PRIVACY POLICY

The data controller and data fiduciary responsible for your personal information is:

Deepsara AI LLP Operating: HEXASPEAR Intelligence Platform Office: DEEPAGARASHU P, Salem, Tamil Nadu, India Email: hexaspear@gmail.com

Deepsara AI LLP determines the purposes and means of processing personal data collected through the HEXASPEAR Intelligence Platform. We are committed to protecting your privacy and handling your data with care, transparency, and in compliance with applicable Indian and international law.

When you create an account:

• Email address — to identify your account and send notifications
• Username and display name — to personalise your experience
• Profile photo — optional, to display on your profile
• Bio, headline, profession — optional, shown on public profile

When you use the Platform:

• Reading progress — which books/content you read, completion percentage, and time spent reading
• Streak data — consecutive days of activity
• Bookmarks and XP scores — to save your place and reward engagement
• Search queries — to understand what content users look for and improve recommendations
• Device type and browser — for performance optimisation and bug fixing
• General location (country level only) — via Firebase infrastructure, for content relevance

What we DO NOT collect:

• Personal Reflections — your journal entries are stored only on your device and are never transmitted to or accessible by our servers
• Financial or payment information — we do not process payments directly
• Precise GPS or real-time location data

• To provide Platform features — progress tracking, bookmarks, streaks, personalised content
• To improve the Platform — analytics, performance monitoring, bug fixes
• To send notifications you have explicitly opted into
• To detect, prevent, and respond to abuse or security threats
• To comply with applicable legal obligations
• To display relevant advertising via Google AdSense

We do not use your data to train AI models. Your Personal Reflections are never used for any purpose as they are never accessible to us.

Your data is stored in Google Firebase (Firestore), hosted on Google Cloud Platform with:

• AES-256 encryption at rest
• TLS/HTTPS encryption for all data in transit
• Role-based access controls — only authorised personnel can access user data

Media files and assets are stored on Cloudflare R2 and served via CDN.

We retain your data for as long as your account is active. Upon account deletion:

• Your personal data is permanently purged from live systems immediately
• Backup copies are fully deleted within 30 days

We DO NOT sell your personal data to any third party. Ever.

We share data only with the following infrastructure providers strictly as needed to operate the Platform:

• Google Firebase / Google Cloud Platform — database and authentication
• Cloudflare — media storage and CDN delivery
• Google AdSense — advertising
• Google Gemini — AI content generation (platform content only, not user personal data)

These providers are bound by their own privacy policies and data processing agreements. They process your data only as required to provide their services.

You have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — correct inaccurate data (most fields editable in Settings)
• Deletion — permanently delete your account and all associated data
• Objection — object to processing of your data for analytics purposes
• Portability — request your data in a structured, machine-readable format
• Withdraw consent — opt out of non-essential data processing at any time
• Nominate — nominate a person to exercise your rights on your behalf (as provided under the DPDP Act 2023)

To exercise any of these rights: Email: hexaspear@gmail.com Subject line: "Privacy Request" Response time: 5 business days

This Platform is strictly intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18 years of age.

If we discover that a user is under 18, we will immediately and permanently terminate their account and delete all associated data without notice.

If you believe a minor has created an account, contact us at hexaspear@gmail.com and we will act within 24 hours.

This Privacy Policy is also governed by India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Under the DPDP Act, Deepsara AI LLP acts as the Data Fiduciary and commits to:

• Processing your personal data only for the purposes disclosed in this Policy
• Collecting personal data based on your consent, given when you create an account and agree to our Terms
• Implementing reasonable security safeguards to protect your data
• Not retaining your data beyond the period necessary for the stated purposes
• Notifying relevant authorities of data breaches as required by law

Your rights under the DPDP Act 2023:

• Right to access information about your data
• Right to correction and erasure
• Right to grievance redressal (via our Grievance Officer)
• Right to nominate a person to exercise your data rights

If you believe your rights under the DPDP Act have been violated, you may also lodge a complaint with the Data Protection Board of India after exhausting our grievance redressal process.

Your personal data is processed and stored by infrastructure providers whose servers may be located outside India:

• Google Firebase / Google Cloud Platform (United States) — database and authentication. Google operates under internationally recognised data protection standards and Standard Contractual Clauses (SCCs) for international data transfers.
• Cloudflare R2 (United States / Global CDN) — media storage and delivery. Cloudflare complies with applicable international data protection frameworks.

These transfers are necessary to provide Platform services. By using the Platform, you consent to your data being transferred to and processed in countries where these providers operate.

We ensure that any international transfer of personal data is subject to appropriate safeguards as required by the DPDP Act 2023 and other applicable law.

In accordance with the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

Name: Deepagarashu P Designation: Grievance Officer Organisation: Deepsara AI LLP Office: DEEPAGARASHU P, Salem, Tamil Nadu, India Email: hexaspear@gmail.com

Complaints acknowledged within 24 hours. Resolved within 15 days of receipt.

We may update this Privacy Policy from time to time. We will notify registered users of material changes through the Platform at least 7 days before the changes take effect. Continued use after changes constitutes acceptance of the revised Policy.

If you do not agree to the revised Policy, you must stop using the Platform and may delete your account.

Deepsara AI LLP HEXASPEAR Intelligence Platform Office: DEEPAGARASHU P, Salem, Tamil Nadu, India Email: hexaspear@gmail.com Response time: 5 business days