Privacy Policy

1. Data Controller

The data controller for your personal data is TinKern Labs, Hyderabad, Telangana, India. For privacy-related enquiries, contact us at hello@tinkernlabs.com.

2. Information We Collect

We collect the following categories of data:

• Account data: Name, email address, and authentication credentials when you register or sign in via a third-party provider (e.g., Google OAuth).
• Usage data: Diagrams and text you submit as practice solutions, evaluation scores, and session activity (e.g., problems attempted, timestamps).
• Technical data: IP address, browser type, operating system, and device identifiers collected automatically when you access the Service.
• Cookie data: Small files placed on your device for session management and preference storage. See our Cookie Policy for details.

3. How We Use Your Data

• To provide and operate the Service (your submissions are processed by our AI evaluation pipeline).
• To manage your account and authenticate your sessions.
• To improve the quality and accuracy of our AI feedback models using anonymised, aggregated data.
• To communicate with you about the Service, including transactional emails (account confirmation, password reset).
• To comply with our legal obligations.

We do not use your data for advertising, and we do not sell or rent your data to any third party.

4. Legal Basis for Processing

Our primary legal framework is the Digital Personal Data Protection Act, 2023 (DPDP Act) of India. Where you are located in the European Economic Area (EEA) or the United Kingdom, we process your data in accordance with the GDPR on the following bases:

• Performance of a contract: Processing necessary to provide the Service you signed up for.
• Legitimate interests: Improving our AI evaluation quality using anonymised data.
• Legal obligation: Complying with applicable Indian and international law.

5. Third-Party Services

We use the following sub-processors to operate the Service. Each has its own privacy programme and data protection commitments:

• Supabase — database hosting and authentication. Data may be stored on servers in the EU or US. Supabase is SOC 2 Type II compliant.
• Vercel — web hosting and edge delivery. Infrastructure spans multiple regions globally.
• Anthropic / Google / OpenAI — AI model providers used to generate evaluation feedback. Your submission content is transmitted to these providers solely for the purpose of generating a response and is not used to train their models under our API agreements.

We do not share your personal data with any other third parties without your explicit consent, except where required by law.

6. Data Retention

We retain your account data and submissions for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law (e.g., financial records) or for legitimate interests (e.g., aggregated, non-identifiable analytics).

7. Security

We implement industry-standard security measures, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. No system is completely secure. If you believe your account has been compromised, contact us immediately at hello@tinkernlabs.com.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate or incomplete data.
• Erasure:Request deletion of your personal data (“right to be forgotten”), subject to legal retention obligations.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdrawal of consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email us at hello@tinkernlabs.com. We will respond within 30 days in accordance with applicable law.

9. Cookies

We use cookies for session management and user preferences. For full details, including how to manage or opt out, see our Cookie Policy.

10. International Data Transfers

As we use cloud infrastructure (Supabase, Vercel) with servers outside India, your data may be transferred to and processed in other countries. Where such transfers occur, we ensure appropriate safeguards are in place, consistent with our obligations under the DPDP Act 2023 and, where applicable, the GDPR.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via the Service or by email. Continued use of the Service after changes are published constitutes acceptance of the revised Policy.

12. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes relating to this Policy shall be subject to the exclusive jurisdiction of the courts of Hyderabad, Telangana, India.

13. Contact