How we handle your personal data

Who is responsible for your data

Sailesh Bhupalam, operating as Pragnapath, decides how and why your personal data is processed, which makes us the Data Fiduciary under the DPDP Act. Because this is a Sole proprietorship, the proprietor is personally accountable for that handling.

You can reach us about anything in this policy at hello.sobr@gmail.com. Our grievance contact is named in the "Grievance and contact" section below.

What we collect, and exactly why

We collect only what we need to run the service you signed up for. Each item below has a single, specific purpose - we do not collect data on the off chance we might want it later.

• Name - to address you, to personalise your account, and to put your name on a GST invoice when you pay.

• Email address - to create and secure your login, to send you service and account messages, and to deliver access and receipts.

• Phone number - to reach you about your account, payment, or a grievance when email is not enough.

• Payment metadata (the UPI reference or transaction ID, amount, and date) - to confirm your payment, unlock access, issue a GST invoice, and process any refund. We do NOT store your card number, UPI PIN, or bank credentials - those stay with the payment rail and never reach us.

• Your intake answers (the questions you answer when you start) - to set up your prep experience and tailor what you see.

• Your climb and progress data (your daily activity, drills, dry-block records, reflections, and the signals the experience produces) - to run the prep simulation, show you your own progress, and give you the honest read the service exists to deliver.

• A reflection you explicitly mark as shareable is ALSO shown to other learners. This is off by default: a reflection is private to you unless you turn sharing on for that specific line. When you do share, anyone who reaches the same day of the climb may see it - including people who start months after you, in later groups. You choose separately whether it appears anonymously (the line only, with nothing that identifies you) or with a name you type yourself. You can delete any reflection at any time, and it disappears from every surface immediately.

Our legal basis: your consent

We process your personal data on the basis of your consent. Under the DPDP Act that consent must be free, specific, informed, unconditional, and given by a clear affirmative action - so we ask for it that way.

We do not use pre-ticked boxes or bundled accept-everything traps. You choose to share each thing for the purpose we state, and you can decline anything that is not strictly required to deliver what you paid for.

Withdrawing your consent

Withdrawing your consent is as easy as giving it. Write to hello.sobr@gmail.com and tell us what you want to withdraw, or use the self-serve erasure route at /ramp/privacy/erase.

When you withdraw consent, we stop the processing that relied on it. This does not undo processing we already did lawfully before you withdrew, and a few narrow records the law requires us to keep (see the retention section below) may remain for that limited purpose only.

Your rights, and how to use each one

As a Data Principal under the DPDP Act you have the following rights. We will not charge you for exercising them, and we will not make the service harder to use because you did.

• Right to access - ask what personal data of yours we hold and how we have processed it. Request it at hello.sobr@gmail.com; your account also lets you export your own data.

• Right to correction - ask us to correct or complete anything inaccurate or out of date. Write to hello.sobr@gmail.com and we will update it.

• Right to erasure - have your personal data deleted when its purpose is served or you withdraw consent. This is already self-serve at /ramp/privacy/erase; you do not have to wait for us.

• Right to grievance redressal - raise a complaint about how we handle your data and get a response within our published timeline. Contact details are in the next section.

• Right to nominate - name another person to exercise your rights on your behalf if you die or become incapacitated. Tell us your nominee at hello.sobr@gmail.com.

Grievance and contact

If you have any concern about your personal data, contact our Grievance Officer, Sailesh Bhupalam (Grievance Officer (Proprietor)), at hello.sobr@gmail.com.

We will acknowledge your grievance within 24 hours and work to resolve it within 15 days.

How long we keep it, and when we erase it

We keep your personal data only as long as the purpose it was collected for is still live. When that purpose is served, or you withdraw consent or ask for erasure, we delete it.

The one exception is records the law makes us keep - chiefly the tax and GST invoice records tied to a payment, which Indian tax law requires us to retain for a fixed period. We keep only those records, only for that purpose, and only for as long as required.

If there is a data breach

If a personal data breach affects you, we will notify you and the Data Protection Board of India as the DPDP framework requires. We commit to reporting a notifiable breach within 72 hours of becoming aware of it, and we will tell affected users what happened, what data was involved, and what to do.

Escalating to the Data Protection Board

If we do not resolve your grievance to your satisfaction, you can complain to the Data Protection Board of India. We would rather you give us the chance to fix it first - reach Sailesh Bhupalam at hello.sobr@gmail.com - but the Board is your right.

Where your data is processed, and who this is for

Your personal data is processed in India.

This is an adults-only (18+) service. We do not knowingly collect data from anyone under 18, so the DPDP children's-data and parental-consent obligations do not apply here. If you are not 18 or older, please do not use the service or share any data with us.

Cookies and analytics

We use the minimum cookies needed to keep you logged in and to keep the service working. Any product analytics we run (for example, a tool like PostHog) is used only to understand and improve the product - not to sell you anything or build an advertising profile.

A note on our scale

We are a small operator and, at our current scale, are not a Significant Data Fiduciary under the DPDP Act (that is a designation the Government makes for large-volume or high-risk processors). If that ever changes, we will take on the additional duties the Act attaches to it.

Version and status

This Privacy Policy is version v1-provisional, effective 2026-06-30.

We may update this policy from time to time as our service or the law evolves; the effective date above always reflects the current version, and material changes will be notified to you.