Privacy Policy

Disha ("Find Your Disha") is operated by Indesol Global LLP ("Indesol Global", "we", "us"). This policy explains what personal data we collect when you use Disha, why we collect it, who processes it on our behalf, how long we keep it, and the rights you have. It is written to comply with India's Digital Personal Data Protection Act, 2023 (DPDP Act).

What we collect

• Account data: your email address (used for passwordless magic-link sign-in) and, if you provide one, your name.
• Profile data (optional, from onboarding and your Account page): preferred name, phone number, age range, gender, city and state, occupation, company name and role, primary goal, language preference, timezone, and reminder times. Every one of these fields is optional — skip anything you'd rather not share.
• Assessment data: your answers, computed scores, verdicts, and growth diagnoses for the Business Growth and Life Growth assessments, and any name you choose to enter for yourself or your business.
• Elephant Identifier data: the full text transcript of your adaptive AI interview and the resulting psychological profile. This is self-reflective, potentially sensitive personal data — please share only what you are comfortable with, and avoid submitting financial account numbers, government IDs, or health/medical records.
• Transformation data: your belief maps (old and new beliefs, identity shifts, proof actions), daily practice and action logs, reflections (including any emotions and lessons you record), belief-strength ratings, and your private journal entries.
• Reports: the PDF report files generated from your results.
• Billing data: your plan status and payment records (amounts, timestamps, and Razorpay-issued identifiers). We do not collect or store your card, UPI, or bank account details — these are handled directly by Razorpay.
• Technical data:IP address and timestamps used for security and abuse prevention; a log of the emails we have sent you (subject lines only, never their content); and product usage events (for example, "an assessment was completed") used to improve Disha. We use no third-party analytics, no advertising trackers, and no cookies beyond what sign-in requires.

How we use your data

Only to provide and improve Disha: authenticating you, running and scoring your assessments, generating your reports and transformation plans, conducting the Elephant Identifier interview, sending you the emails you have enabled, processing payments, and enforcing plan limits. We do not sell your personal data, and we do not use your answers, journals, or transcripts for advertising.

How we use AI (Anthropic)

Six features send your content to Anthropic, our AI provider, solely to generate your results: (1) the Elephant interview conversation itself, (2) your Elephant profile and its calibration, (3) journal pattern analysis (up to your 20 most recent entries), (4) personalized visualizations built from your belief map, (5) your action prescription derived from your Elephant profile, and (6) your composite identity statement. The name you give during the Elephant interview is included so it can address you naturally; your email address is never sent to Anthropic. We log only technical usage (token counts and timing) — never the content of your prompts or results. AI output is informational and is not professional, medical, or psychological advice.

Who processes your data on our behalf

• Anthropic — the AI features listed above.
• Razorpay — payments and subscriptions; receives your name and email to create your payment profile, and handles your card/bank/UPI details directly (we never see them).
• Resend — delivers our emails: sign-in links, receipts, daily practice reminders, renewal notices, and your assessment PDF reports (sent as an email attachment when an assessment is completed on a paid plan).
• Vercel and Neon — host the application, the database where your data is stored, and your PDF reports.

Each provider is contractually bound to use your data only to provide its service to us, not for its own purposes.

How long we keep your data

• Your account, assessments, transformation data, and journals: for as long as your account exists, so you can access your history and compare re-assessments over time.
• Generated PDF report files:emailed to you as an attachment — that attachment is your copy to keep. The file stored on our side is kept only briefly after generation (a few hours) and then deleted, and the email's convenience download link stops working after 2 hours.
• After you request deletion: everything above is permanently deleted once a 30-day grace period passes (sign-in is paused during it). If you change your mind during the grace period, you can request restoration from the sign-in page — our team processes these requests manually, and the deletion proceeds on schedule unless a request is approved before the date.
• Payment transaction facts: retained after account deletion without your name, email, or any link to you, because Indian tax law requires transaction records to be kept.
• Sign-in links: expire after 24 hours and can be used only once.
• Security and rate-limit records: kept for up to 48 hours, then removed by our nightly cleanup; expired sign-in links and sessions are removed by the same nightly cleanup.
• Operational logs (email delivery history, AI usage counts, product usage events, and payment-notification delivery logs): kept for up to 24 months, then deleted automatically.

Your rights

• Access / export: Account → Privacy & Security → Export my data gives you a complete copy of your data, instantly.
• Correction: edit any profile field on your Account page at any time. To correct your sign-in email address, contact us.
• Erasure: Account → Privacy & Security → Delete my account, or email us. The 30-day grace period above applies.
• Withdraw consent: turn emails off on your Account page or via the unsubscribe link in any email; withdraw consent entirely by deleting your account. Withdrawal does not affect processing that happened before it.
• Nominate: you may nominate another person to exercise these rights on your behalf if you are unable to — contact us to arrange it.

Grievances

For any grievance about how your data is handled, email support@indesol.com. We acknowledge grievances within 72 hours and aim to resolve them within 15 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

Security

We protect your data with encrypted connections, tokenized sessions, server-side-only secrets, and signature-verified payment webhooks. No system is 100% secure, but we take reasonable, industry-standard steps to safeguard your information against unauthorized access, alteration, or disclosure.

Children

Disha is for adults (18+) only — you confirm this when signing in, and we do not knowingly process children's data.

Consent and changes to this policy

Your consent is collected through the checkbox at sign-in and recorded together with the version of this policy you agreed to (this is version 2). When this policy changes materially, we update the version and the "Last updated" date above.

Contact us

Questions about this policy or your data? Email support@indesol.com. Indesol Global LLP.