Privacy Policy

1. Introduction

Kaptanz Space Private Limited ("we", "us", "our"), operating WorkRight at workright.in, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our POSH compliance platform.

2. Information We Collect

We collect the following categories of information:

• Account Information: Company name, admin name, email address, phone number, industry, and password (stored as a hashed value)
• Employee Information: Names, email addresses, employee IDs, departments, and designations as entered by your company administrator
• Training Data: Training progress, quiz responses, scores, and certificate records
• Complaint Data: Complaint details, respondent information, incident descriptions, ICC inquiry records, and related documents as filed through the Platform
• Payment Information: Transaction records processed through Razorpay. We do not store credit card numbers or bank account details directly.
• Usage Data: Login timestamps, pages visited, and feature usage for improving the Platform

3. How We Use Your Information

• To provide and maintain the Platform's services
• To generate training certificates and compliance reports
• To process payments and manage subscriptions
• To send service-related notifications (training reminders, compliance deadlines)
• To improve the Platform based on usage patterns
• To comply with legal obligations

4. Complaint Data — Special Protections

Complaint data is treated with the highest level of confidentiality in accordance with Section 16 of the POSH Act 2013. Specifically:

• Complaint details are accessible only to ICC members and company administrators designated in the Platform
• Complainant and respondent identities are never shared with unauthorized parties
• All complaint data is encrypted at rest and in transit
• We do not access complaint contents unless required for technical support with explicit authorization from your organization
• Complaint data is retained as per legal requirements even after account cancellation

5. Data Storage & Security

• Hosting: Data is hosted on secure cloud infrastructure
• Encryption: All data is encrypted in transit (TLS 1.3) and at rest
• Access Control: Role-based access ensures employees only see their own data; ICC members see only assigned complaints
• Passwords: Stored using bcrypt hashing — we never store plain-text passwords
• Backups: Regular automated backups with encryption

6. Data Sharing

We do not sell, rent, or share your personal information with third parties except:

• Payment processing: Razorpay processes payment transactions under their own privacy policy
• Legal requirements: If required by law, court order, or government authority
• Service providers: Cloud infrastructure and email services that process data on our behalf under strict confidentiality agreements

7. Data Retention

• Active accounts: Data is retained for the duration of the subscription
• Cancelled accounts: Account data is deleted within 90 days of cancellation, except where retention is required by law
• Certificates: Remain valid and accessible even after account cancellation
• Complaint records: Retained as per POSH Act requirements (recommended minimum 3 years after resolution)
• Payment records: Retained for 7 years as required under Indian tax laws

8. Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Export: Download your data in a standard format
• Withdraw consent: Opt out of non-essential communications

To exercise these rights, contact us at privacy@workright.in.

9. Cookies

We use essential cookies for authentication (JWT tokens stored in localStorage) and session management. We do not use third-party tracking cookies or advertising cookies. Analytics data is collected in aggregate without personal identifiers.

10. Children's Privacy

WorkRight is designed for use by adults in a workplace context. We do not knowingly collect information from individuals under 18 years of age.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email and update the "Last updated" date above.

12. Contact Us

For privacy-related inquiries or to exercise your data rights, contact us at: