Privacy Policy & Statutory Data Notice
Effective Date: September 2026 · Governing Law: Digital Personal Data Protection Act, 2023 (DPDP Act, Act No. 22 of 2023, Republic of India)
Statutory Notice under Section 5 of the DPDP Act, 2023:
This Privacy Policy serves as the mandatory Notice to Data Principals before or at the time of seeking consent. It is available in English, and in accordance with Section 5(3) of the DPDP Act, may be requested in any of the 22 languages specified in the Eighth Schedule to the Constitution of India (including Hindi: यह गोपनीयता नीति भारत के डिजिटल व्यक्तिगत डेटा संरक्षण अधिनियम, 2023 के तहत एक वैधानिक सूचना है) by emailing our Grievance Officer.
1. Statutory Definitions under DPDP Act, 2023
The individual to whom the personal data relates. Where such individual is a child (under 18 years of age) or a person with disability, includes the parents or lawful guardian.
Hackerrecon (“we”, “us”, “our”), operated as an independent software development sole proprietorship based in Bengaluru, Karnataka, Republic of India, recognized as a lawful Data Fiduciary under Sections 2(i) and 2(s) of the DPDP Act, 2023.
Personal data in digital form about an individual who is identifiable by or in relation to such data.
Any entity that processes personal data on behalf of the Data Fiduciary (e.g., Supabase, Dodo Payments, Cloudflare).
2. Core Privacy Guarantee: 100% Client-Side In-Browser Execution
Pursuant to the principles of Data Minimization under Section 8 of the DPDP Act, Hackerrecon implements an uncompromising privacy-by-design architecture:
All 22 Security Toolkit Utilities: Tools such as the JWT Token Inspector, Hash Identifier, CIDR Subnet Calculator, Regex Evaluator, Password Entropy Tester, and HTTP Header Inspector execute 100% locally in your browser RAM. Cryptographic keys, authorization tokens, CIDR IPs, and password strings are never transmitted to our servers.
Online Resume Builder SaaS: Candidate names, contact numbers, email addresses, career history, and A4 PDF resumes are rendered exclusively in client-side JavaScript. No resume text or applicant data is stored, cached, or uploaded to Hackerrecon servers.
CV & ATS Checker SaaS: Uploaded resumes and target job descriptions are parsed in local browser memory without persistent database retention. No resume content is logged or used to train artificial intelligence models.
Invoice Generator SaaS: Client names, GSTINs, bank accounts, and UPI QR strings remain in browser memory. Invoices are compiled into PDF files locally via the browser printing engine.
Offline System Intelligence Utility: Air-gapped diagnostics delivered to enterprise clients execute strictly on the local host with zero remote telemetry.
3. Personal Data Processed & Specific Lawful Purposes (Section 5 & 6)
In accordance with Section 5(1) and Section 6 of the DPDP Act, 2023, we process only the minimum digital personal data required for lawful and legitimate purposes:
| Category of Personal Data | Specific Purpose of Processing | Lawful Basis under DPDP Act | Retention Schedule |
|---|---|---|---|
| Email Address & Encrypted Password Hash | Account creation, license binding, and cryptographic authentication across devices. | Consent (Section 6(1)) | Until user requests account deletion. |
| Payment Transaction Metadata (Dodo Payments) | Processing one-time license fees (UPI, Cards, NetBanking), generating digital invoices, and statutory compliance with Indian GST laws. (Card numbers and UPI PINs are NEVER handled by Hackerrecon). | Contractual Fulfillment & Legal Obligation (Section 7) | Statutory tax period (7 years as required by Indian GST laws). |
| Consulting & Technical Audit Target URLs (Enterprise Engagements) | Execution of authorized malware cleanup and technical SEO audits under mutual Non-Disclosure Agreement (NDA). | Explicit Contractual Agreement | Permanently wiped 30 days after final sign-off. |
| Google OAuth Profile (Optional Sign-In) | Seamless single sign-on authentication (reads email and public profile name only). | Consent (Section 6(1)) | Duration of active account. |
4. Your Rights under the DPDP Act, 2023
As a Data Principal under Indian law, you are entitled to exercise the following statutory rights at zero cost:
You have the right to request a summary of the personal data being processed by us, a description of the processing activities, and the identities of all Data Processors with whom your data has been shared.
You have the right to correct inaccurate or misleading personal data, complete incomplete data, update outdated records, and demand permanent erasure of personal data that is no longer required for its lawful purpose.
You have the right to access a fast-track, readily available grievance redressal mechanism provided by Hackerrecon to resolve any complaint regarding our obligations under the DPDP Act.
You have the right to nominate, in the prescribed manner, another individual who shall exercise your rights as a Data Principal in the event of your death or incapacity.
5. Consent Management & Withdrawal of Consent (Section 6)
When processing is grounded in consent under Section 6(1) of the DPDP Act, your consent is obtained through clear affirmative action. In accordance with Section 6(4), you have the right to withdraw your consent at any time, and the procedure for withdrawal is as seamless and accessible as giving consent.
Upon withdrawal of consent, we shall cease processing your personal data within 48 hours and instruct all authorized Data Processors to erase such data, unless retention is required by Indian law (such as GST audit logs).
6. Protection of Children & Persons with Disabilities (Section 9)
Hackerrecon does not knowingly collect or process personal data from children under the age of 18 without verifiable consent from their parent or legal guardian.
- We do not engage in behavioral tracking, profiling, or targeted advertising directed at children.
- We do not process any personal data of children that is likely to cause any detrimental effect on their well-being.
- If we discover that personal data of a minor has been collected without parental consent, we immediately purge the data from all storage within 24 hours.
7. Reasonable Security Safeguards & Breach Protocol (Section 8(5) & 8(6))
Hackerrecon implements enterprise-grade technical and organizational security controls to protect digital personal data:
Personal Data Breach Notification (Section 8(6)): In the unlikely event of an unauthorized personal data breach, Hackerrecon will promptly notify the Data Protection Board of India (DPBI) and each affected Data Principal in such form and manner as prescribed under the DPDP Act.
8. Cross-Border Data Transfers (Section 16)
Hackerrecon stores core customer authentication data in secure data centers (including AWS Mumbai / ap-south regions via Supabase). Any transfer of personal data outside India complies with Section 16 of the DPDP Act, ensuring that data is never transferred to any country or territory restricted by the Central Government of India.
9. Data Protection Officer & Grievance Redressal Details
In fulfillment of our statutory obligations under Section 13 of the DPDP Act, 2023, Hackerrecon has designated a dedicated Grievance Redressal Officer to address all queries, concerns, and rights requests:
10. Right to Complain to the Data Protection Board of India (DPBI)
If you are not satisfied with the resolution provided by our Grievance Redressal Officer, or if we fail to respond to your grievance within the prescribed statutory period, you have the legal right under Section 13(4) of the DPDP Act, 2023 to file a formal complaint before the:
11. Amendments & Updates to this Notice
Hackerrecon may update this Statutory Privacy Notice periodically to reflect changes in regulatory notifications, rules framed under the DPDP Act, 2023, or platform features. Significant amendments will be announced through a prominent notice on our homepage or via email to registered users.