1. Privacy Policy

1. Introduction & Data Controller

Kaushift ("we", "us", "Platform") is operated by an individual based in Indore, Madhya Pradesh, India. This Privacy Policy explains how we collect, store, process, and protect your personal data in compliance with India's Digital Personal Data Protection (DPDP) Act, 2023. By creating an account or using Kaushift, you provide explicit affirmative consent for data processing described herein.

2. What Data We Collect

• Account Data: Email address, username, hashed passwords, or Google OAuth profile metadata.
• User Content: Stories, autopsies, post-mortems, comments, votes, reactions, and messages in private rooms.
• AI Analyzer Data: Prompts, startup metrics, burn rate figures, and generated AI reports.
• Billing & Payment Metadata: When paid features or subscription plans launch, payments will be processed securely via Razorpay. We receive payment status, transaction reference IDs, and plan type (never full credit card numbers or UPI PIN details). Access during our initial v1 launch is free.
• Technical Telemetry: IP address, device specs, browser type, and cookie preferences.

3. Third-Party Sub-Processors & Data Transfers

We rely on trusted cloud service providers ("Sub-Processors") to run Kaushift safely. Data is stored and processed across secure servers located in India and internationally (including US/EU cloud infrastructure provided by Supabase, Vercel, and OpenAI) protected by industry-standard encryption in transit and at rest:

• Supabase Inc. — Relational database hosting, user authentication, and real-time live sync.
• Google LLC — OAuth 2.0 social login authentication.
• Vercel Inc. — Web application hosting and global Content Delivery Network (CDN).
• Razorpay Software Pvt. Ltd. — Payment gateway processing (applicable when paid plans launch).
• OpenAI LLC — AI report generation (user inputs sent via OpenAI API strictly for prompt fulfillment; per OpenAI API terms, API inputs are not used to train public LLM models).

5. Retention & Breach Notification SLA

We retain personal data as long as your account remains active or as required by statutory Indian laws. In the event of a verified personal data breach, we will notify affected users and the Data Protection Board of India within statutory timelines as prescribed under the DPDP Act 2023.

6. Your Rights Under DPDP Act 2023

You have the right to request access to your personal data, correct inaccurate data, request erasure/account deletion, withdraw consent at any time, and nominate a representative in case of incapacity.

To exercise your rights or submit a data request, email our Data Protection Officer at kaushift@gmail.com. We respond within statutory timelines (maximum 30 days).