Privacy Policy &
Data Protection Framework
Baagupadu is engineered on the principle that self-discovery requires absolute psychological safety. We strictly adhere to India's Digital Personal Data Protection (DPDP) Act 2023, the Information Technology Act 2000, and CERT-In cybersecurity directives.
Our Uncompromising Privacy Commitments (TL;DR)
- No Sale of Data: We never monetize, rent, or trade your journal entries or career roadmaps.
- Active PII Scrubbing: Phone numbers, Aadhaar, PAN, and emails are scrubbed before LLM dispatch.
- Minor Non-Tracking (Sec 9): Zero behavioral tracking or advertising targeted at students under 18.
- Right to Erasure: You can permanently purge your entire profile and chat history on demand.
1. Introduction & Entity Details
This Privacy Policy constitutes a legally binding agreement between you (the "Data Principal", "User", or "Student") and Baagupadu Technologies ("Baagupadu", "we", "us", or "our"), an Indian technology enterprise co-founded and architected by Sreekar Reddy Pindi in Hyderabad, Telangana, India.
This policy governs your access to and use of baagupadu.com, our conversational autonomous AI companion engine ("Sahayam AI"), student reflective journals, career roadmap synthesizers, and educational institutional pilot programs (Campus Edition).
Corporate Registration & Operating Headquarters:
Baagupadu Technologies • Hyderabad, Telangana, India • Email: info@baagupadu.com
2. Statutory Legal Framework
Baagupadu operates under strict compliance with the statutory legal doctrines of the Republic of India:
- Digital Personal Data Protection (DPDP) Act 2023 (Act No. 22 of 2023):
Enforcing lawful grounds for processing digital personal data, verifiable parental consent for minors, purpose limitation, and statutory rights of Data Principals.
- Information Technology Act 2000 & IT Rules 2011:
Governing reasonable security practices and procedures for sensitive personal data or information (SPDI).
- CERT-In Cybersecurity Directives (Section 70B(6) IT Act):
Mandatory secure logging, 180-day audit log retention within Indian territorial jurisdiction, and immediate incident notification.
3. Data We Collect & What We Reject
Under Section 6 (Notice) and Section 7 of the DPDP Act 2023, personal data processing must be limited to specific, necessary purposes:
What We Collect (With Consent)
- • Account Identifiers: Name and email address authenticated via Clerk.
- • Reflective Inputs: Answers provided during childhood curiosity, teenage identity, and adult ambition explorations.
- • Guidance Preferences: Academic stream, vocational goals, and preferred companion tone.
- • Security Telemetry: IP address and browser type for rate-limiting and DDoS defense.
What We Strictly Never Collect
- • Biometric Data: No fingerprints, facial scans, or voiceprints.
- • Financial Credentials: No credit/debit card numbers or bank account PINs.
- • National IDs: No Aadhaar scans, PAN copies, or passport records.
- • Invasive Geolocation: No real-time GPS tracking or background tracking.
4. Automated PII Redaction Engine
A foundational cornerstone of Baagupadu's architecture is our internal PII Scrubbing Engine (implemented in backend/core/pii_scrubber.py).
Before any student reflection or dialogue is dispatched to our reasoning pipeline or Large Language Model (LLM), it passes through high-speed regex sanitizers specifically tuned for the Indian subcontinent:
This ensures that even if a student accidentally shares their phone number or Aadhaar in conversation, that information is masked in volatile memory before reaching the inference model.
5. Special Protections for Minors (Section 9 DPDP Act)
Section 9 of the DPDP Act 2023 establishes stringent statutory safeguards for children (individuals under 18 years of age). Baagupadu adheres to these protections comprehensively:
1. Complete Prohibition on Behavioral Tracking & Profiling
Under Section 9(2), Baagupadu does not undertake behavioral tracking, advertising surveillance, or predictive commercial profiling of minor students.
2. Absolute Ban on Targeted Advertising
Under Section 9(3), we never serve targeted advertisements directed at children or monetize student academic stress.
3. Guardian Consent Framework
For students under the age of 18 participating via institutional tie-ups (schools/colleges), verifiable parental or institutional guardian consent is required prior to processing student data.
6. Data Principal Rights & Right to Erasure
Under Chapter III of the DPDP Act 2023, you hold enforceable statutory rights over your personal data:
Right to Access (Section 11)
Request a readable copy of all your persona reflections, conversation messages, and generated roadmap milestones.
Right to Correction (Section 12)
Correct or update outdated career goals, academic streams, or account credentials at any time.
Right to Erasure ("Delete Me")
Under Section 12(3), demand the permanent deletion of your account. We execute a cascade delete of all chat history and anonymize security logs.
Right of Grievance Redressal (Section 13)
Access a dedicated, accessible grievance resolution process with a nominated Data Protection Officer.
7. AI Governance, Dynamic RAG & Scope of Advice
In accordance with international AI transparency principles (aligned with EU AI Act Articles 13 & 14):
- Clear AI Notification:You are conversing with an autonomous artificial intelligence system ("Sahayam AI"), not a human counselor.
- Dynamic RAG Grounding: Rather than unconstrained text generation, Sahayam uses pgvector retrieval against curated developmental psychology and educational frameworks to prevent hallucinations.
- Important Informational Disclaimer: Sahayam AI provides educational exploration, empathetic self-discovery, and reflective roadmaps. It does not provide licensed clinical psychiatric treatment, statutory psychological therapy, medical diagnosis, or guaranteed admission/employment outcomes.
8. Security Architecture & CERT-In Log Retention
Baagupadu employs defense-in-depth cybersecurity controls across every layer:
Transport Encryption
TLS 1.3 encryption enforced on all incoming traffic via Cloudflare Zero Trust tunnel protection.
Cryptographic Auth
Clerk RS256 JWKS public key validation verifies every API request before backend handler execution.
Adversarial LLM Rails
Guardrail agents continuously filter prompt injections, jailbreaks, and sensitive data leakage.
CERT-In 180-Day Retention
In accordance with CERT-In directives, technical access and security logs are securely stored for 180 days within India.
9. Infrastructure & Third-Party Sub-Processors
We engage vetted enterprise infrastructure providers under strict Data Processing Addendums:
| Sub-Processor | Purpose | Security Certifications |
|---|---|---|
| Clerk.com | User Authentication & Multi-Factor Security | SOC 2 Type II, ISO 27001 |
| Cloudflare, Inc. | Global Edge WAF, DDoS Mitigation & TLS Termination | SOC 2 Type II, ISO 27001 |
| Vercel Inc. | Frontend Application Delivery & CDN | SOC 2 Type II |
10. DPO & Grievance Redressal
In compliance with Section 13(2) of the Digital Personal Data Protection Act 2023, Baagupadu has appointed a dedicated Data Protection Officer (DPO) & Grievance Redressal Officer.
Statutory SLA: All privacy grievances, access requests, or deletion notices are formally acknowledged within 24 business hours and resolved within 30 calendar days as required by Indian law.