Total documents
Total fields
Estimated character/word/token counts
|Count of documents across data sets Count of fields in all documents.
Volume Metrics for Content
| | Taxonomy Metrics | Count of themes, sub-themes, tags, and tag applications | | AI Usage Metrics | Counts of AI suggestions, annotations applied. | Number of reports/widgets Count of Created Reports Platform Configuration Snapshots Roles, deployment, and AI configuration **What is NOT aggregated:** Individual documents, user personal data, actual content text, or file attachments are not copied. Only aggregated counts and configuration metadata are collected. The platform context fields (which are text descriptions of your organization's research goals that you configure in the platform) are aggregated as part of configuration metadata. These may contain descriptions of your organization's work. **Who has access:** Only Dots internal staff with @ooloilabs.in email accounts can access the mothership tenant. Access is enforced at the middleware level — all API requests to the analytics tenant (except login) require a JWT token from a user with an @ooloilabs.in email domain. ### **6. AI Systems & Third-Party Model Providers** Dots integrates AI capabilities powered by third-party large language model (LLM) providers. This section describes what data flows to which providers and their respective data policies. #### 6.1 OpenAI — Primary AI Provider **What data is sent to OpenAI:** For chat-based Q\&A and analysis: * User's question/query * Conversation history (previous Q\&A pairs in the session) * Data schema (field names, types, labels, and sample values from your content types) * Platform context (your configured research goals/domain description) * Tool call results (aggregated metrics, document excerpts retrieved from your database) For document embeddings (vector representations): * Text content from your documents (chunked text fields) * Annotation text excerpts * Document summaries For AI annotation/categorization: * Document text content (the specific text being annotated) * Tag taxonomy (your themes, sub-themes, and tags) * Platform context For document summarization: * Document text (truncated to token limits) * Platform context **OpenAI's data policy (for API usage):** * **OpenAI does NOT use API data to train models** (since March 1, 2023). Data sent through the API is not used to train or improve OpenAI's models unless you explicitly opt in (we have not opted in). * **Data retention:** API data is retained for up to **30 days** for abuse monitoring purposes, then deleted. * Eligible customers can request Zero Data Retention (ZDR). See *OpenAI Data Controls and OpenAI Data Usage Policy.* #### 6.2 Anthropic (Claude) — Secondary AI Provider \[BETA Features] **What data is sent to Anthropic:** For report generation: * User's report request/query * Data schema and platform context * Report plan (structured plan generated in a prior step) Gathered data (aggregated metrics and retrieved data) For pattern analysis: * Statistical analysis of annotations (tag prevalence, co-occurrence, lift scores) * Aggregated statistics only — not individual document data * Platform context for grounding insights **Anthropic's data policy (for API usage):** A**nthropic does NOT use API data to train models** under commercial terms, unless the customer explicitly opts in (we have not opted in). **Data retention:** API logs are retained for **7 days** (as of September 15, 2025), then fully deleted within 30 days. See *Anthropic Privacy Center.* #### 6.3 Sarvam AI — Speech-to-Text Provider \[Add-on Only] **What data is sent to Sarvam:** Audio files uploaded by your users (downloaded from GCS and sent as multipart form data) Audio is processed for speech-to-text transcription and optionally English translation with speaker diarization **Sarvam's data policy:** Sarvam collects the text, queries, and inputs you send and the responses returned. **Sarvam reserves the right to use input and output data to train, improve, and further develop their product.** Users explicitly consent to this by using the service. This is a notable distinction from OpenAI and Anthropic, which do not use API data for training by default. See *Sarvam AI Privacy Policy and Sarvam AI Terms of Use.* **Important note for clients:** If you use the Sarvam audio transcription import feature, the audio data you upload will be sent to Sarvam's API, and per their current terms, Sarvam may use that data to improve their models. If this is a concern, please discuss alternative transcription options with us. #### 6.4 ElevenLabs — Speech-to-Text Provider \[Add-on, Emerging] **What data is sent to ElevenLabs:** Audio files uploaded by your users (downloaded from GCS and sent via ElevenLabs' API). Audio is processed for speech-to-text transcription and, where enabled, translation. ElevenLabs is being introduced as an alternate option to Sarvam for these features. **ElevenLabs' data policy:** By default, ElevenLabs' general privacy policy permits the company to use voice, text, and related data to research, develop, and improve its AI models. **Dots has opted out of this model-training use.** Audio and text sent to ElevenLabs as part of Dots' services is not used by ElevenLabs to train or improve its models. This is a notable distinction from Sarvam, which by default reserves the right to use input/output data for model improvement. See *ElevenLabs Privacy Policy.* **Important note for clients:** Dots is finalizing its commercial terms with ElevenLabs and will update this policy to confirm any additional data-handling details as this integration goes live. #### 6.5 How AI Data is Stored Locally After AI processing, results are stored in your tenant's database. | **Collection** | **What is stored?** | | ------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |AI Chat
SYSTEM\_AISuggestionCache
|Chat conversation history (user queries and AI responses), related document references, query metadata
Cached AI annotation suggestions per document field, with tag mappings and justifications.
| | embeddings (MongoDB) | Text chunks with 1,536-dimensional vector embeddings. | *chunks / annotations (Elasticsearch) Vector embeddings indexed for semantic search* *SYSTEM\_DocumentSummary AI-generated document summaries with hash-based invalidation* AI chat conversations are scoped to the user who created them — other users cannot access your chat history (enforced via user ID matching on read queries). #### 6.6 AI Data Access Control * Only content types that are explicitly enabled in your AI configuration are included in AI processing * Field-level filtering ( includeFields / excludeFields ) allows you to control which fields are visible to AI systems * ACL-based scoping restricts what data appears in AI responses based on user permissions ### **7. Access Control and User Management** #### 7.1 Role-Based Access Control (RBAC) Dots implements a granular role-based access control system that allows organizations to define who can view, edit, annotate, export, or administer data. Roles can be customized to match organizational hierarchies and project-specific requirements. Access permissions are enforced at the platform level, ensuring that users can only interact with data they are authorized to access. #### 7.2 Authentication User authentication is managed through secure credential systems. Dots supports password-based authentication with enforced complexity requirements. The platform supports integration with enterprise identity providers for single sign-on (SSO) capabilities where applicable. #### 7.3 Session Management Active user sessions are subject to configurable timeout policies. Sessions are invalidated upon logout, and inactive sessions expire automatically. Session tokens are generated using cryptographically secure methods and are resistant to prediction and replay attacks. #### 7.4 Audit Logging All user activities within the Dots platform are logged. Audit logs capture information including the user identity, action performed, timestamp, affected data record, and originating IP address. These logs are retained for a defined period and are available to authorized administrators for compliance and forensic review. ### **8. Third-Party Integrations and Data Sharing** #### 8.1 Integration Security Dots supports integrations with external applications and services. All third-party integrations are vetted for security compliance before they are made available on the platform. Data exchanged through integrations is transmitted over encrypted channels, and API keys and authentication tokens are stored securely. #### 8.2 Data Sharing Dots does not share customer data with third parties except where explicitly authorized by the customer or required by law. When data sharing is necessary for service delivery (for example, with a cloud hosting provider), Dots ensures that appropriate data processing agreements are in place with the third party. #### 8.3 Sub-Processors A list of sub-processors used by Dots is available upon request. Customers are notified of material changes to the sub-processor list, and Dots ensures that all sub-processors are contractually bound to equivalent data protection standards. ### **9. Data Retention and Deletion** #### 9.1 Retention Policy Dots retains customer data for as long as the customer’s account remains active and as required for the purposes for which the data was collected. Organizations can configure retention periods for specific data categories within the platform. #### 9.2 Data Deletion Upon termination of a customer’s subscription or upon a valid deletion request, Dots will permanently delete or anonymize all customer data within a defined timeframe (typically 30 days), unless a longer retention period is required by law. Deletion is performed across all systems, including primary databases, backups, and logs. #### 9.3 Data Export Customers can export their data from the Dots platform at any time in standard, machine-readable formats. Dots supports full data portability to ensure that organizations are not locked into the platform. ### **10. Incident Response** #### 10.1 Incident Detection Dots employs continuous monitoring and alerting systems to detect potential security incidents. Automated threat detection tools monitor for unauthorized access attempts, anomalous data patterns, and system vulnerabilities. #### 10.2 Response Procedure In the event of a confirmed security incident, Dots follows a structured incident response procedure that includes immediate containment, root cause analysis, remediation, and post-incident review. Affected customers are notified promptly in accordance with contractual obligations and applicable legal requirements. #### 10.3 Notification Timeline Dots commits to notifying affected customers of a confirmed data breach within 72 hours of discovery, consistent with GDPR requirements and industry best practices. Notifications include a description of the incident, the data affected, measures taken, and recommended actions for the customer. ### **11. Internal Security Practices** #### 11.1 Personnel Security All Dots team members with access to customer data or production systems are bound by confidentiality agreements. Access to production environments is limited to authorized personnel on a need-to-know basis. #### 11.2 Security Training Dots conducts regular security awareness training for all employees. Training covers topics including data handling procedures, phishing awareness, incident reporting, and secure development practices. #### 11.3 Secure Development The Dots engineering team follows secure software development lifecycle (SDLC) practices. Code changes undergo peer review, and security testing is integrated into the continuous integration and deployment pipeline. Vulnerability assessments and penetration testing are conducted periodically. ### **12. Policy Updates** This policy is reviewed and updated at least annually, or more frequently as required by changes in law, technology, or business operations. Material changes to this policy will be communicated to customers through the Dots platform and via email notification. Continued use of the platform following notification of changes constitutes acceptance of the revised policy. ### **13. Contact Information** For questions, concerns, or requests related to data security and privacy, please contact the Dots team: ***Website:**