PRIVACY POLICY

The data controller and data fiduciary responsible for your personal information is:

Deepsara AI LLP Operating: HEXASPEAR Intelligence Platform Office: DEEPAGARASHU P, Salem, Tamil Nadu, India Email: hexaspear@gmail.com

Deepsara AI LLP determines the purposes and means of processing personal data collected through the HEXASPEAR Intelligence Platform. We are committed to protecting your privacy and handling your data with care, transparency, and in compliance with applicable Indian and international law.

When you create an account:

• Email address — to identify your account and send notifications
• Username and display name — to personalise your experience
• Profile photo — optional, to display on your profile
• Bio, headline, profession — optional, shown on public profile

When you use the Platform:

• Reading progress — which books/content you read, completion percentage, and time spent reading
• Bookmarks and notes — to save your place and your own highlights
• Search queries — to understand what content users look for and improve recommendations
• Listening progress — which audio episodes you have played, how far through each one you are, and when you last played it, so playback resumes where you left off
• Articles you have opened — recorded against your account so we can apply the monthly free-article limit. We store which articles and when; we do not record how long you spent reading
• Device type and browser — for performance optimisation and bug fixing
• General location (country level only) — via Firebase infrastructure, for content relevance

When you make a payment:

• Your name and email are shared with Razorpay (our payment processor) to generate a payment order
• Razorpay collects and processes your card, UPI, or banking details directly — we never see or store them
• We store only your plan ID, payment status, and Razorpay order/payment IDs to activate your access

What we DO NOT collect:

• Personal Reflections — your journal entries are stored only on your device and are never transmitted to or accessible by our servers
• Card numbers, CVV, UPI PINs, or any banking credentials — these go directly to Razorpay
• Precise GPS or real-time location data

• To provide Platform features — progress tracking, bookmarks, notes, personalised content
• To improve the Platform — analytics, performance monitoring, bug fixes
• To send notifications you have explicitly opted into
• To detect, prevent, and respond to abuse or security threats
• To comply with applicable legal obligations

We do not use your data to train AI models. Your Personal Reflections are never used for any purpose as they are never accessible to us.

Your data is stored in Google Firebase (Firestore), hosted on Google Cloud Platform with:

• AES-256 encryption at rest
• TLS/HTTPS encryption for all data in transit
• Role-based access controls — only authorised personnel can access user data

Media files and assets are stored on Cloudflare R2 and served via CDN.

We retain your data for as long as your account is active. Upon account deletion:

• Your personal data is permanently purged from live systems immediately
• Backup copies are fully deleted within 30 days

We DO NOT sell your personal data to any third party. Ever.

We share data only with the following infrastructure providers strictly as needed to operate the Platform:

• Google Firebase / Google Cloud Platform — database and authentication
• Razorpay — payment processing (your name and email are shared to create payment orders; Razorpay's Privacy Policy applies to payment data)
• Resend — transactional email delivery
• Cloudflare R2 — storage and delivery of images and audio files (your email address is used to send payment confirmations and account notifications)
• Google AI services — AI-assisted content production (platform content only, never user personal data)

These providers are bound by their own privacy policies and data processing agreements. They process your data only as required to provide their services.

You have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — correct inaccurate data (most fields editable in Settings)
• Deletion — permanently delete your account and all associated data
• Objection — object to processing of your data for analytics purposes
• Portability — request your data in a structured, machine-readable format
• Withdraw consent — opt out of non-essential data processing at any time
• Nominate — nominate a person to exercise your rights on your behalf (as provided under the DPDP Act 2023)

To exercise any of these rights: Email: hexaspear@gmail.com Subject line: "Privacy Request" Response time: 5 business days

This Platform is intended for users aged 13 and above. Users between 13 and 17 years old may only use the Platform with the permission and supervision of a parent or guardian. We do not knowingly collect personal data from anyone under 13 years of age.

If we discover that a user is under 13, or is between 13 and 17 without appropriate parental permission, we will terminate their account and delete all associated data.

If you believe a child under 13 has created an account, or that a 13–17 year old is using the Platform without a parent's knowledge, contact us at hexaspear@gmail.com and we will act within 24 hours.

This Privacy Policy is also governed by India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Under the DPDP Act, Deepsara AI LLP acts as the Data Fiduciary and commits to:

• Processing your personal data only for the purposes disclosed in this Policy
• Collecting personal data based on your consent, given when you create an account and agree to our Terms
• Implementing reasonable security safeguards to protect your data
• Not retaining your data beyond the period necessary for the stated purposes
• Notifying relevant authorities of data breaches as required by law

Your rights under the DPDP Act 2023:

• Right to access information about your data
• Right to correction and erasure
• Right to grievance redressal (via our Grievance Officer)
• Right to nominate a person to exercise your data rights

If you believe your rights under the DPDP Act have been violated, you may also lodge a complaint with the Data Protection Board of India after exhausting our grievance redressal process.

Your personal data is processed and stored by infrastructure providers whose servers may be located outside India:

• Google Firebase / Google Cloud Platform (United States) — database and authentication. Google operates under internationally recognised data protection standards and Standard Contractual Clauses (SCCs) for international data transfers.
• Cloudflare R2 (United States / Global CDN) — media storage and delivery. Cloudflare complies with applicable international data protection frameworks.

These transfers are necessary to provide Platform services. By using the Platform, you consent to your data being transferred to and processed in countries where these providers operate.

We ensure that any international transfer of personal data is subject to appropriate safeguards as required by the DPDP Act 2023 and other applicable law.

In accordance with the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

Name: Deepagarashu P Designation: Grievance Officer Organisation: Deepsara AI LLP Office: DEEPAGARASHU P, Salem, Tamil Nadu, India Email: hexaspear@gmail.com

Complaints acknowledged within 24 hours. Resolved within 15 days of receipt.

We may update this Privacy Policy from time to time. We will notify registered users of material changes through the Platform at least 7 days before the changes take effect. Continued use after changes constitutes acceptance of the revised Policy.

If you do not agree to the revised Policy, you must stop using the Platform and may delete your account.

Deepsara AI LLP HEXASPEAR Intelligence Platform Office: DEEPAGARASHU P, Salem, Tamil Nadu, India Email: hexaspear@gmail.com Response time: 5 business days