Privacy Policy | HarplixAI

This Privacy Policy describes how HARPLIX (the Data Fiduciary under India's Digital Personal Data Protection Act 2023) collects, uses, and protects your personal data when you use HarplixAI (harplixai.com). For our postal address, see our Contact page. By using HarplixAI you consent to this policy. If you do not agree, please do not use the service.

1. Who We Are

HARPLIX is the Data Fiduciary responsible for your personal data on HarplixAI. For our registered address and contact details, see our Contact page.

Contact: support@harplixai.com
Grievance Officer: see Section 10 below

2. Information We Collect

2.1 Information You Provide Directly

Account data: name, email address, password (stored hashed, never in plain text), profile details
Onboarding: user type, selected domain
Subscription: plan chosen, Razorpay payment metadata (we do not receive or store card numbers — those remain with Razorpay)
Referral programme: UPI ID (for payouts), and, if you choose to provide them in response to our optional prompt above ₹10,000 lifetime referral earnings, your PAN and the name as printed on it (purely for our internal bookkeeping — providing these is optional, you can skip the prompt, and skipping does not affect your payouts)
Content you submit: project submissions, assessment answers, mock interview responses, CV uploads

2.2 Information Collected Automatically

IP address (used for security and abuse prevention, stored hashed)
Browser type, device information, pages visited
Referral attribution: referral code, UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), landing path
Session cookies for authentication (see Section 7)

2.3 Information from Third Parties

Google OAuth (if you sign in with Google): name, email, profile picture — only what you consent to share during the Google sign-in flow
Razorpay webhook: payment confirmation status (success/failure)

3. Why We Use Your Data

To provide the HarplixAI service and manage your account
To process payments, subscriptions, and referral commissions
To prevent fraud and abuse of the referral programme
To send service notifications (we do not send marketing emails unless you opt in)
To improve content and AI feature accuracy
To comply with our own legal obligations, including books-of-account and tax recordkeeping requirements that apply to us as the operator

4. Legal Basis for Processing (under DPDP Act 2023)

Your consent: you signed up and agreed to this policy
Contractual necessity: we cannot deliver the service without your data
Legal obligation: books-of-account and tax records that the operator is required to maintain under applicable law
Legitimate interest: fraud prevention, security, analytics

5. Who We Share Data With

We do not sell your personal data. We share data only with these service providers ("Data Processors"), who process it on our behalf:

Supabase Inc. (US-based company) — database, authentication, file storage. Your data is hosted in Supabase's Asia-Pacific (Sydney, Australia) region.
Razorpay Software Private Limited (India) — payment processing. Razorpay receives payment-related data directly. Its own privacy policy applies at razorpay.com.
Google LLC / Gemini API (United States) — AI content processing. Content you submit to AI features (mock interviews, prompt practice, CV analysis) is sent to Google's Gemini API. Google does not use this data to train its models under our API agreement.

We may also disclose data if legally required (court order, tax authority notice) or to protect our rights.

6. Cross-Border Data Transfers

Your account and learning data are hosted by Supabase in Australia (its Asia-Pacific Sydney region). Content you submit to AI features is processed by Google in the United States. By using HarplixAI you consent to your data being transferred to and processed in these locations. These providers are bound by contractual agreements consistent with Indian data protection standards.

7. Cookies and Tracking

HarplixAI uses the following cookies:

Essential Cookies (cannot be disabled)

Supabase auth session cookie — session duration, HttpOnly, Secure
CSRF token — session duration

Functional Cookies

sf_ref — stores a referral code if you arrived via a referral link, so we can show you referral-discounted pricing. Expires after 30 days.
sf_ref_utm — stores campaign attribution parameters from your first visit. Expires after 30 days.

We do not use advertising or third-party tracking cookies. You can clear cookies through your browser settings. Disabling essential cookies will prevent you from using the service.

8. Data Retention

When you delete your account, different categories of data are handled differently. We keep no "hidden copy" of your identity. We do, however, retain certain financial, audit, and certificate records in an anonymized form, as required by Indian law and described below.

8.1 Deleted immediately on account deletion

Account and identity data: name, email, password hash, profile details, onboarding selections. Deleted immediately and permanently the moment you confirm deletion. There is no grace period and no recovery option.
Learning data: module progress, quiz attempts, mock interview transcripts, CV uploads, project submissions, and portfolios. Deleted at the same time, irreversibly.
Referral identity: your link to your past referrals (referrer/referee user IDs) is removed at the same time so that retained records can no longer be traced back to you.

8.2 Retained anonymized after deletion

Financial records (subscription, payment, referral commission, payout, wallet history, and — only if you provided them at our optional prompt — your PAN and PAN-printed name): retained in our records with your name and other learning-side identifiers removed. The transaction history is kept for as long as the operator is required to maintain books of account and tax records under applicable law (the Income Tax Act 1961), typically a minimum of seven financial years from the relevant transaction; PAN details, if you provided them, are kept for an internal audit margin of up to eight years from the deletion date.
Audit records (referral events, consent timestamps, deletion record): retained anonymized to comply with our record-keeping obligations under the DPDP Act 2023.
Certificates: retained with the holder's name snapshotted at issuance, so third-party verification (employers, education programmes) can continue to validate credentials you earned. The link between the certificate and your account is removed; the certificate itself remains visible at /verify/<id>.

8.3 Deletion archive

At deletion time we create one small archive record containing: a one-way, irreversible hash of your email (used only to prevent abuse and not reversible to your address); your former referral code (permanently reserved so that it cannot be re-issued to a new user); a snapshot of the consent versions you accepted; and a snapshot of any forfeited wallet balance. The archive does not store your name, password, profile, learning data, or any other personal identifier.

8.4 Why we retain some data after deletion

The DPDP Act 2023 expressly permits a Data Fiduciary to retain personal data after a data principal's erasure request "to comply with any law for the time being in force" (DPDP Act §8(7)). The financial records described in Section 8.2 are retained under this carve-out, with the operator's books-of-account and tax recordkeeping obligations under the Income Tax Act 1961 as the binding authority. Audit records are retained under the DPDP Act's own record-keeping requirements. Certificates are retained because the integrity of credentials you earned matters to third parties who rely on them.

9. Your Rights under the DPDP Act 2023

You have the right to:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Erasure. Erasure of your identity and learning data is immediate and irreversible the moment you confirm deletion in your account settings; no support request is required. Financial, audit, and certificate records are retained anonymized as described in Section 8 under the DPDP Act "another law" carve-out. If you wish to exercise the right to erasure of records retained under Section 8 after the applicable retention period has expired, contact grievance@harplixai.com.
Data portability. If you wish to receive a copy of the personal data we hold about you, email grievance@harplixai.com with your request. We provide responses within 7 working days. We do not currently offer a self-serve download; this is handled on a per-request basis.
Withdraw consent at any time (note: some processing is necessary for the service to function).
Nominate another person to exercise your rights in case of death or incapacity.
Lodge a complaint with the Data Protection Board of India.

To exercise any right, email grievance@harplixai.com.

10. Grievance Officer

Under Rule 6 of the DPDP Rules, we have designated the following Grievance Officer to address your concerns:

Name: Kadumuri Raja Shekar Varma
Role: Grievance Officer, HARPLIX
Email: grievance@harplixai.com
Response time: within 7 working days

If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

11. Security

We use industry-standard security measures including encrypted connections (HTTPS), hashed passwords, encrypted data at rest (via Supabase), and access controls. No system is perfectly secure; in the event of a data breach affecting your personal data, we will notify you and the Data Protection Board of India as required by law.

12. Children's Data

HarplixAI is intended for users aged 18 years and above. We do not knowingly collect data from children under 18. If you believe a child under 18 has provided us with personal data without parental consent, please contact grievance@harplixai.com and we will delete the data promptly.

13. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent version. Material changes will be communicated via email to registered users. Continued use of HarplixAI after changes constitutes acceptance.

14. Contact

For any questions about this Privacy Policy or our data practices:

General: support@harplixai.com
Data privacy / DPDP grievances: grievance@harplixai.com