ComfHutt Technologies Private Limited ("ComfHutt", "we") is the Data Fiduciary for personal data processed through CRUX. This notice tells you, in plain language, what we collect, why, what we do with it, and what you can require of us.
1. What we collect, and why
| What | Why we process it | Our basis |
|---|---|---|
| Name, email address, phone number (if given) | To create and operate your account, authenticate you, and contact you about the service | Your consent, given when you create an account |
| Projects you grade, search, save or watch | To deliver the grade you asked for, show your history, and operate saved lists | Your consent |
| Questions you ask our AI assistant | To answer them, and to diagnose and improve the assistant | Your consent |
| A quoted price you enter for a project | To compare it against comparable declared rates in that report | Your consent |
| Payment details | Processed by our payment gateway, not by us. We store only a transaction reference, the amount, and the plan purchased | Performance of your purchase |
| Device, browser, IP address, pages viewed | Security, fraud and abuse prevention, and aggregate usage measurement | Our legitimate use in operating a secure service, as permitted under the Act |
| Documents and statements you send us in a dispute | To review and decide the dispute | Your consent |
We do not sell your personal data. We do not share it with developers, builders, brokers or listing platforms. No third party pays us for access to it.
2. What we do not collect
We do not ask for and do not want your Aadhaar number, PAN, bank account details, income details, or copies of your identity documents. Do not send them to us. If you send them in a dispute submission, we will delete them and tell you we have.
5. Where data is stored, and for how long
We store personal data on servers located in India wherever the service supports it, and otherwise with reputable providers subject to contractual protections. Some processing may occur outside India; we will not transfer personal data to any territory restricted by the Central Government.
We keep personal data only as long as the purpose requires:
- Account data: while your account is open, and for up to 12 months after you close it, to handle disputes and meet legal obligations.
- Grading history and reports: while your account is open. Purchased reports are retained for 3 years so you can retrieve what you paid for.
- Dispute records: 3 years from the decision.
- Security and access logs: at least 1 year, as required under the DPDP Rules.
We will notify you at least 48 hours before we erase data under a retention rule.
6. Your rights
Under the Digital Personal Data Protection Act, 2023 you may:
- Access — obtain a summary of the personal data we hold about you and how we process it;
- Correct — have inaccurate or incomplete data corrected, completed or updated;
- Erase — have your personal data erased where the purpose no longer requires it and no law requires us to keep it;
- Nominate — nominate another person to exercise your rights in the event of your death or incapacity;
- Grieve — have a complaint heard by us, and escalate it to the Data Protection Board of India if you are not satisfied;
- Withdraw consent — at any time, as easily as you gave it. Withdrawal does not affect processing already carried out.
To exercise any of these, write to grievance@comfhutt.com from the email address on your account. We will respond within 90 days, and usually far sooner.
7. Your duties
The Act also places duties on you. Do not impersonate anyone, do not submit false particulars, and do not file a frivolous or false complaint. Provide only authentic information when exercising a right to correction.
8. Security
We use access controls, encryption in transit, restricted administrative access, logging and regular review. No system is perfectly secure, but we take these obligations seriously and design for the least data necessary.
9. If there is a breach
If a personal data breach affects you, we will notify you without delay and in any case within 72 hours of the reporting trigger, in plain language: what happened, what data was involved, what we are doing, and what you can do. We will also notify the Data Protection Board of India as required.
10. Children
CRUX is not for anyone under 18. We do not knowingly process a child's personal data, and we do not undertake behavioural tracking or targeted advertising directed at children. If you believe a child has given us personal data, tell our Grievance Officer and we will delete it.
11. Information about third parties
CRUX publishes analysis of businesses and projects based on public records, including records that name individuals in their business or professional capacity. That processing is of publicly available information and is separate from the personal data you give us as a user. If you believe information published about you is inaccurate or wrongly attributed, use our dispute and correction process.
12. Grievance Officer
Murtaza Patel · grievance@comfhutt.com · ComfHutt Technologies Private Limited, 301, Babji Hieghts, Beside Gayatri Dairy, Krushnanagar Main Road, Near Gandhi Society, Madhapar Circle, Rajkot, Gujarat 360006
If we do not resolve your complaint to your satisfaction, you may complain to the Data Protection Board of India.
13. Changes
We will post any updated policy here with a new date, and give notice where changes are material.