Privacy Policy

1. Who We Are

Bodhi Research ("Bodhi", "we", "us") is a product of Little Shepherd Network, a registered MSME in India, owned and operated by Sunder Pal. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our platform at bodhiresearch.in.

This policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

2. Data We Collect

We do NOT collect: passwords, phone numbers, physical addresses, Aadhaar/PAN details, bank account details, credit/debit card numbers (handled entirely by Razorpay), or biometric data.

3. How We Use Your Data

• To provide and maintain the Bodhi platform and its features
• To authenticate your identity and manage your account
• To process payments and manage subscriptions
• To send transactional emails (payment confirmations, account changes)
• To improve the platform based on aggregated, anonymized usage patterns

We do not sell, rent, or share your personal data with any third party for marketing purposes.

4. Legal Basis for Processing

• Consent: You consent to data collection when you sign in with Google and use the platform.
• Contractual necessity: Processing is necessary to deliver the service you subscribed to.
• Legitimate interest: Improving platform performance and preventing abuse.
• Legal obligation: Compliance with applicable Indian laws.

5. Third-Party Services

We use the following third-party services that may process your data:

Academic search APIs (OpenAlex, Semantic Scholar, CORE, ArXiv, CrossRef, PubMed, EuropePMC, DOAJ) receive only your search queries — no personally identifiable information is sent to them.

6. Data Storage & Security

• Your data is stored in Supabase (PostgreSQL) with Row Level Security (RLS) enabled — users can only access their own data.
• All data transmission is encrypted via HTTPS/TLS.
• Authentication is handled via industry-standard OAuth 2.0 (Google).
• We do not store passwords — authentication is delegated to Google.
• Payment data is handled entirely by Razorpay (PCI-DSS Level 1 compliant).

7. Data Retention

• Active accounts: Data is retained as long as your account is active.
• Deleted accounts: Upon account deletion request, all personal data and user-created content is permanently deleted within 30 days.
• Payment records: Transaction records are retained for 7 years as required by Indian tax law (Income Tax Act, 1961).
• Server logs: Automatically purged after 30 days.

8. Your Rights

Under the DPDP Act, 2023 and applicable law, you have the right to:

• Access: Request a copy of all personal data we hold about you.
• Correction: Request correction of inaccurate personal data.
• Erasure: Request deletion of your account and all associated personal data.
• Data portability: Export your documents and saved references.
• Withdraw consent: Withdraw consent at any time by deleting your account.
• Nominate: Nominate another person to exercise your data rights in case of your death or incapacity (as per DPDP Act).

To exercise any of these rights, email us at support@bodhiresearch.in. We will respond within 72 hours and complete the request within 30 days.

9. Cookies

Bodhi uses only essential cookies required for authentication and session management. We do not use advertising, tracking, or analytics cookies. No cookie consent banner is required as we only use strictly necessary cookies.

10. Children's Privacy

Bodhi is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If we learn that we have collected data from a minor, we will promptly delete it.

11. Cross-Border Data Transfer

Some of our service providers (Supabase, Google, Vercel) operate outside India. By using Bodhi, you consent to the transfer of your data to servers located outside India for the purpose of service delivery. These providers maintain industry-standard security certifications (SOC 2, ISO 27001).

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or in-app notification at least 15 days in advance. The "Last updated" date at the top reflects the most recent revision.

13. Grievance Officer

In accordance with the IT Act, 2000, the DPDP Act, 2023, and the rules thereunder: