Privacy Policy

This Privacy Policy constitutes an official statutory notice under Section 5 of the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) and the DPDP Rules, 2025. It governs the collection, processing, storage, and protection of digital personal data when you access or use gizcalc.in (the "Platform"), operated by Gizcalc India ("we", "us", or "our"), functioning as a Data Fiduciary under Indian law.

By accessing the Platform, creating an account, or communicating with us, you acknowledge that you have read, understood, and agreed to the data practices described herein. If you do not agree with this Policy, please refrain from using the Platform or exercising account features.

1. Identity & Contact Details of the Data Fiduciary

Pursuant to Section 5(1)(ii) of the DPDP Act 2023, the details of the Data Fiduciary are as follows:

• Data Fiduciary Name: Gizcalc India
• Operating Mode: Digital & Electronic Platform (Republic of India)
• Designated Data Protection & Grievance Officer: GizCalc
• Statutory Redressal Email: gizcalc@gmail.com
• General Communications Email: gizcalc@gmail.com

2. Lawful Grounds for Processing Personal Data

Under Section 4 and Section 6 of the DPDP Act 2023, Gizcalc processes digital personal data solely on the basis of:

• Informed Consent (Section 6): Where you have signified agreement through a clear, affirmative action that is free, specific, informed, unconditional, and unambiguous.
• Certain Legitimate Uses (Section 7): Solely for responding to voluntary communications, preventing fraud, defending system security against distributed denial-of-service (DDoS) attacks, or complying with lawful orders issued by Indian courts or regulatory bodies.

3. Categories of Personal Data Collected

3.1 Personal Data You Provide Directly

• Account Credentials: When you register on Gizcalc, we collect your full legal name, email address, and a cryptographically salted and hashed representation of your password using modern algorithms (`bcrypt`). We never possess or store your password in plaintext.
• Direct Inquiries & Grievances: When you submit a message via the Contact Form, Grievance Form, or Data Rights intake, we collect your name, email address, contact phone (optional), subject matter, and message content to investigate and redress your claim.

3.2 Complete Client-Side Isolation for Calculator Inputs

Crucial Statutory Transparency: When you use any of our 750+ calculators (such as entering monthly income, loan tenure, EMI values, body weight, or investment goals), these values are processed entirely client-side inside your browser runtime. They are NOT transmitted across the internet to our servers and are NOT saved in any remote database, unless you are actively logged in to a registered Gizcalc account and explicitly choose to click "Save to History". If you are an unregistered visitor, your financial and personal calculation parameters are mathematically invisible to our servers.

3.3 Automatically Collected Telemetry & System Logs

To preserve platform availability, detect malicious intrusion, and optimize caching, our web servers automatically log non-identifying technical variables:

• Network & Device Identifiers: Operating system type, browser user-agent, device category (desktop, tablet, mobile), screen resolution, and language settings.
• Pseudonymized IP Telemetry: IP addresses are collected strictly for rate-limiting, brute-force mitigation, and coarse geographic telemetry (country/state level). IP addresses are never cross-referenced to identify individual users by name.
• Navigation Analytics: Aggregated page hit counters, calculator usage frequencies, and session latency.

4. Purpose Limitation & Data Minimization (Section 8)

In accordance with Section 8(4) of the DPDP Act 2023, personal data is processed strictly for specified, lawful purposes:

• To furnish, maintain, and optimize our 750+ free calculation engines.
• To enable registered users to save, organize, and export calculation scenarios.
• To investigate and respond to user feedback, bug reports, and statutory DPDP requests.
• To protect the Platform from automated bot abuse, credential stuffing, and unauthorized scraping.
• To serve non-intrusive contextual advertising in compliance with Google AdSense terms.

Explicit Non-Sale Commitment: Gizcalc never sells, rents, trades, or licenses your personal data to commercial third parties, lenders, NBFCs, credit bureaus, or marketing aggregators.

5. Protection of Personal Data of Children & Minors (Section 9)

Gizcalc enforces stringent safeguards under Section 9 of the DPDP Act 2023:

• The Platform is designed for general audiences and does not knowingly solicit or collect personal data from individuals under 18 years of age without verifiable parental or lawful guardian consent.
• We strictly do not engage in behavioral tracking, targeted psychological profiling, or behavioral advertising directed at minors.
• If we discover that personal data of a minor has been registered without appropriate parental authorization, we will permanently purge such records from our databases within 48 hours.

6. Retention & Permanent Erasure Schedule (Section 8(7) & Section 12)

Under Section 8(7) of the DPDP Act 2023, personal data must be erased as soon as the purpose for which it was collected is no longer served:

• Registered Account Data: Retained until the user requests account deletion under Section 12(1)(c). Upon receiving a valid erasure request, all user credentials, history records, and profile tokens are permanently expunged across active database clusters within 30 days.
• Contact & Support Inquiries: Retained for a maximum of 180 days following full resolution, after which records are automatically destroyed.
• Statutory Grievance Records: Retained for 1 year to satisfy regulatory audit requirements of the Data Protection Board of India (DPBI), after which they are irreversibly anonymized.

7. Technical & Organizational Security Safeguards (Section 8(5))

Pursuant to Section 8(5) of the Act, Gizcalc deploys robust technical defenses to prevent personal data breaches:

• End-to-End Encryption in Transit: Mandatory HTTPS enforced via TLS 1.3 encryption across all platform endpoints with strict HTTP Strict Transport Security (HSTS) headers.
• Cryptographic Password Protection: One-way password hashing using industry-standard modern bcrypt with automated salting.
• Anti-Bot & CSRF Protections: Cryptographic Cross-Site Request Forgery (CSRF) tokens on all form submissions, timing traps, and Cloudflare Turnstile CAPTCHA.
• Least-Privilege Database Access: Production database clusters are isolated, protected behind enterprise firewalls, and accessible exclusively to vetted core engineering personnel.

8. Statutory Rights of the Data Principal (Chapter III, Sections 11–14)

As a Data Principal under Indian law, you are endowed with legally enforceable rights:

• Right to Access Information (Section 11): Right to obtain a concise summary of personal data being processed, processing activities, and identities of Data Processors.
• Right to Correction & Updating (Section 12(1)(a)): Right to rectify inaccurate, misleading, or outdated personal data.
• Right to Permanent Erasure / Deletion (Section 12(1)(c)): Right to demand complete erasure of your account and personal records.
• Right to Nominate (Section 14): Right to designate a representative who shall exercise your rights in the event of demise or incapacity.
• Right to Withdraw Consent (Section 6(4)): Right to withdraw consent as easily as giving it, without retroactive penalty.
• Right of Grievance Redressal (Section 13): Right to seek prompt grievance resolution from our designated Grievance Officer within 30 calendar days.

To exercise any of these statutory rights, use our self-service controls in your Account Dashboard, submit a formal request via the Data Rights Portal, or email our Grievance Officer directly at gizcalc@gmail.com.

9. Grievance Officer & Escalation to Data Protection Board of India (DPBI)

If you have any complaints regarding data processing, security safeguards, or rights fulfillment, please contact:

Under Section 13(3) of the DPDP Act 2023, if our Grievance Officer fails to resolve your complaint within 30 days, or if you are unsatisfied with the resolution, you have the statutory right to escalate your complaint directly to the Data Protection Board of India (DPBI) via its official regulatory portal at dpbi.gov.in.

10. Hindi Statutory Summary (डीपीडीपी अधिनियम, 2023 की धारा 5(3) के तहत सारांश)

11. Revisions & Updates

Gizcalc reviews this Privacy Policy periodically to maintain compliance with notifications issued by the Ministry of Electronics and Information Technology (MeitY) and regulatory orders of the DPBI. Material changes will be highlighted with a revised effective date on this page.