Privacy Policy

Effective date: 2026-05-26 · Last updated: 2026-06-12 · Version 1.1

1. Who is the Controller of Your Data

The data controller for the purposes of GDPR and equivalent laws is:

• Viprasol Tech Private Limited (operating the "Cimpathy" service)
• CIN: U62090HR2025PTC135188
• Incorporated: 18 August 2025
• Registered in Haryana, India
• Contact: help@cimpathy.com
• Postal address available on request via the email above.
• EU/UK Representative (GDPR / UK GDPR Article 27): Cimpathy is operated from India and is first launching in India. We will designate an Article 27 representative before actively offering or directing the Service to individuals in the EU/EEA or the UK, and their name and address will be published here at that time. In the meantime, EU/EEA/UK residents may contact us at help@cimpathy.com, and we honour the data-protection rights described in this policy regardless of where you live.

2. What Information We Collect

We collect only what is necessary to run the Service. Categories:

What we explicitly do NOT collect: card numbers (Cashfree handles these — they never pass through our servers), biometric data, browsing history outside Cimpathy, contacts, camera, microphone, precise location, or unique device fingerprints beyond an opaque hash.

3. Why We Process Your Data (Lawful Basis)

Under GDPR Article 6 we identify a lawful basis for each processing purpose. For special-category data — your sensitive mental-wellness information, which may concern your health — we additionally rely on your explicit consent under Article 9(2)(a), and we never sell or share it.

4. How We Use Your Information

• Provide and personalize the Service (your home dashboard, history, mood charts);
• Authenticate you and prevent fraud or abuse;
• Run our crisis-safety system (real-time text classifier on your messages to surface emergency resources — runs on our server, no human reads your messages unless you contact support);
• Process Premium and Premium Plus purchases and payments (via Cashfree in India, or PayPal internationally);
• Send transactional notifications (password reset, payment receipt, security alert, material policy change);
• Improve the Service through aggregated, de-identified usage signals (e.g., crash counts);
• Comply with legal obligations and respond to lawful requests.

We do not use your content to train AI models. We do not sell or rent your personal information to anyone. We do not use cross-app tracking or third-party advertising cookies.

5. Who We Share Your Information With

We share data only with a limited list of vetted processors who operate under contract and only for the purposes listed:

We will share data with law enforcement only when legally compelled by a valid order in our jurisdiction. We publish a transparency note if we ever receive such a request; gag orders permitting.

6. International Data Transfers

Some of our subprocessors (Anthropic, Resend, Sentry) are located in the United States. For users in the EU/UK we rely on Standard Contractual Clauses (SCC 2021/914) approved by the European Commission, together with a transfer impact assessment ("TIA"). For users in India, transfers are made in accordance with Section 16 of the Digital Personal Data Protection Act, 2023 (the Indian government has not, as of the effective date, restricted transfers to these countries). Payment data for Indian users is processed within India by Cashfree. If you would like a copy of the SCCs or our TIA summary, email help@cimpathy.com.

7. Encryption & Security

• Wellness content (journal, mood notes, safety plan, hope-vault items, AI chat history) is encrypted on your device with AES-256-GCM using a per-record key derived from a master key under your control.
• The master key is wrapped with your BIP-39 recovery phrase. We never see plaintext content for these records, even when synced.
• Account passwords are stored hashed with bcrypt (a per-password random salt and an adaptive work factor, per OWASP guidance). We never store your password in plaintext.
• Transport security: TLS 1.2+ enforced; HSTS; certificate pinning in mobile apps.
• Access controls, rate limits, audit logs, refresh-token reuse detection.
• Crash reports (if you opted in) are anonymized — no IP, no message content.
• Device-side note (web): the "we cannot read your content" guarantee applies to our servers, which only ever receive ciphertext for the wellness content listed above. On the web app, the on-device encryption key is held in your browser's local storage (browsers do not expose a hardware secure-enclave to web apps). It is therefore as protected as your browser/device profile; for the strongest protection, use a device passcode and our in-app App Lock, and avoid shared/public computers.

No system is perfectly secure. If you discover a vulnerability, please report it to help@cimpathy.com.

8. How Long We Keep Your Data

9. Your Rights

Subject to applicable law, you have the right to:

• Access — request a copy of personal data we hold about you (GDPR Art. 15; CCPA §1798.110);
• Rectify — correct inaccurate or incomplete data (GDPR Art. 16);
• Erase / Delete — "right to be forgotten" (GDPR Art. 17; CCPA §1798.105);
• Restrict processing in certain cases (GDPR Art. 18);
• Portability — receive your data in a structured, machine-readable format (GDPR Art. 20);
• Object to processing based on legitimate interests (GDPR Art. 21);
• Withdraw consent at any time, without affecting prior processing (GDPR Art. 7);
• Not be subject to automated decision-making with legal effect (GDPR Art. 22) — Cimpathy does not make such decisions;
• Lodge a complaint with your local data-protection authority (e.g., ICO in the UK, CNIL in France, BfDI in Germany).

To exercise any right: email help@cimpathy.com with the subject "Data Rights Request" and your registered email. We respond within 30 days (extendable by 60 days for complex requests, with notice). We may ask you to verify your identity to prevent fraud.

You may also delete most data yourself via Settings → Account → Delete account (immediate soft-delete; hard-deleted after 30 days).

10. For California Residents (CCPA/CPRA)

If you reside in California, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by CPRA:

• Right to know the categories and specific pieces of personal information collected (§1798.110);
• Right to delete personal information (§1798.105);
• Right to correct inaccurate personal information (§1798.106);
• Right to opt-out of "sale" or "sharing" of personal information (§1798.120, §1798.121) — we do not sell or share your personal information; there is nothing to opt out of, but you may submit a verifiable request anyway and we will confirm in writing;
• Right to limit use of sensitive personal information (§1798.121) — we use sensitive information only for the purposes listed in Section 4;
• Right to non-discrimination for exercising any right (§1798.125) — we will not deny service, charge differently, or downgrade quality.

To submit a CCPA request, email help@cimpathy.com with "California Privacy Request" in the subject. An authorized agent may submit on your behalf with written authorization. Verification is required.

11. For Users in India (Digital Personal Data Protection Act, 2023)

If you are in India, the following applies in addition to the rights above. Viprasol Tech Private Limited is the Data Fiduciary for your personal data.

Notice & consent. We process your personal data — including sensitive data about your mental wellbeing — on the basis of the consent you give through the in-app consent flow before any such processing begins. You may withdraw consent at any time in Settings → Privacy, or by writing to our Grievance Officer. Withdrawing consent is as easy as giving it and does not affect processing already lawfully carried out.

Your rights as a Data Principal (DPDP §11–14):

• Access — obtain a summary of the personal data we process and our processing activities;
• Correction & erasure — correct, complete, update, or erase your personal data;
• Grievance redressal — a readily available means to raise grievances (see Grievance Officer below);
• Nomination — nominate another individual to exercise your rights in the event of your death or incapacity.

Grievance Officer. In accordance with DPDP §13 and the Information Technology Act, 2000, the Grievance Officer for Cimpathy is:

Deepak — Grievance Officer
Viprasol Tech Private Limited
Email: help@cimpathy.com (subject line: "Grievance")
We acknowledge grievances within 24 hours and aim to resolve them within the period prescribed under applicable law.

You may also lodge a complaint with the Data Protection Board of India once it is constituted.

12. Children

Cimpathy is intended only for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18.

Under DPDP §9 (India), we do not knowingly process a child's personal data (a person under 18 in India) without the verifiable consent of a parent or lawful guardian, and we do not carry out tracking, behavioural monitoring, or targeted advertising directed at children. Under COPPA (US) we do not knowingly collect data from children under 13, and under GDPR (EU) not from children under 16 (or the lower age set by a member state, minimum 13). If you believe a minor has provided us information, contact help@cimpathy.com and we will delete it promptly.

13. Cookies & Similar Technologies

The Cimpathy website uses only strictly necessary cookies (session token, CSRF token, theme preference). We do not use advertising cookies, analytics cookies, or third-party tracking. The mobile/web app uses local storage and IndexedDB to keep your data on your device — this is not a "cookie" in the regulatory sense but functions similarly. You can clear it by uninstalling the app or using your browser's "Clear site data" feature.

14. Marketing vs Transactional Email

Transactional emails (password reset, security alert, payment receipt, material policy change, account verification) are sent regardless of marketing consent and cannot be opted out of while you maintain an account — these are required to deliver the Service safely.

Marketing emails (product updates, tips, surveys) are sent only with your prior, specific, opt-in consent. Every marketing email includes an unsubscribe link that takes effect within 24 hours. You can also opt out at Settings → Notifications.

15. AI Processing & Profiling

The Service uses Anthropic's Claude API for premium AI chat. When you send a message to the AI:

• Your message is transmitted to Anthropic over TLS, processed, and the response returned.
• Anthropic's policy (as of last verification — see footer date) is to not train models on API content by default and to retain API logs for up to 30 days for abuse monitoring before deletion. We re-verify quarterly; please consult Anthropic's current policy at anthropic.com/legal/privacy.
• We do not profile you or make automated decisions with legal or significant effect about you.
• Crisis-detection is a deterministic regex-based pre-filter operated on our server; it surfaces emergency resources but does not contact anyone on your behalf.

16. Data Breach Notification

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will:

• Notify the competent supervisory authority within 72 hours of becoming aware (GDPR Art. 33);
• Notify affected users without undue delay if the breach is likely to result in high risk (Art. 34);
• Publish a transparency note on our website summarizing scope, impact, and remediation.

17. Changes to This Policy

We may update this Privacy Policy. Material changes (new data uses, new subprocessors, expanded retention) will be communicated by email and in-app banner at least 30 days before the effective date. The "Last updated" timestamp at the top reflects the most recent change. Continued use of the Service after the effective date constitutes acceptance.

18. Contact & Complaints

The Cimpathy service is operated by Viprasol Tech Private Limited (CIN: U62090HR2025PTC135188), a company incorporated on 18 August 2025 and registered in Haryana, India.

• All inquiries (privacy, security, legal, general support): help@cimpathy.com

If you are not satisfied with our response, you have the right to lodge a complaint with your local data-protection authority:

• UK: Information Commissioner's Office — ico.org.uk
• EU: your national DPA — directory at edpb.europa.eu
• California: California Privacy Protection Agency — cppa.ca.gov