Privacy Policy
This is our notice to you under the Digital Personal Data Protection Act, 2023 (DPDP Act). It explains what personal data Identty processes, why, and how you stay in control.
Last updated 4 November 2026 · Version 2026-11-04
Who we are
Identty is a product of Zlaark, a sole proprietorship of Kanish Kumar. Zlaark decides why and how personal data is processed through Identty (the website at identty.si and the Identty mobile app), which makes it the Data Fiduciary under the DPDP Act. You are the Data Principal.
Contact: [email protected]. Our Grievance Officer is Kanish Kumar; see the Grievance redressal page.
What this policy covers
It applies to personal data we process when you visit identty.si, create an account, use the Identty apps, or contact us. It does not cover websites you reach through links on a profile, or information you choose to make public and which others then copy.
Personal data we process and why
We process only the data below, and only for the purposes next to it. If we want to use your data for a new purpose we will tell you and, where the law requires, ask for your consent again.
| Data | Examples | Why we process it |
|---|---|---|
| Account data | Email address, name, sign-in identifiers (including your Google account ID if you use Google sign-in) | To create and secure your account, sign you in and send sign-in codes. |
| Profile and career content you add | Headline, location, experience, education, skills, projects, resumes, portfolio items, achievements, job applications, interview notes, services, proposals, testimonials | To provide the features you use and to build the profile and documents you ask for. |
| Files you upload | Profile photo, portfolio images, credential documents (certificates) | To store and display them as you direct. Credential documents are private. |
| Messages you send or receive through Identty | Client inquiries, proposal responses, feedback comments, testimonials | To deliver them to the right person and let you manage them. |
| Technical and security data | IP address, device and browser details, sign-in sessions, one-time codes (stored only as hashes), request logs | To keep the service secure, prevent abuse and fraud, apply rate limits and diagnose faults. |
| Usage information | Which features are used and how often, as anonymous counts; profile view and share events | To understand which features matter and to show you the analytics for your own profile. Platform-wide feature counts are anonymous and are not linked to you. |
| Website usage analytics | Pages visited and sign-up steps completed on identty.si, with an approximate country and the browser and device type. No cookies are used, your IP address is not stored, and nothing is linked to your account. | To see how people use the site and fix points where they get stuck. Collected by Umami, which we run ourselves; it honours your browser’s Do Not Track setting. |
| Error reports | Technical details of a crash or error (the error message, the page or route, and the browser or app version). Request contents, headers, cookies and sign-in tokens are removed before a report is sent. | To find and fix faults. Stored in GlitchTip, which we run ourselves, for about 90 days. |
| Consent records | Which version of the Terms and this Policy you accepted, when, and from which IP address | To keep a record of your consent, as the DPDP Act requires. |
| Communications with us | Emails and grievances you send us | To respond to you and meet our legal obligations. |
We do not knowingly collect sensitive categories such as health, financial account numbers, or government identity numbers. Please do not upload documents that contain them (for example, an Aadhaar or PAN number) unless you have redacted them.
Consent
We process your personal data on the basis of your consent, given when you create an account by ticking the box that links to this Policy and the Terms. Your consent is free, specific, informed and unambiguous, and limited to the purposes above. We may also process data without consent where the DPDP Act permits it, for example to comply with the law or a court order.
You can withdraw consent at any time, and it should be as easy as giving it: delete your account from Settings → Privacy & data, or write to [email protected]. Withdrawal does not affect processing done before you withdrew. Because Identty cannot work without your account data, withdrawing consent means we can no longer provide the service to you, and we will erase your data as described below.
What is public and what is private
- Your public profile at identty.si/@yourname shows only the sections you choose to make visible. Contact details such as your email are hidden unless you turn them on.
- Portfolio images and your profile photo are served from public storage so they can appear on public pages. Anyone with the exact link can open them.
- Credential documents (such as certificates) are stored in private storage, are never public, and can only be opened by you through short-lived signed links.
- Private share links (for example a client portal or an unpublished project) can be revoked.
Where data is processed
Our providers may store and process data on servers outside India. We transfer personal data outside India only to the extent the DPDP Act and any restrictions notified by the Government of India permit, and we require our processors to apply appropriate safeguards.
How long we keep data
| Data | How long |
|---|---|
| Account, profile and content | Until you delete your account (or we delete it as described below). |
| Uploaded files | Until you delete the item or your account. |
| One-time sign-in codes | Expire after 10 minutes; hashed records are cleaned up afterwards. |
| Sign-in sessions | Up to 30 days, or until you sign out or an administrator revokes them. |
| Consent records | For as long as your account exists, so we can show what you agreed to. |
| Security and abuse logs | Kept for a limited period needed to protect the service, then removed. |
| Grievances and correspondence | Kept while the matter is open and for a reasonable period after. |
When you delete your account we erase your profile, content, files and related records. We may keep limited data only where the law requires it or to deal with a dispute. Copies held in routine backups are removed as those backups expire. Inactive accounts may be removed after we give you notice.
Security and breaches
We use reasonable security safeguards, including encryption in transit, hashed one-time codes, revocable sessions, rate limiting, private storage for sensitive documents and access controls. See the Security page. If a personal data breach affects you, we will tell you and notify the Data Protection Board of India as the law requires.
Children
Identty is for people aged 18 and over. We do not knowingly process the personal data of children and we do not offer a way to obtain verifiable parental consent. If you believe a child has an account, write to [email protected] and we will delete it.
Your rights as a Data Principal
- Access: get a summary of the personal data we process and who we shared it with. You can download your data yourself from Settings → Privacy & data → Export my data.
- Correction, completion and updating: edit your profile and content in the app at any time.
- Erasure: delete your account and data from Settings → Privacy & data → Delete account.
- Grievance redressal: raise a complaint with our Grievance Officer. You should use this first. If it is not resolved, you may complain to the Data Protection Board of India.
- Nominate: name another person to exercise your rights if you die or become incapacitated, by writing to [email protected].
We answer data-rights requests within 30 days. See Your data rights for how to make a request.
Your duties as a Data Principal
The DPDP Act also places duties on you. Please:
- comply with the laws that apply to you when you use Identty;
- do not impersonate anyone or suppress material information when providing your details;
- provide only authentic information and do not file false or frivolous grievances or complaints; and
- do not upload personal data about other people unless you are allowed to.
AI features
Some features (such as rewriting a resume bullet, matching a resume to a job, or mock-interview feedback) use AI. When you use them, the text you submit is sent to an AI provider to produce the response, with obvious personal identifiers removed where we can. AI output may be wrong; you decide whether to use it. We do not make decisions about you with legal or similar effect using AI.
Changes to this policy
If we change this Policy in a way that matters, we will update the date and version at the top and, where the law requires, ask for your consent again. Current version: 2026-11-04.
Contact and complaints
Kanish Kumar, Grievance Officer, Zlaark
Email: [email protected]
We acknowledge complaints within 24 hours and aim to resolve them within 15 days.