Pilot Privacy & Data Handling Notice

Data Fiduciary and grievance contact

The Data Fiduciary for Sefixa is Puneet Naliath, an individual. There is no registered company. Puneet Naliath is also the person who receives and answers grievances.

Write to hello@sefixa.com for access, correction, erasure, withdrawal of consent, nomination, grievances and other privacy requests. Include the workspace ID and the requested scope. Do not email document contents, passwords, authentication tokens or service credentials.

What Sefixa processes

• Account and workspace data: email address, workspace membership and role, authentication/session state and account lifecycle events.
• Workspace content: questionnaires/RFPs, approved evidence, extracted requirements, draft and approved answers, and source-linked evidence references.
• Operational metadata: audit events, retention settings, usage/plan counters, rate-limit state, request identifiers and service diagnostics.
• Optional outreach measurement: only after you consent, first-party campaign events such as landing, engagement and signup, together with coarse browser context (screen size, language and time zone).

Why it is processed

Sefixa processes these data to authenticate users, isolate workspaces, store and parse customer documents, rank evidence against requirements, create reviewable response drafts, support human approval/export, provide security/audit controls, enforce service limits, troubleshoot incidents, honour data-export/deletion requests and, only with consent, measure whether an outreach link led to product use.

Customer content and AI

Sefixa does not use workspace content to train its own models. Sefixa can operate with deterministic evidence-backed drafting and can also use a configured external drafting provider. If external AI drafting is enabled, content needed to draft a response may be sent to that configured provider. Provider-specific data-use/training commitments must be verified against the configured provider contract before confidential paid-pilot use; Sefixa does not extend its own “no training” statement into an unverified promise about third parties.

Named processors

These processors may process data outside India. Session cookies that keep you signed in are necessary for the service and are not used as advertising trackers. Optional outreach measurement runs only after consent.

Retention

Sefixa retains personal data only as long as needed for the purpose collected, then erases it unless a longer period is required to meet a legal obligation, investigate abuse or resolve a dispute.

• Account and workspace membership: while the account is active; removed when the workspace is deleted or a verified erasure request is completed.
• Workspace documents and responses: until the owner deletes them, a configured project-retention period expires, or a verified erasure request is completed.
• Audit history: the period set by the workspace owner, default 365 days (minimum 30, maximum 3650).
• Encrypted backups: 30 days.
• Security and access logs: up to one year, as required by the DPDP Rules, 2025.
• Consented outreach measurement: up to 12 months after the campaign event, then erased.

Workspace owners can configure retention controls, export structured workspace data and delete projects/evidence. Whole-workspace deletion is support-led. The deletion procedure distinguishes application data, private object storage and authentication identity removal; Sefixa does not report a deletion complete until the requested scope is verified.

Your rights

You may exercise these rights by emailing hello@sefixa.com. Sefixa will respond to grievances within 90 days.

• Access: a summary of the personal data Sefixa holds about you and the processing activities that use it.
• Correction: correction of inaccurate or incomplete personal data, including completing incomplete data.
• Erasure: erasure of personal data that is no longer needed for the specified purpose, unless retention is required by law or for a pending dispute or security investigation.
• Withdraw consent: for optional measurement, open Cookie/Tracking settings to reopen the same consent prompt and withdraw as easily as you agreed. Withdrawal stops measurement and clears stored tracking identifiers. You can also email hello@sefixa.com. Withdrawal does not affect processing already completed. If consent is required to operate the account, withdrawal of that account consent will close the account.
• Nominate: nominate another individual to exercise your rights in the event of your death or incapacity. Send the nominee’s name and email to hello@sefixa.com.
• Grievance: raise a privacy grievance with Puneet Naliath at hello@sefixa.com.
• Complain to the Data Protection Board of India: if your grievance is not resolved, you may complain to the Data Protection Board of India under the DPDP Act, 2023.

Children’s data

Sefixa is a business workspace for persons aged 18 years or older. Sefixa does not knowingly process personal data of children and does not track, target or advertise to children. If we learn that a child’s personal data was provided, we will erase it.

Personal data breach notice

If a personal data breach occurs, Puneet Naliath will intimate each affected Data Principal without delay through the registered email or user account, describing the nature, extent and timing of the breach, likely consequences, mitigation measures, steps you can take, and this contact. The Data Protection Board of India will be informed without delay, with a detailed report within 72 hours of becoming aware of the breach, as required by the DPDP Rules, 2025.

Cookie/Tracking settings

Optional first-party measurement stays off until you allow it. Use Cookie/Tracking settings at any time to allow or withdraw that consent. Emailing hello@sefixa.com remains an alternative.

Cookie/Tracking settings

Your requests

Send access, correction, export, erasure, withdrawal of consent, nomination, grievance and other privacy requests to hello@sefixa.com. Include the workspace ID and requested scope, but do not email document contents, passwords, authentication tokens or service credentials.