.
- Withdraw consent. Where we rely on your consent, you can withdraw it at any time. This does not affect what we did before.
- Complaints. Tell us if you have a problem with how we handle your data, and we will try to put it right.
Under the DPDP Act you may also nominate another person to exercise your rights if you die or cannot act yourself, and you can complain to the Data Protection Board of India once you have used our grievance process. If you are in the EU or UK, you can complain to your local data protection authority.
To use any of these rights, email [email protected] from the address on your account. Please say what you want. We may need to confirm that you are the account holder before we act. We will reply within the time the law requires and aim to do so within 30 days. We do not charge a fee unless a request is clearly unfounded or excessive.
For grievances about your personal data, write to [email protected] with “Privacy grievance” in the subject line.
Some data we cannot delete on request, such as billing records we must keep by law. Work records and the audit trail belong to the project and its organisation, so records that other members also depend on may be kept. We will tell you what we kept and why.
If you live in California or another US state with a privacy law, you can ask to know what we hold, and to correct or delete it, and we will not treat you worse for asking. We do not sell personal information or share it for cross-context behavioural advertising.
Children
Ayut is a professional tool for developers. It is not meant for anyone under 18, and we do not knowingly collect personal data from children. If you think a child has given us personal data, email [email protected] and we will delete it.
Cookies and Local Storage
We use a small number of cookies and browser storage items to keep you signed in, remember your language and your light or dark choice, and protect forms. We do not use advertising or cross-site tracking cookies. The details are in our Cookie Policy.
Links and Third-Party Tools
Ayut works with AI providers, code hosts and tools that you choose and connect. This policy does not cover them. Read their privacy terms before you send them anything.
Changes to This Policy
We may update this policy from time to time. We will post the new version on this page. For material changes we will make reasonable efforts to tell you in advance, for example by email or a notice in the app.
Contact
Questions about this policy or your data? Email [email protected] or visit https://ayut.dev.