Privacy Policy

1. Overview & Data Fiduciary

Under the Digital Personal Data Protection Act, 2023, Wefik Agency acts as the Data Fiduciary regarding the personal information collected via wefik.world. We determine the purpose and means of data processing solely to provide our digital marketplace services, authenticate users, fulfill software downloads, manage licenses, and safeguard platform security.

2. Information We Collect

We collect only the minimum personal data required to operate our service:

• Account & Identity Data: Your email address, full name, display name, optional avatar image, and optional secondary recovery email.
• Authentication & Security Data: Encrypted password hashes (managed exclusively by Supabase Auth; we never store plain text passwords), two-factor authentication (TOTP) enrollment status, active login session timestamps, and client user-agent strings to display your active devices.
• Transaction & Order Data: Order IDs, products purchased, license tier, amount in paise, timestamp, and Razorpay payment identifiers. We do not collect or store credit card numbers, CVVs, or UPI PINs.
• Licensing & Technical Usage Data: Cryptographically generated license keys (`WFK-XXXX`), domain names you whitelist for license activation, and signed download request timestamps to enforce rate limits.
• Communications: Messages and details submitted via our contact and feedback forms.

3. Purposes of Processing

We process your personal data for the following legitimate purposes:

• To create and manage your customer account and authenticate your sign-in.
• To fulfill orders, issue cryptographic license keys, and generate secure time-limited download URLs.
• To transmit transactional emails: order receipts, password resets, 2FA security alerts, and recovery OTPs.
• To enforce sliding-window rate limits and prevent brute-force attacks and abuse.
• To comply with statutory financial, tax, and accounting reporting requirements.

4. Third-Party Service Processors

We do not sell, rent, or trade your personal data. We share specific data elements only with vetted cloud processors necessary to deliver our services:

5. Cookies & Local Storage

We use strictly necessary cookies to maintain authenticated user sessions and persist your UI theme preferences (dark mode vs. light mode). We do not load invasive third-party cross-site advertising trackers or sell browsing data to data brokers. For comprehensive details, see our Cookie Policy.

6. User Rights (India DPDP Act 2023)

As a data principal under the Digital Personal Data Protection Act, 2023, you have clear legal rights regarding your personal data:

• Right to Access: You can review your profile, licenses, and order history anytime in your Account Center.
• Right to Correction: You can update your full name, display name, avatar, and recovery email directly under Settings.
• Right to Erasure (Account Deletion): You may permanently delete your account in the Danger Zone of your Security settings. Active memberships must be cancelled first. Upon deletion, personal profile data and avatars are expunged.
• Right to Grievance Redressal: You may register concerns regarding your data processing directly with our Grievance Officer.

7. Data Retention & Anonymization

We retain personal data only for as long as your account remains active. When you delete your account, your profile and authentication records are deleted from active systems.

However, in compliance with Indian tax legislation and commercial accounting regulations, completed financial order records (`orders`, `order_items`) are retained in an anonymized format for statutory statutory auditing periods. [FOUNDER: Confirm tax and financial records retention window, standard is 7-8 years under Indian tax laws].

8. Security Architecture

We employ enterprise-grade security controls to protect your data:

• All web traffic is forced over HTTPS using 256-bit TLS encryption.
• PostgreSQL database tables and avatar cloud buckets enforce Row-Level Security (RLS) policies. User A cannot view User B’s data.
• Passwords must meet strict entropy rules and are automatically checked against the HaveIBeenPwned k-anonymity database to block compromised passwords.
• Zero-trust Edge Functions running in Deno handle privileged operations using isolated server-side credentials.

9. Children’s Personal Data

Wefik.world is a commercial software platform for professional developers, agencies, and businesses. We do not knowingly collect or solicit personal data from children under the age of 18. If we become aware that a child has registered an account without parental consent, we will delete the account promptly.

10. Data Protection & Grievance Contact

For data access inquiries, DPDP Act rights execution, or privacy concerns, contact our designated Grievance Desk: