Privacy Policy

Last updated: 13 October 2026

This policy explains how the current Workplace check, account, reading and support services use personal data. Older records and provider-held copies are described separately. We do not sell your personal data.

Before you sign in

The current six-question answers and result are held in your browser tab before you explicitly request saving or a chapter preview through sign-in. The tab copy has a four-hour validity check and the reading/sign-in intent has a ten-minute expiry. These are application validity periods, not a guarantee that browser-controlled storage is physically erased at that instant. Closing the tab or clearing site storage may remove unsaved work.

Loading the website still sends network requests. Hosting and security systems may process IP addresses, timestamps and technical request details, so this is not a promise that no data ever leaves your device.

Account, result and reading data

Google sign-in supplies identity details needed for your account, such as your name, email, account identifier and profile image where provided. We do not receive your Google password. Saving a result records the selected diagnostic answers, result and related chapter against your account. Reading features can record progress, highlights and private practice entries where you use them.

Older diagnostic records and eligible legacy features, including Before the Room and After the Room, can contain a chosen work situation, an optional private note, planned action, review choices and timestamps. They are separate from the current six-question check. Where the legacy controls are available, you can delete an individual workplace moment or request account-level deletion.

Payments and communications

We process payment and order references, amount, status, plan, access dates and refund information to verify access and handle disputes. Razorpay or the relevant payment provider handles card, bank and UPI credentials; BNB does not store your full payment credentials. Support correspondence contains the details you choose to send. Public testimonials are handled only through the relevant submission and permission process.

Do not include employer secrets, client-confidential information or sensitive personal information. Do not send passwords, OTPs, card details or UPI PINs in notes, testimonials or support requests.

Purposes and service providers

We use data to authenticate accounts, save and retrieve work, provide authorised reading, verify payments, handle support and legal obligations, prevent misuse and investigate faults. The product uses Supabase for authentication, database and storage; Google for sign-in; Render for hosting; Razorpay for payments; Resend for transactional email; and Namecheap Private Email for support correspondence. Only data needed for the relevant service is shared. Providers may process or store data outside India.

Website certification service

Public information pages load TrustedSite to support website verification and display its certification badge when the provider's conditions are met. TrustedSite and its hosting providers may receive technical request and visit information, including your IP address and browser details, and use cookies or similar storage to count visits and operate the badge. This processing may take place outside India. See TrustedSite's privacy information.

The TrustedSite script is not loaded on questionnaire, account, saved-result, privacy-control or administrator pages. We have not added its optional conversion-tracking or shopper identity-protection integrations, or provided it with questionnaire answers, account records, order values or payment references.

Google Store Widget

Public information pages load Google's official Store Widget to display store information when Google has eligible data for this website. Google decides whether the widget appears and which ratings or quality information it shows. The widget is not a website security certificate.

Loading the widget sends Google our website origin, browser display dimensions and technical request information, such as your IP address and browser details. Google collects aggregated widget views and clicks. Its embedded content may use cookies or similar technologies, subject to your browser and Google settings, and information may be processed outside India. Google's handling of this information is explained in its Privacy Policy. You can manage Google's advertising personalisation in My Ad Center.

The widget is not loaded on questionnaire, account, saved-result, privacy-control or administrator pages. We do not send it questionnaire answers, account records, customer email addresses, order details or payment references. Google Customer Reviews purchase surveys have not been activated.

Optional Google Analytics

Google Analytics is optional and off by default. When the feature is available, we ask you to Allow analytics or No thanks before loading Google's Analytics script. Declining does not affect your ability to browse, sign in, read or pay. Your choice is kept in a first-party consent cookie for up to 180 days, and you can change it at any time in Privacy controls. If analytics has not been enabled for this release, no Google Analytics page tracking occurs regardless of your choice.

Only if you allow it, Google Analytics measures visits to our public information pages, including pages viewed and general navigation. The data may include page title, URL path without query parameters, date and time, a pseudonymous browser identifier stored in first-party cookies (such as _ga and _ga_*), and browser, device and approximate location information inferred from technical requests. Google may process this data outside India. See Google's Privacy Policy. We do not send your workplace-check answers, private notes, sign-in details, email, full payment information or account pages as optional Google Analytics page views.

Google Analytics consent here does not enable Google Ads remarketing, personalised advertising, session recordings or behavioural-event ingestion. Those remain off. Verified payment, delivery, fraud-prevention and security records are processed for operating the service independently of this optional choice. Any later use of purchase data for Google Analytics or advertising attribution requires its own review and appropriate disclosure and controls.

Withdrawing consent stops future optional page tracking on this website and attempts to remove associated first-party analytics cookies. It cannot undo information already received by Google or automatically delete information held by other providers. For questions about earlier records, contact hello@builtnotborn.in. TrustedSite's visit counting and Google's Store Widget are described separately above.

Older AI-assisted features

The current six-question result and chapter mapping use defined product logic rather than an AI service. Earlier diagnostic features may have used AI infrastructure to help phrase an explanation from a supplied workplace moment. Historical processing records may still be held by those providers. Contact us about relevant historical data or provider-held records.

Privacy requests and your controls

Privacy controls provide account-linked product-data export and display-name correction after sign-in. The export does not include external providers' records or historic acquisition records whose ownership has not been reliably established. Email us for assisted access, correction, consent withdrawal or deletion requests, including questions about these exclusions. Verification is limited to what is proportionate to protect the account; we will not ask for your password or OTP.

Withdrawing data needed to deliver a feature may prevent further delivery of that feature. Requests and remedies are handled under the law applicable when the request is made; statutory rights are not waived by using this website.

Retention, deletion and backups

Account, saved-result and reading data are retained while needed to provide the account experience, subject to deletion requests and justified legal exceptions. Support correspondence is retained while needed to handle the request and any related dispute. Financial and security records can have different legal retention requirements.

An accepted account-deletion request is not the same as a completed deletion. Eligible operational records are removed through a controlled process. Where financial or payment evidence must remain, the active application-account link is detached and replaced by a minimised non-public reference. Deletion does not automatically create a refund, and a refund does not require deleting your account.

Backups, security records and provider-controlled copies may remain until their applicable retention or expiry periods end. When responding to your deletion request, we explain what has been deleted, which records remain, why they are retained and any provider actions still pending.

Security and updates

We use HTTPS, authentication, server-authorised access and account controls. No online system is guaranteed secure. Report suspected unauthorised access using the contact above. We assess reported incidents and notify affected users or authorities when required by applicable law.

We update this policy when our data handling or applicable legal requirements change. Material changes will carry a revised date and appropriate notice.