Legal & trust centre

Privacy Policy

This is our notice to you under the Digital Personal Data Protection Act, 2023 (DPDP Act). It explains what personal data Identty processes, why, and how you stay in control.

Last updated 4 November 2026 · Version 2026-11-04

Who we are

Identty is a product of Zlaark, a sole proprietorship of Kanish Kumar. Zlaark decides why and how personal data is processed through Identty (the website at identty.si and the Identty mobile app), which makes it the Data Fiduciary under the DPDP Act. You are the Data Principal.

Contact: [email protected]. Our Grievance Officer is Kanish Kumar; see the Grievance redressal page.

What this policy covers

It applies to personal data we process when you visit identty.si, create an account, use the Identty apps, or contact us. It does not cover websites you reach through links on a profile, or information you choose to make public and which others then copy.

Personal data we process and why

We process only the data below, and only for the purposes next to it. If we want to use your data for a new purpose we will tell you and, where the law requires, ask for your consent again.

DataExamplesWhy we process it
Account dataEmail address, name, sign-in identifiers (including your Google account ID if you use Google sign-in)To create and secure your account, sign you in and send sign-in codes.
Profile and career content you addHeadline, location, experience, education, skills, projects, resumes, portfolio items, achievements, job applications, interview notes, services, proposals, testimonialsTo provide the features you use and to build the profile and documents you ask for.
Files you uploadProfile photo, portfolio images, credential documents (certificates)To store and display them as you direct. Credential documents are private.
Messages you send or receive through IdenttyClient inquiries, proposal responses, feedback comments, testimonialsTo deliver them to the right person and let you manage them.
Technical and security dataIP address, device and browser details, sign-in sessions, one-time codes (stored only as hashes), request logsTo keep the service secure, prevent abuse and fraud, apply rate limits and diagnose faults.
Usage informationWhich features are used and how often, as anonymous counts; profile view and share eventsTo understand which features matter and to show you the analytics for your own profile. Platform-wide feature counts are anonymous and are not linked to you.
Website usage analyticsPages visited and sign-up steps completed on identty.si, with an approximate country and the browser and device type. No cookies are used, your IP address is not stored, and nothing is linked to your account.To see how people use the site and fix points where they get stuck. Collected by Umami, which we run ourselves; it honours your browser’s Do Not Track setting.
Error reportsTechnical details of a crash or error (the error message, the page or route, and the browser or app version). Request contents, headers, cookies and sign-in tokens are removed before a report is sent.To find and fix faults. Stored in GlitchTip, which we run ourselves, for about 90 days.
Consent recordsWhich version of the Terms and this Policy you accepted, when, and from which IP addressTo keep a record of your consent, as the DPDP Act requires.
Communications with usEmails and grievances you send usTo respond to you and meet our legal obligations.

We do not knowingly collect sensitive categories such as health, financial account numbers, or government identity numbers. Please do not upload documents that contain them (for example, an Aadhaar or PAN number) unless you have redacted them.

What is public and what is private

  • Your public profile at identty.si/@yourname shows only the sections you choose to make visible. Contact details such as your email are hidden unless you turn them on.
  • Portfolio images and your profile photo are served from public storage so they can appear on public pages. Anyone with the exact link can open them.
  • Credential documents (such as certificates) are stored in private storage, are never public, and can only be opened by you through short-lived signed links.
  • Private share links (for example a client portal or an unpublished project) can be revoked.

Who we share data with

We do not sell your personal data and we do not use it for advertising. We share it only with:

  • Processors that help us run Identty (hosting, database, file storage, email delivery, AI). They act on our instructions. The current list is on the Sub-processors page.
  • People you choose: viewers of your public profile, and recipients of the links you share.
  • Authorities where we are required to by law, a court order or a lawful request, and to protect rights, safety and security.

Where data is processed

Our providers may store and process data on servers outside India. We transfer personal data outside India only to the extent the DPDP Act and any restrictions notified by the Government of India permit, and we require our processors to apply appropriate safeguards.

How long we keep data

DataHow long
Account, profile and contentUntil you delete your account (or we delete it as described below).
Uploaded filesUntil you delete the item or your account.
One-time sign-in codesExpire after 10 minutes; hashed records are cleaned up afterwards.
Sign-in sessionsUp to 30 days, or until you sign out or an administrator revokes them.
Consent recordsFor as long as your account exists, so we can show what you agreed to.
Security and abuse logsKept for a limited period needed to protect the service, then removed.
Grievances and correspondenceKept while the matter is open and for a reasonable period after.

When you delete your account we erase your profile, content, files and related records. We may keep limited data only where the law requires it or to deal with a dispute. Copies held in routine backups are removed as those backups expire. Inactive accounts may be removed after we give you notice.

Security and breaches

We use reasonable security safeguards, including encryption in transit, hashed one-time codes, revocable sessions, rate limiting, private storage for sensitive documents and access controls. See the Security page. If a personal data breach affects you, we will tell you and notify the Data Protection Board of India as the law requires.

Children

Identty is for people aged 18 and over. We do not knowingly process the personal data of children and we do not offer a way to obtain verifiable parental consent. If you believe a child has an account, write to [email protected] and we will delete it.

Your rights as a Data Principal

  • Access: get a summary of the personal data we process and who we shared it with. You can download your data yourself from Settings → Privacy & data → Export my data.
  • Correction, completion and updating: edit your profile and content in the app at any time.
  • Erasure: delete your account and data from Settings → Privacy & data → Delete account.
  • Grievance redressal: raise a complaint with our Grievance Officer. You should use this first. If it is not resolved, you may complain to the Data Protection Board of India.
  • Nominate: name another person to exercise your rights if you die or become incapacitated, by writing to [email protected].

We answer data-rights requests within 30 days. See Your data rights for how to make a request.

Your duties as a Data Principal

The DPDP Act also places duties on you. Please:

  • comply with the laws that apply to you when you use Identty;
  • do not impersonate anyone or suppress material information when providing your details;
  • provide only authentic information and do not file false or frivolous grievances or complaints; and
  • do not upload personal data about other people unless you are allowed to.

AI features

Some features (such as rewriting a resume bullet, matching a resume to a job, or mock-interview feedback) use AI. When you use them, the text you submit is sent to an AI provider to produce the response, with obvious personal identifiers removed where we can. AI output may be wrong; you decide whether to use it. We do not make decisions about you with legal or similar effect using AI.

Cookies

We use only the cookies and browser storage needed to keep you signed in and remember your settings. See the Cookie Policy.

Changes to this policy

If we change this Policy in a way that matters, we will update the date and version at the top and, where the law requires, ask for your consent again. Current version: 2026-11-04.

Contact and complaints

Kanish Kumar, Grievance Officer, Zlaark

Email: [email protected]

We acknowledge complaints within 24 hours and aim to resolve them within 15 days.