Caliberix Partners Privacy Notice

This notice is about your personal data as a partner in the Caliberix Partners programme. If you are looking for how a Caliberix app handles the data of the people who use it, that is the StudyLight Privacy Policy.

1. Who we are

Voraky Retail LLP (LLPIN AAP-1854), trading as Caliberix, is the data fiduciary for the personal data described here. Our addresses and our Grievance Officer are in section 11. This is our notice under India's Digital Personal Data Protection Act, 2023.

2. The short version

• We collect what we need to review your application, run your account, pay you, and meet our tax obligations — no more.
• Your PAN and UPI ID are encrypted before they are stored. Only the payout screen and the tax report can read them, and every such view is logged.
• We never sell your data or use it for advertising.
• You are never shown who the people you referred are — and they are never shown who you are.
• Tax records have to be kept for several years after you leave. Everything else goes when your account does.

3. What we collect, and why

What	Why
Your name, e-mail address, mobile number (optional), what kind of partner you are, and where you plan to share the apps — from your application	To review your application and contact you about it
Your e-mail address and, if you use Google sign-in, the account identifier Google gives us; the sign-in links we send and the sessions they create (we store only one-way hashes of these)	To let you sign in without a password, and to keep your account secure
Your acceptance of the Partner Agreement: the version, the date, the name you typed, and a one-way hash of your IP address	To show what you agreed to and when — a legal record
Your PAN, UPI ID and (if you have one) GSTIN, and your legal name and address for invoices	To pay you, and to deduct and report tax as the law requires
Your commission, tier, payouts, exchange rates, tax deducted, and UPI references	To work out what you are owed, pay it, and keep our accounts
Clicks on your link: the time, the country, the site the click came from, and a daily one-way hash of the browser identification string — no IP address and no cookie	To show your click count and to spot referrals that are not genuine
The account each customer is attributed to, held against your partner account	To know which purchases earn you commission. This is never shown to you (section 6)
Records of what we do to your account — approval, suspension, a payout, a review — with the reason and who did it	To keep an audit trail, and to answer you if you query something
E-mails we send you, and whether sending succeeded	To run the programme and prove what we told you

We do not collect sensitive categories of data about you, and we do not profile you automatically in a way that produces a legal effect — decisions about your account are made by a person, although suspicious-activity checks are automated and simply put a payment on hold for a person to look at.

4. Why we are allowed to process it

We process your data because you asked to join the programme and because we have a contract with you (the Partner Agreement); because Indian tax and accounting law requires us to keep records and deduct tax; and, where we send you programme announcements, because you consented when you applied. You can withdraw consent at any time; that does not affect the e-mails we must send you to run your account, such as a payment notification.

5. Who receives it

• Cloudflare — hosts the portal and its database, and protects it from attack.
• Resend — sends the programme's e-mails (your address and the content of the e-mail).
• Google — only if you choose to sign in with Google, and only to confirm that the account is yours.
• Our bank and UPI provider — to make your payments.
• Our chartered accountant and auditors — for our accounts and tax returns.
• The Income Tax Department — tax deducted from your payments is reported against your PAN, as the law requires.
• A court, regulator or law-enforcement agency — if we are legally required to disclose, or must to establish or defend a legal claim.
• A buyer of our business — if we are ever sold or reorganised, with your rights unchanged.

We do not sell your personal data, and we do not share it with advertisers.

6. What partners and customers never see about each other

Your dashboard shows counts, dates, amounts and an anonymous reference such as "Customer 3F9A1C" — never a name, e-mail address, phone number, account or device. Equally, the people who use the apps are not told who referred them beyond the name you chose to publish yourself.

7. Where it is stored

The portal and its database run on Cloudflare's network; our e-mail provider and our other service providers process data in the countries where they operate, including the United States and the European Union. Where data leaves India, we rely on contractual protections with those providers and transfer only what the service needs.

8. How long we keep it

• Your account and its history — while your account is open, and for one year after it closes, so that we can answer questions about it.
• Payments, commission, PAN, GSTIN and tax records — eight years from the end of the financial year they belong to, because tax and company law requires it. These are kept even if you ask us to delete your account.
• Your UPI ID — while your account is open; it is deleted when the account closes, except where a payment record must show which account was paid.
• Click records — 13 months, then deleted automatically.
• Sign-in links and sessions — deleted within a day of expiring.

9. How we protect it

Your PAN and UPI ID are encrypted (AES-GCM) before they are written to the database, and the key is held separately as a platform secret; if that key is missing, we refuse to store the details rather than store them in the clear. Sign-in links and session identifiers are stored only as one-way hashes. The admin side of the portal is reachable only through Cloudflare Access with a named account, and every change and every view of a PAN or UPI ID is written to an audit log. No system is perfectly secure, but we test these controls and keep them under review.

10. Your rights

• See your data — most of it is in your dashboard; ask us for the rest.
• Correct it — you can change your payout details and contact details in the portal; ask us for anything else.
• Have it erased — ask, and we will close your account and delete what we are not required to keep (section 8).
• Withdraw consent to programme announcements at any time.
• Nominate someone to exercise your rights if you die or become incapable of exercising them yourself.
• Complain — to our Grievance Officer first (section 11), and then, if you are not satisfied, to the Data Protection Board of India.

Write to support@caliberix.com to use any of these. We may need to confirm your identity first. We answer within 30 days.

11. Contact

Voraky Retail LLP (LLPIN AAP-1854), trading as Caliberix
Registered office: Flat No. 402, Sai Nilayam, H. No. 2-99/2, Plot No. 4-1-76-1-113 & 114, next to the Gram Panchayat Office, Nizampet, Hyderabad, Rangareddy, Telangana 500090, India.
Operating office: Ground Floor, Plot No. 942/1780 and 457/1781, Ward No. 17, Banka Bihari Nagar, Gate Bazar, Brahmapur, Ganjam, Odisha 760001, India.
Grievance Officer: M.B. Dalai, Designated Partner — support@caliberix.com. We acknowledge complaints within 48 hours and aim to resolve them within one month.

12. Changes

If we change this notice, the new version appears here with a new version number and date, and we tell partners by e-mail before a material change takes effect.