Privacy Notice
This notice explains what personal data PinakaPolaris.ai collects, why we collect it, who we share it with, and the rights you have over it. It is issued under Section 5 of India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”), read with the DPDP Rules, 2025.
On this page
Who we are
Pinaka Green Energy Pvt. Ltd., registered at G22, Spaze Forum, Corporate Park, Sector 69, Gurugram, Haryana, India, 122001, operates PinakaPolaris.ai. In the language of the DPDP Act we are the Data Fiduciary — we decide why and how your personal data is processed. You are the Data Principal.
For anything in this notice, contact Pinaka Green at contact@pinakagreen.com.
What we collect, and why
We collect only what a green-hydrogen market-intelligence platform needs to function. We do not run advertising, analytics or behavioural-tracking software of any kind.
| Personal data | Why we collect it | Why we’re allowed to | Learn more |
|---|---|---|---|
| Name, company name, phone number, email address, LinkedIn URL | To create and operate your account, and to identify you | You agreed to it · s.6 | Read s.6 |
| Password (stored only as a bcrypt hash — never in plain text) | To authenticate you securely | You agreed to it · s.6 | Read s.6 |
| Account status, role, email-verification state, last login, last seen, password-change time | Account security, access control and abuse prevention | Allowed by law · s.7 | Read s.7 |
| Your search queries and AI-chat messages, the responses generated for you, the model used, response times, and timestamps | To return results, to power the AI assistant, and to show you your own search history | You agreed to it · s.6 | Read s.6 |
| "Associate with Polaris" enquiries: name, company, phone, email, message | To receive and reply to your enquiry. Emailed to us; not stored in our database. | You gave it to us · s.7(a) | Read s.7(a) |
| IP address | Rate-limiting the public enquiry form to prevent abuse | Allowed by law · s.7 | Read s.7 |
What does “Why we’re allowed to” mean?
You agreed to it. You actively opted in — for example by ticking the box at sign-up or by choosing to use a feature. You can withdraw your consent at any time (see section 8), and we then stop the processing that relied on it.
The law lets us, without asking separately. The DPDP Act permits a few narrow, common-sense uses — such as keeping your account secure and preventing abuse — under its “certain legitimate uses” provision. We rely on it only for the rows marked above, never for marketing.
We process your personal data only for the purposes listed above (s.4). If we ever want to use it for a new purpose, we will ask you first.
Your AI chat messages leave our servers
Both your message and the response generated for you are stored against your account so that your search-history page works. You can download or erase them yourself at any time (see section 8).
Who we share your data with
We do not sell your personal data. We share it only with the Data Processors below, each engaged to process data on our behalf (s.8(2)):
| Category of recipient | What they do | Location |
|---|---|---|
| Cloud database hosting providers | Store your account data and search history | May be outside India |
| Large-language-model (LLM) providers — Z.ai (GLM) and OpenAI | Generate AI chat responses | Outside India |
| Email delivery services | Send password-reset emails and enquiry notifications | May be outside India |
| Third-party asset services | Serve company logos and favicons on the dashboard | Outside India |
We may also disclose personal data where required by law, a court order, or a lawful request from a public authority.
Transfers outside India
Several of the processors above are located outside India, so your personal data may be transferred abroad. Section 16 of the DPDP Act permits this, subject to any country the Central Government may notify as restricted. We will stop transferring data to any territory that becomes restricted.
Cookies
We set two cookies, both strictly necessary. We use no advertising or analytics cookies.
- auth_token — an HttpOnly session token that keeps you signed in. It cannot be read by JavaScript.
- polaris_logged_in — a non-sensitive flag the interface reads to decide what to display. It contains no personal data.
How long we keep it, and security
We keep your account data for as long as your account exists. Under s.8(7) of the DPDP Act we erase personal data once you withdraw consent, or once it is reasonable to assume the purpose is no longer being served — whichever is earlier — unless a law requires us to retain it.
Your search and AI-chat history is automatically deleted 365 days after it is created. You do not have to ask. Deleting your account erases everything immediately.
We take reasonable security safeguards to prevent a personal data breach (s.8(5)). Passwords are stored as bcrypt hashes, never in plain text; session tokens are HttpOnly and transmitted over HTTPS in production; and access to the database is restricted.
If a personal data breach occurs, we will notify you and the Data Protection Board of India without delay — and, to the Board, with the detailed report the DPDP Rules, 2025 require within 72 hours — in plain language, describing what happened, the likely impact, the steps we have taken, and what you can do (s.8(6)).
Your rights
Under Chapter III of the DPDP Act you have the right to (each link opens the full section on dpdpa.com):
- Access a summary of the personal data we process about you, and the identities of everyone we have shared it with (s.11).
- Correct, complete or update personal data that is inaccurate or incomplete (s.12).
- Erase your personal data, unless we are required by law to keep it (s.12(3)).
- Withdraw your consent at any time, as easily as you gave it (s.6(4)). Doing so does not make our earlier processing unlawful, and it may mean you can no longer use the service.
- Nominate another person to exercise these rights on your behalf if you die or become incapacitated (s.14).
- Grievance redressal — see section 11 (s.13).
- Download my data gives you a JSON copy of everything we hold, including the list of processors it has been shared with (s.11).
- Delete my account withdraws your consent and permanently erases your account, search history and chat history (s.12(3), s.6(4)).
- Editing your profile fields corrects or updates your details (s.12(2)).
How we record your consent
When you create an account you tick a box confirming that you accept these documents and that you are 18 or older. We store the date, and the version of this notice you agreed to, against your account. s.6(10) of the DPDP Act places the burden on us to prove that consent was given, and this is how we meet it. Your consent record is included in your data export.
Children
PinakaPolaris.ai is a professional research tool and is not intended for anyone under the age of 18. Creating an account requires you to confirm that you are 18 or older, and we record that confirmation. We do not knowingly collect the personal data of a child. Under s.9 of the DPDP Act, processing a child's personal data requires verifiable consent from a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If you believe a child has registered, contact us and we will erase the account.
Grievances, and how to escalate
If you are unhappy with how we handle your personal data, contact Pinaka Green at contact@pinakagreen.com. We will acknowledge and respond within 90 days.
The DPDP Act requires you to exhaust our grievance process first (s.13(3)). If you remain dissatisfied, you may complain to the Data Protection Board of India. Appeals from the Board lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
Changes to this notice
We will update this page when our data practices change and revise the “last updated” date above. Where the change is material, we will tell you directly.
This document is provided for transparency and does not constitute legal advice.