Privacy Policy

profession.bio is a static website hosting platform that provides personal subdomains (e.g., yourname.profession.bio) to individuals for the purpose of hosting static HTML websites.

For the purposes of this policy, profession.bio is the Data Fiduciary as defined under the DPDP Act, 2023 — the entity that determines the purpose and means of processing your personal data.

• Service: profession.bio
• Contact: support@profession.bio
• Jurisdiction: India

We collect only the minimum data necessary to provide our service. The categories of data we process are:

Account Data (provided by you):

• Email address — used for account identification, email verification, password resets, and service communications
• Password — stored as a one-way cryptographic hash (bcrypt); the plaintext is never retained
• Subdomain name — the label you choose for your personal URL (e.g., "yourname" in yourname.profession.bio)

Payment Data (processed by Razorpay, not stored by us):

• We do not collect or store card numbers, bank account details, or UPI IDs
• We record transaction IDs, order IDs, payment amounts, and payment status (paid / failed) for billing and audit purposes
• All payment credentials are handled exclusively by Razorpay under their own privacy policy

Technical / Usage Data (collected automatically):

• Server logs — IP address, request path, HTTP method, response code, and timestamp. Retained for up to 30 days for security and abuse prevention
• Site visit counts — an anonymous pixel records aggregate visit counts for your hosted subdomain. No personally identifiable visitor data is collected; no tracking cookies are set on visitor browsers
• Referral tracking — if you arrived via a referral link, we record which referral code was used, tied to your account. No third-party tracking pixels are involved

Uploaded Site Files:

• ZIP files you upload contain your HTML/CSS/JS files. These are stored on our server for the purpose of serving your website
• We do not analyse, read, or process the content of your files beyond scanning for file type and size constraints at upload time

We use the data we collect solely for the following purposes:

• Account management: Authenticating your login, verifying your email, and allowing password resets
• Service delivery: Provisioning your subdomain, deploying your uploaded files, and serving your live website
• Payment processing: Creating and verifying payment orders via Razorpay
• Communications: Sending transactional emails (verification, payment confirmation, renewal reminders, suspension notices). We do not send unsolicited marketing emails
• Security & abuse prevention: Detecting and preventing unauthorized access, content policy violations, and misuse
• Analytics: Providing you with aggregate visit counts for your own hosted site
• Legal compliance: Retaining records as required by applicable law

Under India's Digital Personal Data Protection Act, 2023, we process your personal data on the following lawful bases:

• Consent: You give explicit consent when you register an account and agree to our Terms & Conditions and this Privacy Policy
• Contract performance: Processing necessary to fulfil the hosting service you have subscribed to
• Legitimate interests: Security logging, abuse prevention, and service integrity — balanced against your privacy rights
• Legal obligation: Retention of transaction records as required by applicable tax and financial regulations in India

profession.bio uses a minimal number of cookies, all strictly necessary for the service to function. We do not use advertising cookies, third-party tracking cookies, or analytics platforms like Google Analytics.

Session Cookie (strictly necessary):

• Name: PHPSESSID
• Purpose: Maintains your logged-in session so you do not need to log in on every page
• Duration: Expires when you close your browser, or after a period of inactivity
• Type: Strictly necessary — cannot be opted out of while using the service

Referral Cookie (functional):

• Purpose: Records which referral link brought you to profession.bio, so the referrer can receive their commission if you sign up
• Duration: 30 days
• Type: Functional — set only if you arrive via a referral link

We use a small number of third-party services to deliver profession.bio. Each handles data under its own privacy policy:

• Razorpay (payment processing) — collects and processes payment credentials. Their privacy policy is at razorpay.com/privacy. We receive only confirmation of payment success/failure and a transaction ID.
• Google Fonts (typography) — fonts are loaded from Google's CDN (fonts.googleapis.com). Google may log the request IP as part of their standard CDN operations. No cookies are set. See Google's Privacy Policy.
• SunlightHost (server infrastructure) — our hosting infrastructure is provided by SunlightHost. Server files and logs reside on their infrastructure. They are a data processor acting on our instructions.

We do not integrate Facebook Pixel, Google Analytics, HotJar, Intercom, or any other behavioural analytics or advertising platform.

We retain personal data only as long as necessary for the purpose it was collected:

• Account data — retained for the lifetime of your account, plus 30 days after deletion to allow recovery if requested
• Payment records — transaction IDs and amounts are retained for a minimum of 7 years as required by Indian financial regulations (GST Act, Income Tax Act)
• Server logs — IP address and access logs are retained for up to 30 days, then deleted automatically
• Uploaded site files — retained while your hosting subscription is active and for up to 7 days after account deletion or subdomain termination
• Email addresses of deleted accounts — hashed email references may be retained in our logs for up to 90 days post-deletion for abuse prevention, after which they are permanently removed

As a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access: Request a summary of the personal data we hold about you and how it is being used
• Right to correction: Request correction of inaccurate or incomplete personal data
• Right to erasure: Request deletion of your personal data and account. We will erase your data within 7 days, subject to legal retention obligations (e.g. transaction records)
• Right to grievance redressal: Raise a complaint with our Grievance Officer (contact in Section 12) and receive a response within a reasonable time
• Right to nominate: Nominate another individual to exercise your rights in the event of your death or incapacity
• Right to withdraw consent: Withdraw consent at any time by closing your account. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal

To exercise any of these rights, email support@profession.bio with the subject line "Privacy Request". We will respond within 30 days.

We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse:

• Password hashing: Passwords are stored using bcrypt — never in plaintext
• HTTPS everywhere: All connections to profession.bio and its subdomains are served over HTTPS with valid SSL certificates
• CSRF protection: All state-changing actions require a valid CSRF token
• Rate limiting: Login and public endpoints are rate-limited to prevent brute-force attacks
• Session security: Sessions are regenerated on login and have secure, HttpOnly flags set
• Access controls: Administrative functions require separate authentication; user data is isolated per account

No system is completely secure. In the unlikely event of a data breach that creates a high risk to your rights, we will notify you and relevant authorities as required by applicable law.

profession.bio is not directed at or intended for use by children under the age of 18 years. We do not knowingly collect personal data from minors.

If we become aware that we have inadvertently collected personal data from a person under 18, we will delete that data promptly. If you believe your child has registered an account, please contact us at support@profession.bio.

We may update this Privacy Policy from time to time. We will notify active account holders via email when material changes occur. The "Last updated" date at the top of this page will always reflect the most recent revision.

Continued use of the service after the effective date of an updated policy constitutes acceptance of the revised terms.

For privacy-related queries, data access or deletion requests, or to raise a complaint:

• Email (Grievance Officer): support@profession.bio
• Subject line: "Privacy Request" or "Privacy Complaint"
• WhatsApp: +91 94900 98720
• Response time: We aim to respond within 30 days

If you are not satisfied with our response, you may approach the Data Protection Board of India (once constituted under the DPDP Act, 2023) or seek other remedies available under Indian law.