Privacy Policy

1. Who we are

Dehurdle is run by Thriving Billions Private Limited (“Dehurdle”, “we”, “us”), a private limited company registered in India (CIN U80301HR2022PTC100862). Our registered address is Flat 802, Tower C, Ireo Uptown, Sector 66, Gurugram, Haryana 122001, India.

This policy explains how we handle personal data when you use our website, the Dehurdle web app, the speech check, our WhatsApp and Slack features, and our apps for ChatGPT, Claude and HubSpot, and our Zoho CRM integration (together, the “Services”). Our Data Protection and Grievance Officer is Vishal Verma (reach@dehurdle.com).

2. Our role: controller or processor

Who decides how your data is used depends on how you use Dehurdle.

• Individual accounts (Free and Pro), website visitors, speech check users and people who fill in our forms: Dehurdle is the controller, called a “data fiduciary” under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”). This policy is our notice to you.
• Organization accounts (Team, Scale and Enterprise): your organization is the controller and Dehurdle is its processor. We use your data only on the organization's instructions, under our Data Processing Addendum. Your employer's own privacy notice explains why it uses Dehurdle and on what legal basis, and requests about your data go to your organization admin. This policy still describes what Dehurdle does with the data.

3. What we collect

Some of this applies only if you use a particular feature.

Account data

• Your name, email address, the organization you belong to, your preferred language, and your answers during onboarding, such as your role, industry, experience level and how you heard about us.
• Sign-in details. Sign-in, including your password or single sign-on, is handled by WorkOS. If your organization sets up directory sync, your account is created and updated from your organization's identity provider through WorkOS.
• Billing details for paid plans. At checkout we send Razorpay the payer's name and email address, pre-filled, with the organization and plan details. Card details go directly to Razorpay, not to us.
• Your phone number, if you choose to add one.

Practice data

• Audio:used for the live conversation and not stored after the session ends, except that if your organization allows practice calls longer than 10 minutes, Google keeps a call's live state, including its audio, for up to 24 hours to carry the call on. Speech check recordings and uploads (up to 25 MB) and WhatsApp voice notes are held in memory, sent to Google for analysis, and not stored.
• Transcripts: the text of each practice conversation, on the web or in a WhatsApp call. Before a transcript is saved, an automatic filter replaces email addresses, phone numbers, payment card numbers and some national ID numbers with “[REDACTED]”. It does not remove names or addresses. It isn't applied to audio or text while they are sent to Google during the live conversation. We also keep the raw spoken words from each session, without redaction, for voice analysis; they are deleted together with the transcript. Avoid sharing real personal details about yourself or others while you practice.
• Scores and feedback: scores, written feedback and your progress across sessions. Scores and feedback are produced by Google's Gemini models.
• Speaking metrics: pace in words per minute and pauses, measured from the timing of your words. Volume, pitch and voice steadiness aren't measured.
• Camera metrics (optional): the camera is off by default. It works only if your organization allows it and you turn it on. The analysis runs in your browser: no video or images leave your device, and nothing is recorded. Only these numbers are sent to us and stored with your scorecard: eye-contact ratio, seconds of direct gaze, head movement, number of rapid movements, nods, smile count, a facial expressiveness score (how much your face moves) and a composure score (how steady your head is). Some of them are also broken down by turn in the conversation.
• Coach chats: messages you exchange with the in-app AI coach. From October 10, 2026, the same automatic filter replaces email addresses, phone numbers, payment card numbers and some national ID numbers before a message is saved; messages saved before then are kept as written. Coach chats are deleted together with transcripts and written feedback after your organization's retention period, and when your organization is deleted.
• Documents you upload to create scenarios: playbooks, decks, notes or call recordings are sent to Google to build the scenario. They are held in memory, or in a temporary cache for up to an hour while a training track is built, and are not stored after that. The scenario that is generated from them is stored in your account.

WhatsApp, Slack and email

• WhatsApp (if you add your phone number): we use your number for WhatsApp practice and calls, reminders, scorecard summaries and sign-in codes, which expire after 5 minutes. Messages go through Meta's WhatsApp Cloud API. We don't store the content of WhatsApp messages. We keep short-lived conversation state for up to 30 days, linked to a hashed version of your phone number. Reply STOP to opt out.
• Slack (only if your organization connects it): we use your work email address to find your Slack account. We send you reminders and scorecard summaries as Slack direct messages, and in Slack you can browse the scenario catalog, see your recent scores and minute balance, and get AI coaching replies in a thread. Slack receives these messages.
• Email: emails from us are sent through Amazon SES in Mumbai, India.

ChatGPT and Claude (only if you connect them)

• Connecting: you can connect Dehurdle to an AI assistant such as ChatGPT (by OpenAI) or Claude (by Anthropic). You sign in to Dehurdle, choose one workspace and approve the connection. WorkOS handles the sign-in: to finish connecting, we send WorkOS your Dehurdle user ID, name and email address, and WorkOS then lets the assistant act for you in that workspace. We keep a record of the connection: the workspace, when you connected, when it was last used and when you disconnected. Your assistants use one workspace at a time; connecting again replaces the one you chose before.
• What the assistant sends us: the words it searches for and, when you ask it to build a scenario, a short description of the conversation you want to practice: your goal, the other person's role, the situation and likely objections. The assistant may write it from your chat or from other tools you have connected to it, such as a CRM or call recordings. We ask the assistant to describe roles, not people, and to leave out names and contact details. Before the description is used, the automatic filter used for transcripts replaces email addresses, phone numbers, payment card numbers and some national ID numbers. The description is then sent to Google to build the scenario and is not stored. The scenario built from it is saved in your practice library in the connected workspace.
• What we send the assistant: see section 5.

HubSpot (only if your company connects it)

• Connecting: a company's owner can connect the company's HubSpot account to Dehurdle, and sales reps then see a Dehurdle card on HubSpot deals. When a rep opens the card, HubSpot tells us their HubSpot email address and user ID; we use the email to match them to their Dehurdle account in that company and don't store either.
• What we read from HubSpot: when a rep asks the card to build a practice, we read that deal's name, stage, amount, expected close date, next step and description; the buyer company's name, industry, size and description; the job titles of the deal's contacts (not their names or contact details); and the deal's latest notes. Before this text is used, the automatic filter used for transcripts replaces email addresses, phone numbers, payment card numbers and some national ID numbers. It is then sent to Google to build the practice and is not stored. The practice is saved in the rep's library like any scenario they build. We keep the deal's ID, and its stage and amount when the practice was built, to compare practiced and unpracticed deals.
• What we write to HubSpot: after each scored practice of a deal, we update four fields on that deal (last practice date, last practice score, number of practices and a link to the last scorecard) and add a note to it with the scenario's title, the score, the rep's name and the scorecard link. Nothing is written for a company that shows its admins company-wide figures only.

Zoho CRM (only if your company connects it)

• Connecting: a company's owner, who must also be a Zoho CRM administrator, can connect the company's Zoho CRM organization to Dehurdle; this adds four Dehurdle fields to the company's deals. Sales reps then open a deal's “Practice on Dehurdle” button, which takes them to Dehurdle. The first time, each rep links their own Zoho login: we store that login's access encrypted, with their Zoho user ID so one Zoho login can only be linked to one Dehurdle account, and use it only to read the deals they open from Dehurdle, so Zoho decides which deals they can use.
• What we read from Zoho CRM: when a rep opens a deal's page on Dehurdle, we read the deal's name to show it to them. When they build a practice, we read the same deal details as for HubSpot: the deal; its account's name, industry, size and description; the job titles of its contacts (not their names or contact details); and its latest notes. The text is filtered, sent to Google to build the practice and not stored, exactly as for HubSpot, and we keep the same deal ID, stage and amount.
• What we write to Zoho CRM: after each scored practice of a deal, we use the company's connection to update the four Dehurdle fields on that deal (last practice date, last practice score, number of practices and a link to the last scorecard) and add a note with the scenario's title, the score, the rep's name and the scorecard link. Nothing is written for a company that shows its admins company-wide figures only.

Speech check, forms, logs and cookies

• Speech check (no account needed): your audio is held in memory, sent to Google for analysis, and not stored. We save the result: the transcript, with email addresses, phone numbers and payment card numbers replaced with “[REDACTED]”, and your scores and tips. Names and other details you say are not removed. The result isn't linked to an account. Anyone with the result link can open it and can delete it from the result page. It is deleted automatically 30 days after the check.
• Forms: when you request a demo or apply as a partner or for a job, we collect your name, email address, phone number, company and message.
• Feedback: when you send feedback from the app, we keep your message with your name, email address and phone number so we can follow up.
• Logs: our server logs and rate limiting use IP addresses. Actions by administrators are logged with their IP address.
• Country and currency: when you open the pricing or billing page, or check out, our server works out your country from your IP address to show prices in your currency. The lookup runs on our own server with a built-in table: your IP address isn't sent anywhere else or stored for this. This site includes IP2Location LITE data available from lite.ip2location.com.
• Cookies: we set marketing attribution cookies only if you accept analytics cookies. If you have accepted them by the time you sign up, the details they hold are sent with your sign-up so we know how you found us. See our Cookie Policy.

4. How we use your data and our lawful bases

Where Dehurdle is the controller, we rely on these lawful bases under the EU and UK GDPR:

• To provide the Services you ask for (your account, practice sessions, scoring and feedback, the coach, the speech check, and payments for paid plans): performance of our contract with you (Article 6(1)(b)).
• Optional features you turn on (camera metrics, WhatsApp, connecting ChatGPT or Claude, public sharing of scorecards) and attribution cookies: your consent (Article 6(1)(a)). You can withdraw it at any time by turning the feature off, disconnecting the assistant, replying STOP on WhatsApp or changing your cookie choice.
• To answer forms (demo requests, partner and job applications): steps you ask us to take before a contract (Article 6(1)(b)), or our legitimate interest in replying to you (Article 6(1)(f)).
• To keep the Services secure and prevent abuse (server logs, rate limiting, logs of administrator actions): our legitimate interests (Article 6(1)(f)).
• To meet our legal obligations: legal obligation (Article 6(1)(c)).

Under India's DPDP Act, we process your personal data with your consent, which you can withdraw at any time as easily as you gave it, or for a legitimate use the Act allows, such as data you give us voluntarily for a specific purpose. Withdrawing consent doesn't affect processing that happened before.

If you use Dehurdle through an organization, the organization decides why your data is used and on what legal basis. We process it only on the organization's instructions.

5. Who can see your data and who we share it with

• You.
• Your organization's admins, if you use an organization account. Depending on what your organization chooses, they see company-wide figures only, each member's progress and scores, or also session transcripts. The app shows you which applies.
• Authorized Dehurdle staff, when needed for support and security.
• Anyone with the link, if you share. If you turn on sharing, anyone with the link can open your scorecards, including your name and transcript. Speech check results, including the transcript, can be opened by anyone with the result link until they are deleted.
• The AI assistant you connect, if you connect one. When you use Dehurdle from ChatGPT or Claude, we send that assistant what it asks for in the workspace you connected: the scenarios in your library (titles, descriptions, objectives, and the AI character's name, role and traits), links to start a practice, your practice history (dates, scenario titles and scores) and your scorecards (scores by competency, written feedback, and short quotes from your conversation that the feedback refers to). Scorecards include only the parts your workspace shows you. We don't send your transcripts, audio, email address or phone number. OpenAI or Anthropic then handles this data under the terms of your account with them, or your employer's, and their privacy policy. Those terms decide whether it is used to train their models, how long it is kept and where it is processed; Dehurdle doesn't control that. They aren't our subprocessors: you choose to send them the data.
• People who can see the deal in your company's CRM (HubSpot or Zoho CRM), if your company connects one. Your score, the scorecard link and your name are added to deals you practiced, and anyone your company lets see those deals in its CRM can see them. The scorecard itself opens only for you and the admins your company's settings allow. The CRM is your company's own system, not our subprocessor.
• Our subprocessors, which process data for us to run the Services.

Our subprocessors

• Amazon Web Services: hosting, database, cache and email, in India (Mumbai).
• Google Cloud (Vertex AI and Speech-to-Text): the live AI conversation, transcription, scoring and the coach. Receives practice audio and transcripts, coach messages, speech check uploads and WhatsApp messages. USA (live voice), India (scoring and coach) and Google's global speech-to-text service.
• Meta Platforms (WhatsApp Cloud API): only if you use WhatsApp. WhatsApp practice, calls, reminders and sign-in codes. Receives your phone number and your WhatsApp messages and calls. Global, including the USA.
• WorkOS: sign-in, single sign-on and, for organizations that set it up, directory sync. Receives your name, email address and sign-in details. USA.
• Razorpay: payments. Receives the payer's name and email address and the organization and plan details; card details go directly to Razorpay. India.
• Slack: only if your organization connects Slack. Reminders and scorecard summaries by direct message, plus the scenario catalog, recent scores, minute balance and AI coaching replies in Slack. Receives those messages and your work email address. USA.

The full list is on our Subprocessors page. We give organization customers 30 days' notice before we add a new subprocessor.

Your controls for ChatGPT and Claude

• In a company workspace, members can connect an assistant only if the company's owner turns this on. It is off until they do. Practice you open from an assistant is saved in that workspace, and its admins see it as they see any other practice.
• You can disconnect at any time in Settings → Integrations → AI assistants. Your assistants lose access straight away. They also lose access if your company turns assistants off or you leave the workspace.
• Disconnecting doesn't delete what the assistant has already received. To delete that, use OpenAI's or Anthropic's own controls, such as deleting the chat.

We don't sell personal data. Apart from the people and companies listed above, we disclose personal data only when the law requires us to.

6. Where your data is stored and international transfers

• Our application servers, database, cache and email service run on Amazon Web Services in Mumbai, India (ap-south-1).
• Live voice conversations are processed by Google in the USA: through its us-central1 region (Iowa), or its US multi-region when Iowa has no capacity for a call.
• Scoring, the coach, the speech check and understanding of WhatsApp messages run on Google in Mumbai, India (asia-south1).
• Speech-to-text, used for the AI persona's speech and for voice messages to the coach, runs on Google Cloud's global endpoint, which isn't tied to one country.
• WorkOS and Slack process data in the USA, Meta globally including the USA, and Razorpay in India.
• If you connect ChatGPT or Claude, the data described in section 5 goes to OpenAI or Anthropic, which are based in the USA, and is processed where their terms say.

We don't offer hosting in the EU, the UK or the USA, and the data region setting on an organization doesn't change where its data is stored.

If you are in the EU or UK, your personal data is therefore transferred to India and, for live voice, to the USA. India has no adequacy decision from the European Commission, so these transfers rely on the EU Standard Contractual Clauses (Commission Decision 2021/914): Module 2 between an organization customer and Dehurdle, and Module 3 for onward transfers to our subprocessors, with the UK Addendum for UK data. Our subprocessors have their own terms based on the Standard Contractual Clauses. We give customers the information they need for their transfer impact assessments. The terms are in our Data Processing Addendum. Data that you send to an AI assistant you connect is transferred at your request under that provider's terms, not under our Standard Contractual Clauses.

7. How long we keep data

• Audio: not stored after the session ends. If your organization allows practice calls longer than 10 minutes, Google keeps a call's live state, including its audio, for up to 24 hours after the call.
• Transcripts, feedback and coach chats: each organization has a retention period in days. The default is 365 days; Dehurdle sets a different period, of at least 1 day, when the organization asks. Individual accounts use the default. Every day, an automatic job deletes transcripts (including the raw spoken words kept for voice analysis), coach chats and written feedback that are older than the retention period. Scores and summary metrics are kept so you can track your progress.
• WhatsApp: conversation state is kept for up to 30 days. Sign-in codes expire after 5 minutes.
• Speech check results: deleted automatically 30 days after the check. You can delete a result sooner from the result page.
• AI assistant connections: the connection record is kept while your account exists. Disconnecting ends access but keeps the record of when the connection was used. The record is deleted when your account is deleted. Scenario descriptions sent by an assistant aren't stored; the scenarios built from them are kept like the other scenarios in that workspace.
• HubSpot: we keep the company's connection, and the link from each practice to its deal (the deal's ID, stage and amount), while the company is connected. Disconnecting HubSpot deletes them, and deleting your account deletes your links. What we already wrote to HubSpot stays in your company's HubSpot.
• Zoho CRM: we keep the company's connection, each rep's linked Zoho login, and the link from each practice to its deal (the deal's ID, stage and amount) while the company is connected. Unlinking your Zoho login deletes your link. Disconnecting Zoho CRM deletes them all and asks Zoho to end the access we held, and deleting your account deletes your links. What we already wrote to Zoho CRM stays in your company's Zoho CRM.
• Form submissions: an automatic job deletes demo requests and partner applications 24 months after you send them, and job applications 12 months after. You can ask us to delete them sooner.
• Feedback and administrator action logs: an automatic job deletes them 24 months after they were written.
• Billing records: kept for as long as tax law requires.
• Attribution cookies: 90 days for your first visit and 30 days for your latest visit.
• Backups: deleted data can remain in our encrypted database backups for up to 7 days.

Deleting your account

When you delete an individual account, we delete your workspace with all its practice sessions, transcripts, scores, coach chats and custom scenarios, remove your name, email address and phone number, and delete your sign-in account at WorkOS and any AI assistant connection. When an organization deletes a member's account, we remove the member's name, email address and phone number, delete their sign-in account at WorkOS and delete their own individual workspace if they have one; their practice records in the organization stay with it without those identifiers. In both cases, feedback the person sent is kept without their name, email address and phone number, and billing records are kept as tax law requires.

If you have an individual account, you can delete it in the app's privacy settings or by emailing reach@dehurdle.com. If you are a member of a Team, Scale or Enterprise organization, ask your organization admin. Deleting an organization deletes all of its data, and the accounts of people who belonged only to that organization.

8. Your rights

Depending on where you live, you have these rights over your personal data.

How to use your rights

• Email reach@dehurdle.com. We may ask you to confirm your identity before we act. We reply within the time the law sets, which under the GDPR is one month.
• If you use Dehurdle through an organization, the organization handles your request. Contact your organization admin; we help the organization respond.
• For a copy of your data, use the export in the app's privacy settings. It downloads your personal data as a JSON file: your profile, phone number, transcripts, scores, written feedback, speaking and camera metrics, coach chats and preferences.

Complaints

You can complain to the data protection supervisory authority where you live or work in the EU, or to the Information Commissioner's Office in the UK. In India, if we don't resolve your grievance, you can complain to the Data Protection Board of India.

9. Security

• Connections to Dehurdle use HTTPS, so data is encrypted in transit.
• Our database and cache are encrypted at rest and in transit, and can't be reached from the public internet.
• Only authorized Dehurdle staff can access customer data, and only for support and security.
• Transcripts are redacted automatically before they are saved, as described in section 3.
• Administrator actions are logged with the administrator's IP address.
• An AI assistant you connect can reach only the workspace you connected. Each of its requests is checked against your active connection, your membership of that workspace and, in a company, the company's setting.
• A company's HubSpot access is stored encrypted, and only the company's owner or Dehurdle staff can connect or disconnect it. Every request from the HubSpot card must be signed by our HubSpot app.
• A company's Zoho CRM access, and each rep's linked Zoho login, are stored encrypted. Only the company's owner or Dehurdle staff can connect or disconnect Zoho CRM. A rep can link only their own login, and only one that belongs to the company's Zoho organization. We send Zoho requests only to Zoho's own servers.

10. Data breaches

If a personal data breach affects data we process for an organization, we tell that organization without undue delay and within 72 hours of becoming aware of it, with the information it needs. The organization, as controller, notifies supervisory authorities and the people affected as the law requires.

Where Dehurdle is the controller, we notify the relevant authority and the people affected as the law requires.

11. Children

The Services are not meant for anyone under 18, and we don't knowingly collect personal data from children. If you think a child has given us personal data, email reach@dehurdle.com and we will delete it.

12. Changes to this policy

When we change this policy, we publish the new version on this page and update the date at the top.