Privacy Policy

1. Who We Are

Data Fiduciary: Decipher Consultancy Services
Registered Address: 295, Block C, Sushant Lok III, Sector 57, Gurugram, Haryana – 122003, India
Platform: Fluxeta — fluxeta.com
Contact: [email protected]

We operate Fluxeta, an AI-native publishing platform for creators and businesses. "You" or "Data Principal" refers to any individual whose personal data we process, including visitors, registered users, newsletter subscribers, and members of sites hosted on Fluxeta.

2. Data We Collect

We collect personal data that you provide directly and data generated through your use of the platform.

2.1 Account & Profile Data

2.2 Payment Data

Subscription and membership payments are processed by Razorpay. We store only the Razorpay customer ID, subscription ID, and payment status. We do not store card numbers or bank account details.

2.3 Content Data

Posts, pages, newsletters, and media you publish on the platform. If you use AI writing tools, the text you submit is processed by our AI sub-processors (see Section 5).

2.4 Usage & Analytics Data

2.5 Communications

If you contact us via email or our support form, we retain the content of that communication to respond to your query.

3. How We Use Your Data

• Providing the service — account management, hosting your sites, sending newsletters on your behalf, processing payments.
• AI writing features — your content is sent to AI sub-processors to generate suggestions. See Section 5.
• Analytics — aggregated, anonymised traffic data shown in your dashboard.
• Communications — transactional emails (password reset, subscription receipts), and — only with your consent — product updates and marketing.
• Security & fraud prevention — detecting abuse, rate-limiting, and maintaining platform integrity.
• Legal compliance — responding to lawful requests from Indian authorities under applicable law.

We do not sell your personal data to third parties.

4. Legal Basis (DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023, we rely on the following bases:

5. Data Processors & Third Parties

We engage the following Data Processors under written contracts that require them to protect your data:

We do not share your data with advertisers or data brokers. Third-party links on creator-published content are outside our control.

6. Your Rights as a Data Principal

Under Sections 11–14 of the DPDP Act, 2023, you have the following rights:

6.1 Right to Access (Section 11)

You have the right to obtain a summary of your personal data being processed and the processing activities. Submit a request to [email protected] and we will respond within 30 days.

6.2 Right to Correction & Erasure (Section 12)

You have the right to correction of inaccurate or incomplete personal data, and the right to erasure of personal data that is no longer necessary or that you withdraw consent for. To exercise this right to correction or right to erasure, email [email protected] or use the account deletion feature in Settings.

6.3 Right to Grievance Redressal (Section 13)

You have the right to readily available means of grievance redressal. Contact our Grievance Officer (see Section 11). We will acknowledge your complaint within 48 hours and resolve it within 30 days.

6.4 Right to Nominate (Section 14)

You may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity. Nominations can be submitted to our Grievance Officer.

Exercising Your Rights

To exercise any of the above rights, email [email protected] with the subject line "Data Principal Rights Request". We may need to verify your identity before processing the request.

7. Children's Privacy

Fluxeta is not intended for persons under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at [email protected] and we will delete the data.

Under the DPDP Act, processing of children's data requires verifiable parental consent. We do not offer services targeted at children.

8. Data Retention

When retention periods expire, data is securely deleted or anonymised.

9. Security

We implement reasonable security measures to protect your personal data, including:

• Encryption of data in transit (TLS 1.2+)
• Encryption of sensitive data at rest (AES-256)
• Bcrypt password hashing
• Role-based access controls limiting internal access
• Regular dependency updates and security patches

No system is 100% secure. In the event of a personal data breach that poses a risk to your rights, we will notify you and the appropriate authority as required under the DPDP Act.

10. Cross-Border Transfers

Some of our sub-processors (Anthropic, Mailgun, Cloudflare) are located outside India. Where personal data is transferred outside India, we ensure that the recipient country or organisation provides a level of protection comparable to the DPDP Act, through contractual safeguards or the Data Protection Board's approved frameworks.

11. Grievance Officer

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India once it is constituted under the DPDP Act, 2023.

12. Additional Rights for EU / UK Residents (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and comparable local laws apply to our processing of your personal data. In addition to the rights already described above under the DPDP Act, you have the following rights:

• Right of access (GDPR Art. 15) — a copy of the personal data we hold about you
• Right to rectification (Art. 16) — correction of inaccurate data
• Right to erasure / "right to be forgotten" (Art. 17)
• Right to restrict processing (Art. 18)
• Right to data portability (Art. 20) — a copy in a structured, machine-readable format
• Right to object to processing based on legitimate interests (Art. 21)
• Right not to be subject to automated decision-making that produces legal effects (Art. 22)
• Right to lodge a complaint with your national supervisory authority

Lawful basis for processing

Our lawful bases under GDPR Art. 6 for the categories of processing in this policy:

International transfers

Our platform is hosted in India. Some sub-processors (see our Sub-processors page) are located in the USA. Where such transfers involve personal data from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, for the UK, the UK International Data Transfer Addendum. Copies are available on written request.

How to exercise these rights

Email [email protected] with the subject "GDPR Data Request" and the specific right you wish to exercise. We will acknowledge within 5 business days and respond substantively within 30 days (extendable to 90 days for complex requests, with notice). We do not charge a fee unless requests are manifestly unfounded or excessive.

Our EU representative pursuant to GDPR Art. 27 is not currently appointed as we do not systematically monitor EU residents. If you are located in the EEA and require a local point of contact, please email us and we will connect you with our designated representative.

13. Additional Rights for California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) provides you with additional rights regarding your personal information.

Categories of personal information collected

In the last 12 months, we have collected the following CCPA-defined categories:

• Identifiers — name, email, IP address
• Commercial information — subscription plan, billing history
• Internet activity — page views, clicks, session data (with consent for non-essential)
• Geolocation data — coarse (country-level) from IP
• Inferences — product-usage patterns for service improvement

We do not collect sensitive personal information (SSN, government ID, financial account credentials, precise geolocation, biometric data) beyond what is strictly required to provide the Services.

Sale or sharing of personal information

We do not sell personal information for money. Depending on your cookie preferences, some marketing pixels may constitute "sharing" for cross-context behavioural advertising under CPRA. You can opt out at any time — see our Do Not Sell or Share My Personal Information page.

Your California rights

• Right to know what we collect, use, disclose, and share
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing (see link above)
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising these rights

To exercise, email [email protected]. We verify identity via the email on your account plus one additional data point before releasing information.

We respect Global Privacy Control (GPC) browser signals as valid opt-out requests.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address registered with your account) and by displaying a notice on the platform at least 7 days before the changes take effect. Your continued use of Fluxeta after the effective date constitutes acceptance of the revised policy.

The "Last updated" date at the top of this page reflects the most recent revision.