DecodePath accounts are created and managed by a parent or legal guardian aged 18 or over (the “account holder”). The student who takes the assessment is usually under 18 and is therefore a child under the DPDP Act.

We process a student’s personal data only with the verifiable consent of the parent or guardian who holds the account. Students must not create their own accounts. If you believe a child’s data was submitted without a parent’s or guardian’s consent, contact our Grievance Officer and we will delete it.

We collect only what we need to provide the assessment and report:

• Account holder details: parent or guardian name, email address and password. Passwords are never stored in readable form; we store only a salted PBKDF2 hash.
• Student details: student name, class (9–12), date of birth, time of birth (optional; “unknown” is accepted) and place of birth.
• Consent record: confirmation that the account holder has read this policy and consents to the processing of the student’s data.
• Assessment data: the student’s answers to the assessment questions, progress through the assessment and the report generated from them.
• Payment records: order amount, payment status, and Razorpay order and payment IDs. Card, UPI, net banking and wallet details are entered directly with Razorpay and are never received or stored by us.
• Email delivery records: the address, subject and delivery status of transactional emails we send (for example, the report summary).
• Technical and security data: IP address and similar request information processed by our hosting provider and used in short-window rate limits to protect sign-up, login and email features from abuse.

We use personal data only for the following purposes:

• Creating and securing your account and keeping you signed in.
• Saving the student’s progress and generating the career discovery report.
• Using date, time and place of birth solely to prepare the separately labelled Vedic astrology section of the report.
• Processing payment, confirming it with Razorpay and unlocking (or, after a full refund, revoking) access.
• Sending transactional emails you request or need, such as the report summary and responses to support requests.
• Preventing fraud and abuse, keeping the service secure, and fixing faults.
• Meeting legal, tax and accounting obligations and responding to lawful requests.

We do not sell personal data, use it for advertising, or send marketing emails.

We process personal data on the basis of the consent you give when you create an account and submit the student’s details, and, where the law permits, for legitimate uses such as complying with legal obligations (for example, keeping payment records for tax purposes).

You may withdraw consent at any time by writing to the Grievance Officer or support@decodepath.in. Withdrawal does not affect processing already carried out. Once consent is withdrawn we stop processing the student’s data and delete it in line with our retention rules. We can then no longer provide the assessment or report.

Because students are minors, we apply these additional safeguards:

• We collect a student’s data only after a parent or guardian, signed in to their own account, gives consent.
• We do not track students, monitor their behaviour, or show them targeted advertising.
• We use no advertising or third-party analytics cookies or SDKs.
• Students’ data is used only to produce their report and is never used to build marketing profiles.
• Reports are shown only to the signed-in account holder and to authorised DecodePath staff who need access to provide support.

We share personal data only with service providers that process it on our behalf and under our instructions, and only as much as they need:

• Razorpay (Razorpay Software Private Limited): payment processing. Razorpay handles your payment details under its own privacy policy and PCI-DSS obligations.
• Resend: sending transactional emails.
• Vercel: website hosting and serving.
• Prisma Postgres (managed PostgreSQL database): storage of account, student, assessment and payment records.

We may also disclose information where required by law, court order or a government authority, to protect the rights and safety of users or the public, or to a successor entity if the business is transferred, in which case this policy will continue to apply.

We use one essential, first-party cookie, decodepath_session. It is httpOnly (not readable by page scripts), keeps you signed in, and expires after 14 days or when you log out. We use no advertising, tracking or analytics cookies.

When you pay, the Razorpay checkout may set its own cookies to process the payment securely and prevent fraud. These are governed by Razorpay’s policies.

Data is stored with our hosting and database providers in [TO FILL: Hosting and database region(s), e.g. India / Singapore / USA]. Some of our providers may process data outside India. Where they do, we rely on transfers permitted under Indian law and on providers that apply contractual and technical safeguards.

We use reasonable security practices, including those expected under the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011:

• Encrypted connections (HTTPS) for all traffic.
• Salted PBKDF2 password hashing; we cannot see your password.
• httpOnly session cookies and server-side verification of every payment.
• Access to personal data limited to authorised personnel who need it.
• Rate limiting on sign-up, login and email features to block abuse.

No system is completely secure. If a personal data breach occurs, we will notify affected account holders and the Data Protection Board of India as required by law, and take steps to contain it.

• Account, student, assessment and report data: kept while your account is active and for [TO FILL: Retention after last account activity, e.g. 24 months], then permanently deleted, unless you ask us to delete it sooner.
• Payment and invoice records: kept for as long as Indian tax and accounting laws require (generally up to 8 years), even after the account is deleted.
• Email delivery and security records: kept only as long as needed for delivery troubleshooting, security and abuse prevention.

As the account holder (and on behalf of the student), you have the right to:

• Get a summary of the personal data we hold and how we use it, and the names of those we share it with.
• Correct, complete or update inaccurate or incomplete data.
• Have personal data erased, including deleting your account. We do not yet offer self-serve deletion, so please email the request.
• Withdraw consent at any time.
• Have your grievances addressed by our Grievance Officer.
• Nominate another person to exercise these rights if you die or become incapacitated.

To exercise any right, email the Grievance Officer or support@decodepath.in from your registered email address. We may ask you to verify your identity before acting. Some data, such as payment records, may need to be kept to meet legal obligations.

We may update this policy when our service or the law changes. We will post the new version on this page with a new “Last updated” date and, for significant changes, inform account holders by email before they take effect.

Questions, complaints and privacy requests can be sent to our Grievance Officer:

• Name: [TO FILL: Grievance Officer full name]
• Email: [TO FILL: Grievance Officer / privacy email]
• Phone: [TO FILL: Support phone number with +91 code]
• Address: [TO FILL: Registered business name], [TO FILL: Registered business address, incl. PIN code]

We will acknowledge your grievance within 48 hours and aim to resolve it within one month of receipt. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

For general support, see our Contact page.