Comprehensive Privacy and Data Protection Policy

Huelip's data handling protocols are meticulously designed and rigorously enforced to ensure absolute compliance with the Digital Personal Data Protection (DPDP) Act of India, alongside other applicable international data privacy standards. We operate on the foundational principles of data minimization, purpose limitation, and explicit consent.

To provide our specialized fintech and project management services, Huelip collects data across several operational vectors:

• Identity and Demographic Data: Full legal name, date of birth, government-issued identification numbers (PAN, Aadhaar, GSTIN), residential address, and corporate entity documentation required for KYC.
• Financial and Transactional Data: Bank account numbers, IFSC codes, UPI IDs, credit/debit card details (processed securely via our payment provider), transaction histories, escrow deposit logs, and milestone payout receipts.
• Technical and Device Data: IP addresses, browser types, operating systems, hardware identifiers, geographic location data, session durations, and interaction heatmaps to ensure platform security and optimize user experience.
• Project and Operational Data: Architectural blueprints, site photographs, communication logs within the platform's messaging system, contract terms, and dispute mediation records.

Huelip processes your personal data strictly for the following operational necessities, grounded in the lawful basis of contractual necessity and statutory compliance:

• Escrow Execution: Routing funds securely, verifying milestones, and triggering precise financial payouts through Excro's escrow setup.
• Regulatory Compliance: Adhering to anti-money laundering (AML) laws, tax reporting mandates, and RBI guidelines for financial intermediaries.
• Dispute Resolution: Maintaining an immutable, auditable log of all project communications and file transfers to provide empirical evidence during neutral mediation or legal proceedings.
• Service Optimization: Deploying technical data to debug software errors, improve server response times, and enhance the overall user interface.

Huelip guarantees that we do not, and will never, sell your personal data, financial records, or project IP to third-party data brokers or marketing agencies.

Data is disseminated strictly on a "need-to-know" basis to highly vetted, legally bound third-party partners essential for platform functionality:

• Financial Infrastructure Partners: Excro receives only the exact data required to execute a specific financial transaction.
• Identity Verification Providers: Authorized verification partners process identification documents solely for the purpose of validating user KYC and ensuring platform integrity.
• Legal and Regulatory Authorities: Huelip will disclose user data to law enforcement agencies, tax authorities, or courts of competent jurisdiction only when explicitly compelled by a valid legal subpoena, court order, or statutory mandate.

Huelip treats data security as an existential priority. We have implemented an enterprise-grade security architecture to protect your information against unauthorized access, malicious alteration, or catastrophic destruction:

• Encryption in Transit: All data transmitted between your device and our servers is secured using advanced TLS (Transport Layer Security) 1.2 or higher cryptographic protocols.
• Encryption at Rest: All sensitive personal and financial data stored on our cloud infrastructure (e.g., AWS/GCP) is encrypted using AES-256 block-level encryption.
• Access Control: Internal access to user databases is strictly governed by the principle of least privilege, requiring multi-factor authentication (MFA) and continuous audit logging for all engineering and administrative staff.
• System Audits: Huelip undergoes regular, rigorous vulnerability assessments and penetration testing conducted by independent cybersecurity firms.

Huelip retains personal and project data only for the precise duration necessary to fulfill the operational purposes outlined in this policy, or as mandated by law. Following the completion of a project and the release of all escrow funds, project-specific data (blueprints, communications) may be archived. However, financial transaction records, KYC documents, and digital contracts are retained for a minimum statutory period (typically 7 to 10 years) as mandated by Indian financial auditing and corporate laws. Upon the expiration of these statutory periods, data is permanently, cryptographically destroyed or irreversibly anonymized.

In accordance with the Digital Personal Data Protection Act, you possess the following enforceable rights regarding your personal data:

• Right to Access: You may request a comprehensive copy of the personal data Huelip holds about you.
• Right to Correction: You may mandate the immediate rectification of any inaccurate, outdated, or incomplete data.
• Right to Erasure (Right to be Forgotten): You may request the deletion of your personal data, provided there are no overriding statutory or contractual obligations requiring its retention (e.g., active escrow holds or mandatory tax logs).
• Right to Grievance Redressal: You have the right to register a formal complaint regarding data processing practices.

The Huelip Platform employs cookies, web beacons, and similar tracking technologies to ensure session persistence, enhance security, and analyze platform traffic. For details, see our Cookie & Storage Policy.

Huelip reserves the unilateral right to amend, modify, or wholly replace these Comprehensive Terms and Conditions and Privacy Policy at any time, subject to evolving technological, legal, or regulatory landscapes. In the event of a material change, registered users will receive formal notification via email or a prominent platform dashboard alert at least 15 days prior to the effective date of the new terms. Continued use of the platform following the implementation of changes constitutes affirmative acceptance of the revised agreements.

In compliance with the Information Technology Act and the DPDP Act, Huelip has appointed a dedicated Data Protection and Grievance Officer. For any legal inquiries, data subject access requests, or reports of privacy violations, please submit a formal written communication to our legal compliance department.