Privacy Policy

This policy explains what personal data Shadow & Sun (shadowandsun.app) collects, why, and the choices you have. It is written to comply with India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and its rules. Shadow & Sun is the data fiduciary for the data described here.

1. What we collect

• Account data: your name and email address, managed through Supabase Auth (including Google sign-in if you use it). If your institution invited you, we create your account from the name and email it gave us, and you confirm it is you with a one-time code sent to that inbox before choosing your own password. We store only a protected (hashed) form of that code, briefly.
• Assessment data: your answers, the name the report is for, your current and target locations, and the scored results and generated narrative, for Rise, Ascent and our other assessments.
• Daybreak interview data: recordings of your spoken answers, their transcripts, delivery measures (such as speaking pace and pauses) and your interview report. Your answer recordings are deleted automatically after 30 days; transcripts and the report stay with your account. If you turn on your camera, it is analysed only inside your browser: video never leaves your device, and we receive only summary numbers (for example how often you faced the screen).
• Credits and referrals: your credit balance and its history. If you invite a friend, we store the email address you enter and send it one invitation; only invite people who are happy to hear from us.
• Payment data: order amount, status, and a payment reference from Cashfree. We never see or store your card, UPI, or bank details; those go directly to Cashfree.
• Usage data: chat questions you ask Dawn or Dusk (our free helper), report feedback you submit, and standard technical logs (IP address, timestamps) used for security and rate limiting. When you create an account we record the IP address it was created from and derive an approximate city/country from it, for fraud prevention and to understand where our users are.
• Analytics: anonymous product-usage events (pages viewed, assessment started, payment started) so we can see where people get stuck. We use explicit events only, no session recording, no advertising trackers, and your assessment answers are never sent to analytics.

2. Why we collect it (purpose limitation)

We process personal data only to: create and secure your account, generate and deliver your reports and interview feedback, process payments and prevent fraud or coupon and referral abuse, send the emails you need (invites, sign in codes, report ready notices, credit reminders, and occasional product news you can unsubscribe from), answer your questions, and improve the Service using aggregate statistics. We do not sell your data or use it for third-party advertising.

2a. Programmes run with your institution

Your individual reports and interview feedback are private to you. When your college or employer runs a placement readiness or development programme with us, it may receive an overall summary for its batch (for example how many students took each test and the spread of results), without any student’s individual results, answers, recordings or payment details. The invitation email says which institution this is. If you have questions, write to us.

3. Consent and children

You provide data by consent when you sign up, take an assessment, or make a payment. Assessments for anyone under 18 must be administered by a parent or legal guardian from their own account, with verifiable consent recorded before the assessment starts, as the DPDP Act requires for processing children’s data. Only the minor’s first name is stored with the results, and we do not use minors’ data for tracking or targeted advertising.

4. Who processes your data

We use a small set of processors, each bound by their own contractual and security obligations: Supabase (authentication and database hosting), Cashfree Payments (payment processing, an RBI-regulated Indian payment aggregator), AI model providers (OpenRouter and the model it routes to, currently Google Gemini) to write the narrative of your reports, your interview questions and feedback, and Dawn’s answers. They receive your first name, results and interview transcripts, never your email or payment details. ElevenLabs and Amazon Polly turn the interviewers’ lines into speech; they never receive your voice. Your spoken answers are transcribed on our own server. Google Workspace sends our emails, PostHog (product analytics), and Sentry (error monitoring, receives crash details, never your assessment answers). Some processors store data outside India; where they do, transfers happen under their standard safeguards, consistent with current DPDP Act rules.

5. Retention

Your account, reports, and order history are kept while your account exists, so you can return to your report at any time. Daybreak answer recordings are deleted 30 days after the interview. Sign in codes expire after 30 minutes. Technical logs are kept only as long as needed for security. When your account is deleted, your personal data is deleted or anonymised, except records we must keep under Indian tax and payment regulations.

6. Your rights

Under the DPDP Act you may: access a summary of the personal data we hold about you, request correction of inaccurate data, request erasure of your data and account, withdraw consent (which ends further processing but doesn’t affect what was lawfully done before), and nominate a person to exercise these rights for you. To exercise any of these, email connect@shadowandsun.app from your registered address. We respond within 30 days.

7. Grievances

If you believe your data has been mishandled, contact our grievance officer at connect@shadowandsun.app with the subject “Grievance”. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

8. Security and changes

Data is encrypted in transit (TLS), access to production systems is restricted, and payment credentials never touch our servers. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify you and the Data Protection Board as the DPDP Act requires. Material changes to this policy will be posted here with a new date. See also our Terms of Service and Refund Policy.