Privacy Policy

1. Data We Collect

We collect only the data necessary to deliver our career intelligence services:

• Profile information — name, email address, professional title, years of experience, industry, domain, company size, and city provided during onboarding.
• Assessment responses — your answers to the career diagnostic questionnaire, used to generate your personalised career report and identify structural constraints.
• LinkedIn data — if you choose to upload your LinkedIn PDF export, we extract professional history (roles, tenures, skills) to enrich your diagnosis. We do not access your LinkedIn account directly or store your LinkedIn credentials.
• Daily signals — brief daily check-in entries (energy level, focus areas, progress notes) that you voluntarily submit to track career momentum over time.
• Reflections — free-text journal entries you create within the platform for coaching and self-assessment purposes.
• Email address — used for authentication (via Google OAuth or magic link), transactional notifications (report ready, session reminders), and with your consent, periodic product updates.

2. How We Use Your Data

Your data is processed for the following purposes:

• Career diagnosis — generating your personalised career intelligence report, identifying your primary constraint, strengths, and growth opportunities across multiple dimensions.
• Personalised coaching — powering AI-assisted coaching, execution plans, strategic move recommendations, and progress tracking tailored to your unique career profile.
• Coach matching — if you opt into coaching, using your diagnostic profile to match you with relevant coaches on the platform.
• Platform improvement — analysing aggregated and anonymised usage patterns to improve our diagnostic models, user experience, and content quality. Individual data is never used for this purpose without anonymisation.
• Transactional communications — sending you essential service-related emails such as report completion notifications, session reminders, and account security alerts.

3. Data Storage

Your data is stored on Supabase infrastructure hosted in the Tokyo (ap-northeast-1) region on Amazon Web Services. All data is encrypted at rest using AES-256 encryption and in transit using TLS 1.2 or higher. Database backups are encrypted and retained according to our infrastructure provider’s backup policy. Access to production data is restricted to authorised personnel only, and all database queries enforce row-level security (RLS) to ensure you can only access your own data.

4. Data Sharing

• Coaches — if you opt into a coaching programme, your career report and relevant diagnostic data may be shared with your assigned coach. This sharing requires your explicit consent, is limited to what is necessary for the coaching engagement, and can be revoked at any time from your Settings page.
• No third-party data sales — we do not sell, rent, or trade your personal data to any third party. This is a firm commitment, not a policy that may change.
• Service providers — we use a limited number of service providers (Supabase for hosting and authentication, Resend for email delivery, Razorpay for payment processing) who process data solely on our behalf and under strict contractual obligations.
• Legal requirements — we may disclose data if required by law, regulation, or valid legal process issued by a competent authority.

5. Your Rights Under DPDPA 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access — request a summary of the personal data we hold about you and the processing activities performed on it. You can export your data from your Settings page at any time.
• Right to correction — request correction or completion of inaccurate or incomplete personal data. Profile information can be updated directly from your Settings page.
• Right to erasure — request deletion of your personal data. Upon receiving a valid erasure request, we will delete your data within 30 days, except where retention is required by law (e.g. financial records).
• Right to withdraw consent — withdraw your consent for data processing at any time from your Settings page. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right to grievance redressal — lodge a complaint with us or escalate to the Data Protection Board of India if you believe your data rights have been violated.
• Right to nominate — nominate another person to exercise your data rights in the event of your death or incapacity, as provided under the DPDPA.

To exercise any of these rights, email us at contact@cultiwate.com or use the self-service options available in your Settings page.

6. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy:

• Account and profile data — retained while your account is active and for 30 days after a deletion request to allow for recovery.
• Assessment and diagnostic data — retained while your account is active to provide ongoing career intelligence and track your progress over time.
• Daily signals and reflections — retained while your account is active. You may delete individual entries at any time from within the platform.
• LinkedIn PDF uploads — processed for data extraction and then deleted. We do not retain the original PDF file after processing.
• Payment records — retained as required by applicable Indian tax and financial regulations (typically 7 years).
• Anonymised analytics — may be retained indefinitely as they cannot be linked back to any individual.

7. Consent

We obtain your explicit, informed consent during onboarding before processing any personal data. Consent is collected separately for each processing purpose where required by the DPDPA. You may withdraw consent at any time from your Settings page. If you withdraw consent, we will cease processing your data for the relevant purpose, though this may limit your ability to use certain features of the platform.

8. Third-Party Services

We use the following third-party services to operate the platform:

• Supabase — database hosting and authentication (AWS ap-northeast-1, Tokyo).
• Google OAuth — sign-in authentication only. We receive your name and email; no other Google data is accessed.
• Resend — transactional email delivery.
• Razorpay — payment processing for paid subscription plans. We do not store your payment card details; these are handled entirely by Razorpay.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes that affect your data processing rights will be communicated via email and may require re-consent. The “Last updated” date at the top of this page indicates when the policy was last revised.

10. Contact Us

If you have any questions about this Privacy Policy, your data, or your rights under the DPDPA 2023, please contact us: