Privacy policy

In short

The rest of this page is the long version. If anything here is unclear, write to privacy@balajitech.xyz and ask.

Who this is

Sand is a business software service run by HESI, from India. In this policy, Sand, we and us mean HESI as the operator of the Sand service; you means the person or company using it.

Sand is sold to businesses and is not meant for personal use or for anyone under 18.

What Sand holds

Your account

• Your name, work email address and the name of your organisation.
• Your password, kept only as a one-way hash — it cannot be read back, by us or anyone else.
• Your settings, your team members and their roles.
• Billing details for your plan, where a plan is paid for.

Your records

The companies, contacts, deals, leads, tasks, notes and files you create, import or enrich in Sand. These are yours. We hold them to run the service for you and for no other purpose.

Your use of the service

• Sign-in times, IP address and browser, kept to spot abuse and to investigate problems.
• A random device number your browser keeps for the Sand app, so we can tell you by email when your account is signed in from a device it has not used before.
• The sign-up, sign-in and password-reset pages use Cloudflare Turnstile, an “I am human” check. Cloudflare looks at the browser to tell people from automated programs; it does not show adverts or track you across sites.
• Error reports and activity logs for the actions taken in your account.
• Which enrichments and outreach runs were used, so your plan can be counted.

This website

This site sets no advertising or tracking cookies. If you fill in a form here, we hold what you typed so that we can reply to you.

Google account data

Outreach is optional. If you choose to use it, you connect your own Google mailbox so that emails go out from your own address rather than from a stranger's. Connecting is your decision, and you can undo it at any time.

What Sand asks for, and why

What Sand stores

• The address of the connected mailbox and which permissions you granted.
• A refresh token, so Sand can keep sending without asking you to sign in every time. It is encrypted with AES-256-GCM before it is written down, and is never shown in the app or in any report.
• The emails Sand sent for you and their delivery state.
• Any reply forwarded to Sand's outreach address, stored against the contact it belongs to, so the thread reads in order.
• Meetings Sand created for you, and nothing else from your calendar.

Limited use

In plain words: data from your Google account is used only to provide the outreach features you turned on. It is never sold, never used for advertising, never used to train or improve generalised AI models, and never read by a person at Sand — except with your permission, to fix a problem you reported, or where the law requires it.

Taking it back

Disconnect the mailbox in Sand under Outreach → Mailboxes. Sand tells Google to cancel the token straight away and deletes its own copy. You can also remove Sand yourself at myaccount.google.com/permissions, and remove the forwarding rule in Gmail settings.

Microsoft account data

An Outlook or Microsoft 365 mailbox can be connected instead, and works the same way. Sand asks for openid, email and Mail.Send — permission to send from your address, and nothing that can read your mailbox. Replies reach Sand the same way, by a forwarding rule you create.

What Sand stores, how the token is protected, and how you disconnect are as described for Google above.

Business contact data

Sand keeps its own database of companies — website, industry, size, office address, a switchboard number — and of people in a business role at them: name, job title, company, work email address and a direct phone number, which can be a mobile. Sand's customers can search this database and, using credits, see a person's email address or number so they can contact them about business. This is business-to-business information about people at work, not information about their private life.

• It comes from public sources and from business data providers.
• Every field Sand fills carries a note of where it came from, so you can judge it.
• It is shown only to Sand's business customers, for business contact. Sand does not build advertising profiles and does not offer it for consumer marketing.
• Sand's terms forbid customers from reselling it or using it for spam.

If you are listed in Sand and want to be removed, use the Remove my data page. To see or correct what is held about you, write to privacy@balajitech.xyz. We will show you what Sand holds, correct it, or remove it and stop showing it to customers. If a customer has already saved your details in its own records, we pass your request on to them.

Where AI comes in

Sand uses language models to research a company, draft an email, and sort an incoming reply. To do that, the text involved — the company details, the draft, the reply — is sent to the model provider that runs the model.

• We use providers whose terms state that content sent through their API is not used to train their models.
• Nothing is sent to a model for advertising or for any purpose other than the feature you are using.
• Your records are not used to train any model of ours either.

Who else sees it

Sand never sells the records you put in it and does not share any data for anyone else's marketing. It is handled by:

• The people in your own organisation that you invited, according to the role you gave them.
• Our hosting and database providers, who run the servers the service sits on.
• Our language model providers, as described above.
• Sand's customers, who see the business contact details in Sand's own database, as described under Business contact data. They never see another customer's records.
• Business data providers, when Sand looks up a company or a person in a business role for its database.
• Our payment provider, for paid plans. Card numbers go to them, not to us — Sand never sees or stores a full card number.
• Us, where we need to look in order to fix a fault, stop abuse, or answer a support request you raised.

Some of these providers run their services outside India, so data may be processed there, under their own security and privacy terms. We will also disclose data where the law requires it, or to protect the rights and safety of our users. If the service is ever sold or merged, your data may move with it, and you will be told before that happens.

Where it is stored

Everything Sand holds lives in India. A few services we rely on handle some of it elsewhere, only for the job they do:

• Sand's servers and databases — Oracle Cloud, Mumbai, India. Your records, Sand's own database of business contacts, and the activity log are all kept here.
• Backups — a copy is made every night and kept in Oracle Cloud storage, Mumbai, India, encrypted at rest.
• Emails Sand sends you (sign-in codes, alerts, invitations) — sent through Google's email service, which runs worldwide.
• Emails you send through Sand — they go out from your own Google or Microsoft mailbox, which you connect yourself.
• Language models — run by model providers in the United States, for the features described under Where AI comes in.
• Business data providers — in the United States, when Sand looks up a company or a person in a business role.
• Payments — Razorpay, India.
• Security checks, web addresses and forwarded replies — Cloudflare, which runs worldwide.

How long it is kept

• Your records — for as long as your account is open.
• Mailbox tokens — until you disconnect the mailbox, then deleted.
• Activity log — sign-ins, searches, contact views and exports in your organisation, for 1 year, then deleted. Payment entries are kept with the billing records below.
• Notifications in the app — for 6 months, then deleted.
• Other logs — error logs for a short rolling window, for fault-finding and security; a record of each business data lookup, for as long as it is needed to account for usage and billing.
• Business contact data in Sand's own database — while it stays accurate and useful, and removed when the person listed asks.
• Billing records — as long as tax and accounting law in India requires, even after the account closes.
• Backups — a copy of everything is made every night and kept for 30 days, then deleted. Anything removed or deleted is gone from the backups within 30 days too.

Close your account and we delete your data within 30 days, apart from anything we are legally obliged to keep. You can ask for it sooner, and you can export your records at any time through the app or the API.

Keeping it safe

• Everything travels over HTTPS.
• Passwords are stored as one-way hashes; mailbox refresh tokens are encrypted at rest with AES-256-GCM.
• API keys are stored hashed and are shown to you once, at the moment you create them.
• Each organisation's data is separated, and every request is checked against the signed-in account.
• Access to production systems is limited to the people who need it.

No service can promise perfect security. If a breach affects your data, we will tell you and the Data Protection Board of India without undue delay, and within the time Indian law requires.

Your choices

• See it — your records are on screen, and the API returns them in full.
• Correct it — edit any record, or ask us.
• Export it — download your records through the app or the API.
• Delete it — delete records yourself, or ask us to close the account and remove everything.
• Disconnect — unlink a mailbox or a calendar at any time, without affecting the rest of your account.
• Object — tell us to stop a particular use of your data, and we will stop or explain why we cannot.

Write to privacy@balajitech.xyz for any of these. We answer within 30 days. If you are not satisfied with the answer, you can complain to the Data Protection Board of India.

Changes to this policy

If this policy changes, the date at the top changes with it. For a change that affects what we do with your data, we will tell you in the app or by email before it takes effect.