Caliberix Partners Privacy Notice

This notice is about your personal data as a partner in the Caliberix Partners programme. If you are looking for how a Caliberix app handles the data of the people who use it, that is the StudyLight Privacy Policy.

1. Who we are

Voraky Retail LLP (LLPIN AAP-1854), trading as Caliberix, is the Data Fiduciary for the personal data described here, and you, as a partner, are the Data Principal. This is our notice to you under section 5 of India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). Our addresses and our Grievance Officer are in section 11.

2. The short version

• We collect what we need to review your application, run your account, pay you, and meet our tax obligations — no more.
• Your PAN and UPI ID are encrypted before they are stored. Only the payout screen and the tax report (and its export for our chartered accountant) can read them, and every such view is logged.
• We never sell your data or use it for advertising.
• You are never shown who the people you referred are — and they are never shown who you are.
• Tax records have to be kept for several years after you leave. Everything else goes when your account does.

3. What we collect, and why

What	Why
Your name, e-mail address, mobile number (optional), what kind of partner you are, and where you plan to share the apps — from your application	To review your application and contact you about it
Your e-mail address and, if you use Google sign-in, the account identifier Google gives us; the sign-in links we send and the sessions they create (we store only one-way hashes of these)	To let you sign in without a password, and to keep your account secure
Your acceptance of the Partner Agreement: the version, the date, the name you typed, and a one-way hash of your IP address	To show what you agreed to and when — a legal record
Your PAN, UPI ID and (if you have one) GSTIN, and your legal name and address for invoices	To pay you, and to deduct and report tax as the law requires
Whether your PAN is operative (linked with Aadhaar), as we checked it on the Income Tax Department's TRACES portal, with the date and who checked it	To deduct tax at the rate the law sets — 20% applies until a PAN is confirmed operative
Your commission, tier, the monthly credits to your account (with the exchange rate used), tax deducted, payouts, and UPI references	To work out what you are owed, deduct tax, pay you, and keep our accounts
Clicks on your link: the time, the country, the site the click came from, and a daily one-way hash of the browser identification string — no IP address and no cookie	To show your click count and to spot referrals that are not genuine
The account each customer is attributed to, held against your partner account	To know which purchases earn you commission. This is never shown to you (section 6)
Records of what we do to your account — approval, suspension, a payout, a review — with the reason and who did it	To keep an audit trail, and to answer you if you query something
E-mails we send you, and whether sending succeeded	To run the programme and prove what we told you

We do not collect sensitive categories of data about you, and we do not profile you automatically in a way that produces a legal effect — decisions about your account are made by a person, although suspicious-activity checks are automated and simply put a payment on hold for a person to look at.

4. Why we are allowed to process it

We process your personal data on the grounds the DPDP Act allows:

• Your consent (section 6), which you give when you apply and when you accept the Partner Agreement — to review your application, run your account and sign you in, and, if you ask for them, to send you programme announcements.
• Certain legitimate uses (section 7) — using the details you gave us voluntarily for the purpose you gave them (running your partner account and paying you), and processing that Indian law requires of us: deducting and reporting tax at source, and keeping tax and accounting records.

You can withdraw your consent at any time by writing to support@caliberix.com (or, for announcements, by unsubscribing). Withdrawal does not affect processing already done, the e-mails we must send you to run your account (such as a payment notification), or the records the law requires us to keep (section 8). If you withdraw consent to running your account, we will close it and pay what you are owed under the Partner Agreement.

5. Who receives it

Data Processors — service providers that process your data only on our instructions and under contract, for the purposes in this notice:

• Cloudflare — hosts the portal and its database, and protects it from attack.
• Resend — sends the programme's e-mails (your address and the content of the e-mail).
• Google — only if you choose to sign in with Google, and only to confirm that the account is yours.
• EmailOctopus — only if you ask for programme announcements (your e-mail address).

Others who receive data because the law or the service requires it, each responsible for its own handling:

• Our bank and the UPI network — to make your payments.
• Our chartered accountant and auditors — for our accounts and tax returns.
• The Income Tax Department — we check your PAN on its TRACES portal, and tax deducted from the commission credited to you is reported against your PAN, as the law requires.
• A court, regulator or law-enforcement agency — if we are legally required to disclose, or must to establish or defend a legal claim.
• A buyer of our business — if we are ever sold or reorganised, with your rights unchanged.

We do not sell your personal data, and we do not share it with advertisers.

6. What partners and customers never see about each other

Your dashboard shows counts, dates, amounts and an anonymous reference such as "Customer 3F9A1C" — never a name, e-mail address, phone number, account or device. Equally, the people who use the apps are not told who referred them beyond the name you chose to publish yourself.

7. Where it is stored

The portal and its database run on Cloudflare's network; our e-mail providers and other Data Processors process data in the countries where they operate, including the United States and the European Union. Section 16 of the DPDP Act allows personal data to be transferred outside India except to a country the Central Government restricts by notification; we will follow any such restriction. We transfer only what each service needs, under contractual protections with the provider.

8. How long we keep it

• Your account and its history — while your account is open, and for one year after it closes, so that we can answer questions about it.
• Payments, commission, PAN, GSTIN and tax records — eight years from the end of the financial year they belong to, because tax and company law requires it. These are kept even if you ask us to delete your account.
• Your UPI ID — while your account is open; it is deleted when the account closes, except where a payment record must show which account was paid.
• Click records — 13 months, then deleted automatically.
• Sign-in links and sessions — deleted within a day of expiring.

9. How we protect it

We take reasonable security safeguards to prevent personal data breaches, as section 8(5) of the DPDP Act requires. Your PAN and UPI ID are encrypted (AES-GCM) before they are written to the database, and the key is held separately as a platform secret; if that key is missing, we refuse to store the details rather than store them in the clear. Sign-in links and session identifiers are stored only as one-way hashes. The admin side of the portal is reachable only through Cloudflare Access with a named account, and every change and every view of a PAN or UPI ID is written to an audit log. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the DPDP Act requires. No system is perfectly secure, but we test these controls and keep them under review.

10. Your rights

As a Data Principal you have these rights under the DPDP Act:

• A summary of your data (section 11) — of the personal data we process about you and what we do with it, and of the Data Fiduciaries and Data Processors we have shared it with. Most of it is in your dashboard; ask us for the rest.
• Correction and erasure (section 12) — you can change your payout and contact details in the portal; ask us for anything else. On erasure we close your account and delete what we are not required to keep (section 8).
• Withdraw consent at any time (section 4 above).
• Grievance redressal (section 13) — our Grievance Officer (section 11) acknowledges complaints within 48 hours and answers within 30 days; if you are not satisfied, you may complain to the Data Protection Board of India.
• Nominate (section 14) someone to exercise your rights if you die or become incapable of exercising them yourself. To nominate, or to change or withdraw a nomination, write to support@caliberix.com from your account's e-mail address with the nominee's full name and contact details; we confirm it in writing and keep it with your account.

Write to support@caliberix.com to use any of these. We may need to confirm your identity first.

11. Contact

Voraky Retail LLP (LLPIN AAP-1854), trading as Caliberix
Registered office: Flat No. 402, Sai Nilayam, H. No. 2-99/2, Plot No. 4-1-76-1-113 & 114, next to the Gram Panchayat Office, Nizampet, Hyderabad, Rangareddy, Telangana 500090, India.
Operating office: Ground Floor, Plot No. 942/1780 and 457/1781, Ward No. 17, Banka Bihari Nagar, Gate Bazar, Brahmapur, Ganjam, Odisha 760001, India.
Grievance Officer: M.B. Dalai, Designated Partner — support@caliberix.com. We acknowledge complaints within 48 hours and aim to resolve them within one month.

12. Changes

If we change this notice, the new version appears here with a new version number and date, and we tell partners by e-mail before a material change takes effect.