Privacy Policy
Learn how Thriving Billions Private Limited (“Dehurdle”, “we”, “us”) protects your personal information, voice recordings, and conversation transcriptions in alignment with GDPR, DPDPA, and CCPA standards.
1. Introduction
Thriving Billions Private Limited, operating as Dehurdle (“Dehurdle”, “we”, “us”, or “our”), is dedicated to defending your data privacy. This Privacy Policy details how we collect, process, share, and protect your information when you interact with our landing site, web applications, and live voice coaching simulation platforms (collectively, the “Services”).
We function as a Data Fiduciary (under the Indian Digital Personal Data Protection Act, 2023 - DPDPA). Under the EU General Data Protection Regulation (GDPR), when you use our Services as an employee or provisioned user of a subscribing organization, that organization acts as the Data Controller, and Dehurdle acts as a Data Processor processing personal data on their behalf. For direct individual registration or marketing interactions, Dehurdle acts as a Data Controller. By utilizing our Services, you consent to the processing of your personal data according to these parameters.
Critical: Zero Voice Retention & EU AI Act Compliance
Dehurdle prioritizes absolute biometric security. Audio streams recorded during live voice simulations are sent to our servers in-memory via WebSocket connections strictly for real-time speech-to-text conversion and objective vocal metrics analysis (words per minute, pause timing, filler word counts, and acoustic volume dynamics).
We DO NOT store or persist raw audio files of your voice. All audio streams are discarded immediately upon session completion. Conversational dialogue is saved solely as redacted text transcripts.
EU AI Act Article 5(1)(f) Non-Inference Warranty: Dehurdle vocal analysis measures purely objective communication delivery metrics for self-directed skill practice. Dehurdle does NOT conduct emotion recognition, stress detection, psychological profiling, or emotional state inference on employees or learners. Under strict enterprise terms, customer transcripts and simulation data are NEVER used to train foundational AI models.
2. Information We Collect
We collect and process the following categories of personal information:
- Account Identifiers: Name, professional email address, organization name, account role credentials, and WorkOS authentication profile tokens.
- Simulation Metadata & Scores: Structured script outputs, metrics scores (Objection Handling, Value Articulation, Needs Discovery), speaking pace (Words Per Minute), pause lengths, and transcript histories.
- Knowledge Uploads: Internal playbooks, product pamphlets, or sales guides uploaded by organization administrators to customize AI persona scenarios.
- Technical Logs: IP address, device specs, browser versions, session request identifiers (Correlation IDs), and ping/pong latency responses.
3. Lawful Basis for Processing (GDPR & DPDPA)
We process your data under the following legitimate criteria:
- Performance of Contract: To set up user accounts, validate subscription seats, track remaining minute packages, and render live simulated scoring results.
- Consent (DPDPA Section 6): Specifically requested when you authorize microphone access in your browser to run live call scenarios. You may revoke consent at any time.
- Legitimate Interests: To run analytics audits, verify security boundaries, manage rate limits, prevent system abuse, and optimize AI responsiveness thresholds.
4. Data Sharing & Third-Party Disclosure
We do not sell, rent, or trade personal data to third parties. We disclose data solely to vendor entities involved in hosting our platform services (listed in our Subprocessors Page) and strictly under matching Data Processing Addendums (DPAs).
When a workspace account is provisioned by an employer, organization administrators have access to dashboard competency reports, average scores, and session completion records associated with that seat.
5. Data Residency & Cross-Border Transfers
For organizations subscribed to our Scale plan, we provide localized regional hosting domains to satisfy international parameters:
- EU Clients: Persistent database layers and servers are fully hosted inside Frankfurt (AWS eu-central-1). No customer data migrates outside the European Economic Area (EEA).
- Indian Clients: Data residency matches local parameters, hosted inside Mumbai (AWS ap-south-1).
- US/Global Clients: Hosted within Northern Virginia (AWS us-east-1).
6. Your Rights (GDPR & DPDPA)
Depending on your geographic location, you possess the following entitlements regarding your data:
- Right to access summary of processed data
- Right to correction and complete deletion
- Right to nominate another person in event of death/incapacity
- Right to grievance redressal
- Right to access, copy, or port your data
- Right to object to or restrict processing
- Right to erasure (“Right to be Forgotten”)
- Right to lodge a complaint with a Supervisory Authority
7. Data Retention & Deletion
We retain account parameters and transcript logs only for as long as your organization subscription remains active. If you delete your account, or if your organization cancels its license, we will permanently delete or anonymize all associated personal data within 30 days, unless a legal constraint mandates retention.
8. Incident Response & 72-Hour Breach Notification
In alignment with the Indian DPDPA rules (2025–2026) and GDPR Article 33, Dehurdle maintains an automated incident management and response protocol. In the unlikely event of a confirmed security incident impacting customer personal data, Dehurdle will notify affected Data Controllers/Data Principals and statutory regulatory authorities within 72 hours of confirmation, detailing the scope, mitigation steps, and protective remedies.
Data Protection Officer
For inquiries, access requests, or to register a grievance under GDPR/DPDPA, contact our Data Protection Team.