Privacy notice

1. Who we are

HEILC (“we”) is an AI and digital transformation agency based in Chennai, Tamil Nadu, India. For the personal data described here, HEILC is the Data Fiduciary — we decide why and how it is processed (DPDP Act, s.2(i)).

Questions about your data, and grievances, go to our Grievance Officer & privacy contact: Pardhasaradhi Menda, hello@heilc.com, or the grievance form (s.8(9), s.8(10)).

2. This notice in your language

The summary you see before signing in is available in the languages below. If you'd like it in any other language in the Eighth Schedule to the Constitution, ask through the grievance form and we will provide it (s.5(3), s.6(3)).

3. What we collect and why

Reading the site needs no account and no personal data beyond what any web request carries. We ask for data only when you choose to sign in, send a request, generate a proposal or talk to our assistant — and only what that purpose needs (s.4, s.6(1)).

Sign-in providers: if you use Google or Facebook, we receive your name, email address and profile picture from them — nothing else. We never ask for your password, contacts or social posts.

4. What we don't do

• We don't sell or rent personal data, and we run no advertising or analytics trackers.
• We don't ask for precise (GPS) location. Region personalisation uses only your approximate location, only with your permission, and stays in your browser.
• We don't make decisions that legally or significantly affect you by automated means. The assistant and proposal generator produce drafts; people at HEILC make every real decision.
• We don't create accounts for, track, or target advertising at anyone under 18.

5. Who we share it with

These service providers process personal data on our behalf, as Data Processors under contract (s.8(2)). We remain responsible for what they do with it (s.8(1)). Some are outside India; the DPDP Act permits transfer except to countries the Government restricts by notification (s.16), and we will stop any transfer that becomes restricted.

• Supabase — Account sign-in and database. Location: Region chosen at setup (Mumbai, India recommended).
• Vercel — Website hosting and delivery. Location: Global edge network.
• Groq (and Anthropic as fallback) — Generates assistant replies and proposals. Location: United States.
• Resend — Sends sign-in codes and delivers request notifications to the HEILC team. Location: United States (sending region: Tokyo, Japan).
• Google and Meta (Facebook) — Only if you choose them to sign in; they confirm your identity. Location: As per their own policies.
• Spline — Serves the 3D robot on the homepage (receives your IP address as any web request does). Location: As per their own policy.

We disclose personal data to authorities only when Indian law requires it (s.7(c)–(e)), and we will tell you when the law allows us to.

6. How long we keep it

The table above lists each period. We erase personal data once its purpose is served or when you withdraw consent, whichever comes first, unless a law requires us to keep it (s.8(7)). If your account is inactive for three years we treat its purpose as no longer served: we email you 48 hours before erasing it, and signing in stops the deletion (s.8(8)). Our processors are instructed to erase what we shared with them (s.8(7)(b)).

7. Your rights

• Access (s.11) — a summary of your data, what we do with it, and everyone we've shared it with.
• Correction, completion, updating and erasure (s.12) — fix or remove anything, or delete your account entirely.
• Withdraw consent (s.6(4)) — at any time, as easily as you gave it. Withdrawing doesn't make earlier processing unlawful, and you won't be able to use account-only features afterwards (s.6(5)); we stop processing and ask our processors to stop too (s.6(6)).
• Grievance redressal (s.13) — a fast, free route to raise any concern with us.
• Nominate (s.14) — name someone to exercise these rights if you die or become unable to.

8. How to use your rights

• Signed in? Your Account page lets you view and edit everything, download all your data, set a nominee, change consents and delete your account — immediately, no email needed.
• Otherwise, use the grievance form or email hello@heilc.com.
• We acknowledge grievances within 72 hours and resolve them within 30 days, and never later than the 90 days the DPDP Rules allow.
• If you are not satisfied after using our grievance process, you can complain to the Data Protection Board of India (s.13(3), s.27).

9. Children

Accounts are for people aged 18 or over; we ask you to confirm this before sign-in. Under the DPDP Act anyone under 18 is a child, and processing their data needs verifiable parental consent (s.9(1)). We don't offer that, so if we learn a child has created an account we delete it. We never track, behaviourally monitor or target advertising at children (s.9(3)).

10. How we protect it

Reasonable security safeguards (s.8(5)), including:

• Encryption in transit everywhere (HTTPS with HSTS), and encryption at rest by our database provider.
• Database row-level security: every person can read only their own records; staff access is limited to what a task needs.
• Rate limits and input validation on every form and AI endpoint; strict browser security headers.
• Sign-in, export and deletion events logged and kept for one year to detect misuse.
• No passwords stored by us — sign-in is via one-time codes or your Google/Facebook account.

11. If something goes wrong

If a personal data breach affects you, we will tell you and the Data Protection Board without delay — what happened, the likely consequences, what we're doing about it and what you can do — followed by a detailed report to the Board within 72 hours (s.8(6); DPDP Rules, 2025).

12. Your duties

The DPDP Act also asks you not to impersonate anyone, not to suppress material information, not to file false or frivolous grievances, and to give only verifiably authentic information when asking for a correction or erasure (s.15).

13. Changes to this notice

If we change what we collect or why, we update this notice, change its version number, and ask for your consent again before processing anything new. This is version 2026-10-26. See also our terms of use and data deletion instructions.