Privacy Policy

1. Who we are

CircularHub is operated as an independent service for educational institutions in India. This policy explains what data we collect, why, and how we handle it. It is aligned with India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Scope: this policy covers your data. Document accuracy and authenticity are covered separately — circulars on this service are uploaded as-is and you must cross-check them against the original issuing authority before relying on them. See our Disclaimer and Terms.

2. Data we collect

When you create an account, we collect:

• Institution name, type, district, state, board, and an optional institution code (UDISE / AISHE)
• Login email address and (hashed) password
• An optional contact phone number

When you fill out your settings, we additionally collect:

• Principal's name (optional)
• Public institutional email, address, website, year established (optional)
• Institution logo (optional)

When you pay a subscription, we collect:

• The UTR (UPI Reference Number) you submit
• Amount and timestamp of the claim

When you use the service, we automatically log:

• Your IP address (for rate limiting and abuse prevention)
• Page requests sufficient to operate the service

3. How we use it

• To provide the service: authentication, content delivery, payment confirmation
• To address you correctly (greetings, payment receipts)
• To send transactional emails: welcome message, payment confirmation, password reset codes
• To prevent abuse and maintain service integrity

We do not use your data for advertising, do not sell it, and do not share it with third-party marketers.

4. Sub-processors

We rely on these third parties strictly to operate the service:

• Resend (resend.com) — sends transactional emails. The email address you register and the email content are transmitted to Resend for delivery.

We do not use Google Analytics, Facebook tracking pixels, or any third-party analytics or advertising service. We do not embed third-party scripts that send your data elsewhere.

5. Cookies

We set one strictly-necessary cookie:

• circularhub_session — keeps you logged in. HTTP-only, SameSite=Lax, Secure in production. Expires in 30 days.

We may also set a small view_statecookie when you toggle “Browse Karnataka” on the circulars page. No third-party cookies. No advertising cookies.

6. Data retention

Account and subscription data are kept while your account exists and for up to 12 months after account closure for accounting and legal compliance. Server access logs are retained for up to 90 days. Email delivery logs are retained by Resend per their policy.

7. Your rights under DPDP

You have the right to:

• Access and review the data we hold about your institution
• Correct inaccurate data
• Withdraw consent and request deletion (this closes your account)
• Lodge a grievance with us, or escalate to the Data Protection Board of India

To exercise any of these rights, email hello@circularhub.in from the email address registered on your account. We will respond within 30 days.

8. Public trust strip (opt-in)

By default, your institution's logo is private to your account and to administrators. If you explicitly opt in via your settings page, your institution's logo (without the principal's name or contact information) will appear on our public homepage in the “Trusted by” section. You can opt out at any time by unchecking the box in settings; the logo is removed on the next page render.

9. Security

Passwords are hashed with bcrypt. Sessions use HTTP-only cookies. The site is served over HTTPS with HSTS in production. Backups of the database are encrypted at rest if your hosting environment provides it. We do our best, but no system is perfectly secure; please use a strong password and keep it private.

10. Changes

We may update this policy. Material changes will be communicated to active subscribers by email and will require fresh consent if substantive.

11. Contact

For privacy questions or DPDP requests: hello@circularhub.in