Privacy Policy

MeHAN ("we", "us", "our") is the Data Fiduciary for personal data collected through mehan.co.in. This policy is written to comply with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and explains what we collect, why, on what lawful basis, how long we keep it, who we share it with, and how you can exercise your rights as a Data Principal.

1. What we collect

• Diagnostic & booking forms — name, work email, company, role, team size, city, and answers to diagnostic questions.
• MCT-AIP trainer applications — name, email, current role, city.
• Analytics & marketing — anonymised or pseudonymised identifiers (IP address, browser, device, page views) via Google Analytics 4, LinkedIn Insight Tag, and Meta Pixel — only after you accept our cookie banner.
• Correspondence — anything you email us.

We do not knowingly collect data from children under 18.

2. Purpose & lawful basis (Section 4 & 7, DPDP Act)

• Consent (Sec. 6) — to send the diagnostic you requested, respond to bookings, evaluate trainer applications, and load analytics/marketing tags.
• Legitimate use (Sec. 7(a)) — to fulfil a service you voluntarily initiated, such as replying to your enquiry.

We do not use your data for any purpose other than the one you consented to. We do not sell your data.

3. How long we keep it (Retention)

• Form submissions: up to 24 months from last interaction, then deleted.
• Client engagement records: up to 7 years, as required by Indian tax and contract law.
• Analytics identifiers: as configured in GA4 / LinkedIn / Meta (typically 14 months).

You can ask us to erase your data earlier — see Section 6.

4. Where it lives & cross-border transfers

Form submissions are processed by our backend (Lovable Cloud, hosted on infrastructure in the EU/US) and stored in Google Sheets (Google LLC, United States) so our team can respond. Analytics data is processed by Google, LinkedIn, and Meta on their global infrastructure. These transfers rely on the receiving entities' standard contractual protections; the Central Government has not restricted transfers to these jurisdictions under Section 16 of the DPDP Act at the date above.

5. Third-party processors we use

• Google LLC — Google Sheets storage, Google Analytics 4.
• LinkedIn Corporation — Insight Tag (marketing measurement).
• Meta Platforms Inc. — Meta Pixel (marketing measurement).
• Cal.com Inc. — discovery call scheduling (only when you book).
• Lovable Cloud — hosting and edge functions.

6. Your rights as a Data Principal (Sec. 11–14)

• Right to access — a summary of the personal data we hold about you.
• Right to correction & erasure — fix inaccurate data or ask us to delete it.
• Right to withdraw consent — as easily as you gave it; processing before withdrawal remains lawful.
• Right to grievance redressal — via our Grievance Officer below.
• Right to nominate — designate another individual to exercise your rights on death/incapacity.

Exercise any of these via our Data Request form. We acknowledge within 72 hours and act within statutory timelines.

7. Cookies & tracking

No analytics or advertising cookies are set until you click "Accept analytics cookies" on our banner. If you reject, only strictly necessary storage (e.g. your consent choice) is used. You can change your choice any time by clearing the site's local storage in your browser and reloading the page.

8. Security

We apply reasonable security safeguards under Section 8(5): TLS in transit, Zod input validation and rate-limiting on all endpoints, restricted origin CORS on our edge functions, and role-scoped access to our backend. If we ever become aware of a personal data breach, we will notify affected Data Principals and the Data Protection Board of India in line with Section 8(6).

9. Grievance Officer (Section 10 & 13)

If your grievance is not resolved to your satisfaction, you may escalate to the Data Protection Board of India.

10. Updates

We update this policy when our processing changes or the law changes. The date at the top always reflects the current version.