Privacy Policy

1. Introduction and Scope

The Humble Foundry Pvt. Ltd. (a company formally incorporated under the Companies Act, 2013) is committed to protecting the privacy and security of your personal and corporate data. This Privacy Policy details our practices regarding the collection, use, processing, transfer, and protection of personal data when you visit our website, engage with our enterprise software services, or utilize our proprietary internal portals. By accessing or using our Services, you acknowledge that you have read, understood, and agreed to be bound by the data practices described in this Policy.

2. DPDP Act 2023 & Compliance

We comply strictly with India's Digital Personal Data Protection (DPDP) Act, 2023. All our employees, contractors, and interns are contractually bound under strict Non-Disclosure Agreements (NDAs) to ensure they do not collect, export, store on personal unsecured devices, or leak any personal data belonging to company users, clients, employees, or team members.

3. Information We Collect

We collect information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular consumer or device ("Personal Data"). The categories of Personal Data we collect include:

• Identifiers: Name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, or other similar identifiers.
• Customer Records: Financial information (for invoicing and payroll purposes), corporate affiliations, and contact details.
• Commercial Information: Records of products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies.
• Internet or Network Activity: Browsing history, search history, and information regarding a consumer's interaction with our web applications.
• Employment Data: For authorized users of our HR portals, we collect professional or employment-related information, including background checks, compensation data, and compliance documentation.

4. Legal Basis and Purpose of Processing

We process your Personal Data on the following legal bases:

• Performance of a Contract: To provide you with the Services, process transactions, and manage our business relationship.
• Legitimate Interests: To improve our Services, ensure network and information security, and prevent fraud.
• Legal Obligations: To comply with applicable laws, regulations, and legal processes (e.g., tax and employment laws).
• Consent: Where required by law, we will obtain your explicit consent prior to processing your data for specific purposes.

5. Data Sharing and Third-Party Processors

We do not sell, rent, or lease your Personal Data to third parties. We may disclose your Personal Data to trusted third-party service providers who assist us in operating our business (e.g., cloud hosting providers, payment processors, and analytics services). All third-party processors are bound by strict confidentiality agreements and Data Processing Addendums (DPAs) that mandate the implementation of appropriate technical and organizational measures to protect your data.

6. Data Security and Architecture

Security is the cornerstone of our infrastructure. We employ industry-standard technical, administrative, and physical safeguards designed to protect your Personal Data against unauthorized access, destruction, or alteration. Our databases enforce stringent Row Level Security (RLS) policies, ensuring cryptographic data isolation. Data is encrypted both in transit (using TLS 1.3) and at rest (using AES-256). Furthermore, our internal team is mandated to maintain credentials securely and strictly prohibited from sharing repository tokens, SSH keys, or API keys.

7. Internal Portals and Role-Based Access Control (RBAC)

Data stored within our internal employee and administrative dashboards is governed by strict Role-Based Access Control (RBAC). Access to sensitive employment, financial, and corporate data is restricted exclusively to authorized personnel on a strict "need-to-know" basis.

8. Data Retention

We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Upon the expiration of the applicable retention period, Personal Data will be securely deleted or anonymized in accordance with our data destruction protocols.

9. Your Data Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your Personal Data:

• Right to Access: Request copies of your Personal Data.
• Right to Rectification: Request correction of inaccurate or incomplete Personal Data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your Personal Data under certain conditions.
• Right to Restrict Processing: Request the limitation of processing of your Personal Data.
• Right to Data Portability: Request the transfer of your Personal Data to another organization or directly to you.

10. Modifications to this Policy

We reserve the right to amend this Privacy Policy at our discretion and at any time. When we make changes, we will post the updated Privacy Policy on this page. Your continued use of our Services following the posting of changes constitutes your acceptance of such changes.