Privacy Policy & Data Protection Notice

1. Introduction & Data Fiduciary Details

Kynoa operates as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act). We are committed to protecting the privacy, confidentiality, and autonomy of our registered users ("Data Principals"). This policy sets out how we collect, process, store, and safeguard your personal data when you use our labor market intelligence platform.

2. Itemized Notice of Personal Data Collected & Purpose (Section 5)

In accordance with Section 5 of the DPDP Act, 2023, the table below specifies every item of personal data collected and its precise lawful purpose:

3. Data Principal Rights (Sections 11 – 14)

As a Data Principal under the DPDP Act, 2023, you hold the following non-negotiable statutory rights:

• Right to Access (Section 11): You have the right to obtain a summary of your personal data processed by Kynoa and the identities of all third parties with whom it was shared. You can download your data archive anytime in your Account Settings.
• Right to Correction & Erasure (Section 12): You may update or correct inaccurate details or request permanent erasure of your account and personal data ("Right to be Forgotten") via Settings.
• Right to Withdraw Consent (Section 6(4)): You may withdraw your consent at any time. Withdrawal does not affect the legality of prior processing.
• Right of Grievance Redressal (Section 13): You have the right to have grievances addressed by our designated Grievance Officer within 30 days.
• Right to Nominate (Section 14): You may nominate any individual to exercise your privacy rights in the event of death or incapacity.

4. Security Safeguards & Technical Measures (Section 8(5))

We implement comprehensive technical, organizational, and physical safeguards to prevent unauthorized access, alteration, disclosure, or accidental breach:

• Encryption in Transit: All API traffic and web communications use TLS 1.3 encryption.
• Password Security: Passwords are irreversibly hashed using salted bcrypt (cost factor 12).
• Reset Token Hashes: Password reset tokens are stored strictly as SHA-256 hashes with an automatic 1-hour expiration.
• Network Controls: Restricted CORS whitelisting, preventing cross-origin session hijacking.

5. Third-Party Data Processors & Cross-Border Transfers (Section 8(1) & 16)

Kynoa engages verified enterprise cloud service providers ("Data Processors") bound by strict confidentiality and security terms:

• Database Hosting: Supabase (PostgreSQL managed cloud database).
• Application Hosting: Render Services Inc.
• CDN & Edge Delivery: Vercel Inc.
• Transactional Email Delivery: Resend Technologies Inc.

6. Grievance Redressal & Data Protection Officer Contact (Section 13)

If you have any questions, wish to exercise any of your statutory rights, or wish to file a privacy grievance, contact our designated Grievance Officer:

If you remain dissatisfied with the resolution of your grievance, you have the right to lodge a formal complaint with the Data Protection Board of India (DPBI) pursuant to Section 13(3) of the Act.