← Return to Tark War Room TARK STATUTORY COMPLIANCE SUITE
STATUTORY CHARTER // TARK-LEGAL-PP-2026-V2.4

Privacy Policy & Data Governance Charter

Effective: October 14, 2026 · Jurisdiction: Republic of India · DPDP Act, 2023 & IT Act Section 43A Compliant

1. Preamble & Sovereign Data Covenant

This Privacy Policy and Data Governance Charter governs the collection, processing, cryptographic storage, telemetry aggregation, and erasure of Personal Data and Usage Telemetry by Tark (https://www.tark.live). Under the Digital Personal Data Protection Act, 2023 (DPDP Act), Tark acts as a Data Fiduciary and you act as a Data Principal.

The Tark Zero-Ad & Zero-Brokerage Mandate:
  • We do not serve third-party ads, behavioural retargeting pixels, affiliate links, or sponsored commercial content.
  • We never sell, rent, license, syndicate, or trade your Personal Data, test performance records, or psychometric telemetry to coaching institutes, marketing agencies, or data brokers.

2. Lawful Purpose & Data Retention Matrix

In adherence to the statutory principle of Data Minimization, we collect strictly what is necessary to grade tests on the server, preserve your longitudinal record, and verify lifetime seat ownership:

Data Category Specific Data Elements Lawful Basis & Purpose Retention Period
A. Unauthenticated Diagnostic Ephemeral option clicks (a, b, c, d), timer ticks, landing page diagnostic payload. User-initiated +2.00 / −0.66 evaluation without requiring mandatory registration. Purged on session close
B. Identity & Auth Email address, chosen handle (Leaderboard), OAuth session JWTs. Explicit Consent (Sec. 6, DPDP Act) for account synchronization and seat binding. Active account + 30 days
C. Psychometric Telemetry Attempt history, +2.00 / −0.66 logs, 50:50 risk ratios, subject accuracy matrices, vulnerability tags. Contractual performance: powering the 4-stage loop (Practice → Diagnose → Review → Improve). Account lifetime; erasable on demand
D. Financial Metadata Razorpay order_id, payment_id, verification signature, lifetime seat index (1–500). Statutory tax & audit compliance (Income Tax Act, 1961 and GST rules). 8 years (Statutory)
E. Security Logs Truncated IP, TLS handshake metadata, User-Agent, rate-limit counters. Scraping prevention, DDoS defense, server-side grading integrity. Rolling 90-day window

* Payment instrument exclusion: All transactions are processed exclusively via Razorpay Software Pvt. Ltd. (PCI-DSS Level 1 certified). Tark never stores or views raw credit/debit card numbers or UPI PINs.

3. Sub-Processors & Technical Safeguards

Tark engages enterprise infrastructure providers: Supabase Inc. (encrypted PostgreSQL with Row Level Security), Vercel Inc. (global edge delivery & TLS 1.3 termination), and Razorpay Software Pvt. Ltd. (RBI-regulated payment gateway). All data at rest is encrypted via AES-256; data in transit is protected via TLS 1.3.

4. Rights of the Data Principal (DPDP Act, 2023)

Under Sections 11–14 of the DPDP Act, you retain enforceable rights: Right to Access Information, Right to Correction & Erasure (72-hour complete purge upon request), Right to Withdraw Consent, and Right to Grievance Redressal.

5. Grievance Officer & Contact Information

Pursuant to Rule 5(9) of the IT (SPDI) Rules, 2011 and Section 13 of the DPDP Act, 2023: